Americans, but only slightly.
United States companies consider several strategies for mitigating the risk that a supervisory authority might determine that they are subject to the GDPR (or the ePrivacy Directive). While some companies block European visitors from accessing their websites, and other companies configure a cookie notice to prompt only European visitors for opt-in consent, other companies choose to simply drop a smaller quantity of cookies on European visitors.
In order to help companies understand and benchmark industry practices, BCLP randomly selected a sample of 33% of the Fortune 500 companies identified as being predominantly within the “retailing” sector and then visited their homepages from a server with an IP address in the United States and from a server with an IP address in Europe.1 After excluding from the sample population those companies that blocked European visitors or sought the consent of European visitors to the deployment of cookies, BCLP measured the quantity of advertising cookies that were deployed.2
As of January 13, 2020, Fortune 500 retailers deployed, on average, 18% more advertising cookies on visitors with a United States IP address as compared with visitors with a European IP address.3
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. Websites were visited from a server in Paris France with the following IP address: 139.28.219.252.
2. Cookies were identified and classified using Ghostery for Chrome Version 8.4.4.
3. Note that some companies in the survey population maintain multiple homepages. For example, a corporation might own several different retail brands. The survey focused only on the homepage of the corporate parent (if available) and did not analyze brand-specific practices. If no corporate homepage was available the survey reviewed the website of the company’s most prevalent brand.
[View source.]
