Web Traffic Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: What is a 'cookie wall' and why is it generally considered non-compliant under GDPR?
- A firewall blocking tracking scripts — it's non-compliant because it breaks functionality
- A requirement to accept all cookies to access a site — it invalidates freely given consent (Correct answer)
- A page listing all cookies used — it's non-compliant if not updated monthly
- A CDN caching mechanism — it's non-compliant because it stores data without consent
Correct answer: A requirement to accept all cookies to access a site — it invalidates freely given consent
A cookie wall conditions site access on cookie acceptance, which makes consent coerced rather than freely given, violating GDPR's consent requirements.
Question 2: UTM parameters in URLs are used for web traffic attribution. Which privacy concern do they raise?
- They can expose server-side database credentials
- They may pass personal identifiers across sites via referrer headers (Correct answer)
- They prevent search engines from indexing pages correctly
- They interfere with SSL certificate validation
Correct answer: They may pass personal identifiers across sites via referrer headers
UTM parameters can inadvertently carry personal data like email addresses in referrer headers, creating cross-site data leakage risks.
Question 3: Under IAB's Transparency and Consent Framework (TCF), what is the primary purpose of a Consent Management Platform (CMP)?
- To block all third-party scripts by default
- To collect, store, and signal user consent choices to ad tech vendors (Correct answer)
- To audit website compliance with HIPAA requirements
- To generate privacy policy documents automatically
Correct answer: To collect, store, and signal user consent choices to ad tech vendors
A CMP collects user consent preferences and passes consent signals to ad tech vendors via the TCF standard.
Question 4: A SaaS analytics company processes EU user data on US servers. Which mechanism legally enables this data transfer under GDPR?
- ISO 27001 certification
- Standard Contractual Clauses (SCCs) (Correct answer)
- A registered trademark in the EU
- PCI DSS compliance certification
Correct answer: Standard Contractual Clauses (SCCs)
Standard Contractual Clauses are GDPR-approved legal mechanisms for transferring personal data from the EU to third countries like the US.
Question 5: What does 'legitimate interest' mean as a legal basis for processing under GDPR?
- The company has been in business for more than 10 years
- Processing is necessary for a purpose that outweighs the individual's privacy rights after a balancing test (Correct answer)
- The data subject has given explicit written consent
- The data is anonymized and therefore freely usable
Correct answer: Processing is necessary for a purpose that outweighs the individual's privacy rights after a balancing test
Legitimate interest allows processing when a controller's interests are balanced against the data subject's rights and are not overridden by them.
Question 6: Which of the following web traffic practices would most likely violate CAN-SPAM Act requirements?
- Tracking email open rates using tracking pixels
- Sending promotional emails without a functional unsubscribe mechanism (Correct answer)
- Using A/B subject line testing on email campaigns
- Segmenting email lists by geographic region
Correct answer: Sending promotional emails without a functional unsubscribe mechanism
CAN-SPAM requires all commercial emails to include a working opt-out/unsubscribe mechanism that is honored within 10 business days.
Question 7: In the context of web analytics compliance, what is 'IP anonymization'?
- Encrypting IP addresses in server logs
- Truncating the last octet(s) of an IP address before storage to prevent individual identification (Correct answer)
- Replacing real IPs with randomly generated UUIDs
- Using VPN tunnels to mask analytics server IPs
Correct answer: Truncating the last octet(s) of an IP address before storage to prevent individual identification
IP anonymization truncates the last portion of an IP address (e.g., the last octet) so the full address cannot identify an individual user.
Web Traffic Regulatory Frameworks & Compliance 3
What is a 'cookie wall' and why is it generally considered non-compliant under GDPR?