The situation
The list of cookies, pixels and tags on the webshop
A Spanish fashion retailer runs webshops in Spain and the Netherlands. Over two years the marketing team has added an analytics tool, two advertising pixels, a heatmap tool, a chat widget, an affiliate tracker and a consent banner with a green accept button and the settings two clicks away.
Counsel has a list of 23 tags from the developers and a request to sign off a new banner by the end of the month. Each tag needs a category: strictly necessary, possibly exempt analytics, or consent required. The banner has to meet what each regulator expects, and marketing needs the result in plain terms.
What the research has to settle
The rules behind the answer
- Consent covers the device, not only personal data
- The ePrivacy Directive requires consent to store or read information on a user’s device unless it is strictly necessary for a service the user asked for, or only for carrying a communication. It applies whether or not the information is personal data.
- Consent means the GDPR standard
- Consent must be freely given, specific, informed and unambiguous. The Court of Justice held in Planet49 that a pre-ticked box is not valid consent.
- Pixels and similar techniques are included
- The EDPB’s guidelines on the technical scope of the rule treat tracking pixels and similar techniques in the same way as cookies. Replacing a cookie with a pixel does not avoid consent.
- National law and regulators shape the details
- Dutch law has a narrow exemption for analytics with little or no effect on privacy. The Spanish rules and the Spanish regulator’s guidance set their own expectations for the banner, including how easy refusing must be.
How it runs in azta
From the question to the document
The question, as you would type it
Our Dutch and Spanish webshops use an analytics tool, two advertising pixels, a heatmap tool, a chat widget and an affiliate tracker. Which need prior consent in each country, does Dutch law exempt our analytics if configured for privacy, and must the first banner layer offer a reject option?
You start with
The list of cookies, pixels and tags on the webshop
- 01
Describe the tags
List each tool, what it stores or reads and why. azta searches the ePrivacy Directive, the GDPR, the EDPB guidelines and the Dutch and Spanish law.
Cited research· Free - 02
Read the exemptions
Open the Dutch analytics exemption and the Spanish provision in the reader, in the original language, and check each condition.
Atlas statute reader - 03
Draft the consent note
Ask for a table by tag and country, with the category, the reason and the banner requirements. Edit it in Canvas.
Canvas · Ask azta· Pro - 04
Hand it to marketing
Export the note to Word for marketing and the developers, with the tags to block until consent listed first.
Word export· Pro You send
A consent requirements note per tool, for the Dutch and Spanish sites
What you get
A consent requirements note per tool, for the Dutch and Spanish sites
Consent note · draft
Webshop tags: consent requirements, Netherlands and Spain
Strictly necessary. The basket, login and load-balancing cookies are needed for the service the customer asks for. They do not need consent in either country and can be set before the banner is answered.
Consent required. Both advertising pixels, the heatmap tool and the affiliate tracker store or read information on the device for purposes the customer did not ask for. They must not fire on either site until the customer consents.
Analytics. On the Dutch site, the analytics tool may fall within the Dutch exemption if it is configured as set out in the annex. On the Spanish site we treat it as needing consent until the configuration has been reviewed against the Spanish rules.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
14 minutes a month
At €120 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 16
- Capacity at your rate
- €1,944
- More consent reviews a quarter
- 0.7
- Return on Pro
- 6×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoWhat stays with you
- The tag inventory and configuration from your developers.
- Checking each regulator’s latest cookie guidance against the note.
- The banner design and the sign-off.
Frequently asked questions
- Does azta hold the regulators’ cookie guidance?
- It holds EU law, the EDPB’s guidelines and national legislation. Not every national regulator’s guidance is in the collection, and azta says what it cites so you can see what still needs checking.
- Can it check the banner text?
- Upload or paste the text and ask. azta checks it against the consent requirements and cites them.
- Does it cover consent for marketing emails?
- Yes, as a separate question. Electronic marketing has its own consent rules under the same directive and national law.
