Web Traffic Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A/B testing platforms often share user assignment data with third-party analytics tools. The primary compliance risk is:
- A/B test results becoming publicly visible to competitors
- User data being shared with vendors who may not have appropriate data processing agreements in place (Correct answer)
- Test variants loading slower and affecting Core Web Vitals scores
- IP addresses conflicting between test groups
Correct answer: User data being shared with vendors who may not have appropriate data processing agreements in place
Sharing user data with third-party A/B testing vendors requires Data Processing Agreements (DPAs) to be in place under GDPR.
Question 2: Under GDPR, how long can organizations retain web analytics data?
- Exactly 12 months, as specified in Article 17
- No longer than necessary for the specified purpose, as determined by the controller (Correct answer)
- A maximum of 26 months as mandated by Google's default settings
- Indefinitely if the data is pseudonymized
Correct answer: No longer than necessary for the specified purpose, as determined by the controller
GDPR's storage limitation principle requires data to be kept no longer than necessary for its stated purpose, with no fixed universal duration.
Question 3: What distinguishes 'pseudonymization' from 'anonymization' in web analytics?
- Pseudonymization uses stronger encryption than anonymization
- Pseudonymized data can still be re-linked to individuals with additional information, while truly anonymized data cannot (Correct answer)
- Anonymization is illegal under GDPR while pseudonymization is required
- They are legally identical terms under US privacy law
Correct answer: Pseudonymized data can still be re-linked to individuals with additional information, while truly anonymized data cannot
Pseudonymized data retains a key that could re-identify individuals, so it remains personal data under GDPR; truly anonymized data falls outside GDPR's scope.
Question 4: A website operator notices their traffic spiked dramatically from a single foreign country they don't target. The regulatory concern this raises is:
- Violating that country's import/export restrictions on digital goods
- Potentially collecting personal data from residents subject to local privacy laws the operator hasn't prepared for (Correct answer)
- Triggering higher CDN costs that must be disclosed to investors
- Causing duplicate content issues that violate Google's Webmaster Guidelines
Correct answer: Potentially collecting personal data from residents subject to local privacy laws the operator hasn't prepared for
Receiving traffic from a new jurisdiction may bring local data protection laws into scope, requiring review of privacy practices for compliance.
Question 5: Under PECR (Privacy and Electronic Communications Regulations) in the UK, which type of cookie can be set WITHOUT user consent?
- Analytics cookies tracking page views
- Advertising cookies for retargeting campaigns
- Strictly necessary cookies required for a service the user requested (Correct answer)
- Social media tracking cookies
Correct answer: Strictly necessary cookies required for a service the user requested
PECR exempts strictly necessary cookies — those essential to provide a service explicitly requested by the user — from consent requirements.
Question 6: What is 'dark pattern' consent in the context of cookie compliance?
- Consent banners that only appear at night based on user timezone
- Deceptive UI design that nudges users toward accepting more data collection than they intend (Correct answer)
- A consent mechanism that works only in dark mode browsers
- Consent collected in unlit server rooms without proper audit trails
Correct answer: Deceptive UI design that nudges users toward accepting more data collection than they intend
Dark pattern consent uses manipulative UI techniques — like hiding reject options or using misleading button colors — to obtain consent that wouldn't otherwise be given.
Question 7: Which of the following is a key requirement for a valid GDPR consent to use tracking cookies?
- Consent must be bundled with acceptance of the site's terms of service
- Consent must be freely given, specific, informed, and unambiguous (Correct answer)
- Consent is valid if the user continues browsing after seeing a notice
- Consent only needs to be obtained once and never renewed
Correct answer: Consent must be freely given, specific, informed, and unambiguous
GDPR requires consent to be freely given (no bundling), specific (per purpose), informed (clear explanation), and unambiguous (active opt-in, not pre-ticked boxes).
Web Traffic Regulatory Frameworks & Compliance 5
A/B testing platforms often share user assignment data with third-party analytics tools.
The primary compliance risk is: