1. Option C: Consent or Pay Model (UK and ES only)
This section covers the specific requirements that Utiq business customers’ consent or pay models must meet before Utiq consent can be integrated within such models.
Markets in scope
This section is applicable to the UK and ES markets only.
Pre-requisites
To use the “Consent or Pay Model”, Advertisers and Publishers must meet Utiq’s minimum standards listed below. If you cannot meet these requirements, you must use Utiq’s “Separate consent pop-up model” (see Option 1B.) or “Utiq Integrated Model” (see Option 1A.).
For any questions, please get in touch with our Customer Success team at csm@utiq.com.
These requirements focus only on Consent and Transparency aspects of the integration. Additional requirements will also apply which are covered separately (e.g. contractual).
Utiq Privacy Requirements (UPRs) for “Consent or Pay Model”
Core Requirements
Description
Specification/Checklist
Example (FOR ILLUSTRATION PURPOSES ONLY)
Ensure that your Consent or Pay Model complies with applicable data protection law, including GDPR (and UK equivalent), as well as guidance, decisions or opinions issued by relevant supervisory authorities, in particular as it concerns the collection of users' valid consent; and that you have performed the necessary assessments to this effect.
Validity of your Consent or Pay Model
Ensure your Consent or Pay Model meets the conditions for a valid and freely given consent in accordance with applicable data protection law.
You have performed the necessary assessments to support number 1 above, with regards to the appropriateness of the fee charged, the equivalence of the services offered, the absence of power imbalance* and the “privacy by design” aspects of the model and these assessments must remain valid for as long as the Consent or Pay Model is in use.
You do not hold more than 25% market share in the relevant market in which you operate and/or in which the digital property using Utiq Technology is active.
You inform Utiq if any of the above changes.
* For customers subject to EU law and relevant EU guidance, decisions and opinions, you do not fall within the scope of:
the Digital Services Act (Regulation (EU) 2022/2065),
the Digital Markets Act (Regulation (EU) 2022/1925), or
any applicable European Data Protection Board (EDPB) guidance concerning gatekeeper or platform obligations.
Ensure users are provided with sufficient transparency information to support choice and control over the processing of their personal data.
You must provide clear information about each of the options in your Consent or Pay model using concise, clear and plain language to enable people to make an informed decision.
The consent text must clearly explain what each option means, the consequences and the impact it will have on data processing.
If there is a summary section, main CMP provides a clear summary of the differences between the options.
The main CMP title must be adequate
The main CMP title must not only reference or concern cookies. It must also address other similar technologies, given that Utiq falls under “other similar technologies” and is not a cookie per se.
The main CMP title must be adequately worded, describing both the “Consent” and “Pay” options, with clear wording used and creating no ambiguity regarding the options available to the user.
Valid consent must be obtained for Utiq technology activation and operation
It should be sufficiently clear that Utiq technology is used by the digital property (i.e., website or app) - Visual elements (e.g. Utiq logo) must be used to draw the attention of the users on the presence of also Utiq.
When integrating Utiq consent text in a CMP making use of Consent or Pay model you must ensure that:
The Utiq consent text (v4.0) is used and displayed within the 1st layer of the CMP without modifications.
Utiq consent text is shown in the same form as the digital property's own consent text (same size, font, colour).
Sub-title provided by Utiq is implemented without any variations.
Utiq logo is placed next to Utiq consent text sub-title.
Utiq consent text is inserted in an appropriate location within the 1st layer to ensure visibility and distinct from other consent wording.
In case scrolling is required to view Utiq consent text, Utiq logo is placed in a fully visible section of the CMP not requiring scrolling down. The most logical place is expected to be next to the mention of use of similar tracking technologies by inserting “(including Utiq)”.
Where technically possible, Utiq logo should be clickable and, if clicked, it should automatically direct the user to the Utiq section including the full Utiq consent text).
Where not technically feasible, the text must include additional wording to make it clear to the user that they can find the relevant information by scrolling further down or opening another section (example “(including Utiq (see below)”).
If the digital property is listing the purposes as accordions in the 1st layer, Utiq must be listed as accordion as well.
No reliance on deceptive design patterns [1] and [2] that could compromise the visibility of Utiq consent.
Users must be provided with equivalent selection options, displayed with an equivalent design.
The “Accept” and “Pay” buttons are transparently labelled and presented on both the first and second layer.
The “Accept” and "Pay" buttons should be:
Located in the first and second layers of the CMP.
Equally visible (factors to consider here are size, font and location for example).
Clear wording used, creating no ambiguity as to the function of each option/button in both the first and second layers (e.g. avoid “continue to read for free” or “subscribe for all content”).
Consent button should not make reference to “cookies” only, it should also mention “other similar technologies”.
No reliance on (other) deceptive design patterns [1] and [2].
In case scrolling is required to view Utiq consent text, the buttons should always be displayed and placed in a fully visible section of the CMP (i.e. the accept/pay buttons do not disappear with the scrolling down).
Paying journey is functional and easy.
Paying journey is functional (effectively works)
Paying journey is easy
It must be as easy for users to refuse and withdraw consent as it is to give consent.
Correct configuration of consent/accept and pay/reject functions
The CMP must be configured to ensure that Utiq calls are only triggered if user consents to the activation of Utiq technology.
Utiq technology must be off by default.
No Utiq calls to enable the Utiq technology shall be triggered if a user specifically:
selects the “pay” option
rejects consent to the use of Utiq technology
makes an overall rejection of all non-essential cookies and other tracking technologies
Only strictly necessary cookies (i.e., utiq_consent_status) can be dropped if user denies consent to non essential cookies and other similar technologies.
The digital property’s main consent text must clearly explain how users can exercise their data protection rights.
The digital property’s main consent text should include information on the withdrawal options for both the Consent and Pay selection options.
If a user withdraws their consent, Utiq technology must be switched off/disabled.
There should be a clear distinction between withdrawal of consent and paid subscription workflow - the withdrawal workflow should not directly and immediately trigger a payment process. Instead, users should be informed about the consequences of withdrawing consent first, and only then offer a clearly separate, voluntary subscription option.
Consent withdrawal should be free of charge.
Implement 1st layer Utiq opt-out function
A function to open the second layer of the CMP where the end users can granularly reject the activation of the Utiq technology (using the Utiq custom purpose) will be made available to end users in the “Accept” part of the CMP (within the Utiq consent text).
The word “reject Utiq now” in the Utiq consent text 1st layer sentence “You can reject Utiq now” triggers a function to open the second layer of the CMP where the end users can granularly reject the activation of the Utiq technology (using the Utiq custom purpose).
It must be possible for users to view the purposes in a granular way. Specifically, users should be able to make granular choices for Utiq via distinct tick boxes.
Utiq technology purpose included in 2nd layer of CMP (as Utiq custom purpose)
Utiq 2nd layer consent text must be added in an appropriate location (as Utiq custom purpose).
Where technically possible, Utiq logo must be placed next to Utiq 2nd layer title.
Specific accept and reject options must be placed next to Utiq consent (Utiq 2nd layer text).
No reliance on deceptive design patterns [1] and [2] that could compromise the visibility of Utiq consent.
Implement hyperlinks in clickable elements within Utiq consent text (1st layer and 2nd layer)
The Utiq consent text contains clickable elements:
consenthub
Utiq's Privacy Statement
supported internet connection
for advertising or analytics activities
across our property(ies)
reject Utiq now (“You can reject now”)
Implement hyperlinks that open in a new page for clickable elements within Utiq consent text:
supported internet connection → https://consenthub.utiq.com/pages/privacy-statement#telecom-operators. The reference to supported internet connection of participating telecom operators in scope within the Utiq consent text must be correctly hyperlinked and direct the user to the relevant section within the Utiq privacy statement which contains the list of all participating telecom operators per country.
for advertising or analytics activities → this function will open the Advertiser/Publisher’s own privacy statement.
across our property(ies) → https://consenthub.utiq.com/pages/digital-properties?domain=[INSERT DIGITAL PROPERTY] with already pre-filtered the digital property (e.g. website/app) the user is coming from. This page lists the cross domain websites in scope (i.e., all digital properties that would make use of the same martechpass value), providing transparency also on Group of companies and Data Controllers.
You can reject Utiq now → a function to open the second layer of the CMP.
Configurable elements within the Utiq Consent text must be populated with the Data Controller information
The Utiq consent text (1st layer) contains the following configurable elements:
Populate dedicated configurable elements with your details:
[DATA CONTROLLER] → Data Controller’s name and legal form (i.e. the legal entity that owns the website as mentioned on the website’s Privacy Policy page)
[BUTTON WORDING FOR PAY OPTION] → label/wordings used for the “Pay” option button
The digital property's main CMP must be easy to locate and resurface to facilitate withdrawal of consent at any time
You must give people an easy way to withdraw their consent and you must make this easily accessible on your service at all times.
The option to resurface the website main CMP shall be located in an easily visible place for the user to find. Usually, this will be at the bottom of the page.
The option must be present in all the pages of the website (i.e. not only in the Homepage).
The name of the functionality (e.g., link or icon) should use clear wording to enable the user to make use of the functionality to manage their consents.
The wording used must not reference only cookies, but also other similar technologies (in case such wording is used).
No reliance on deceptive design patterns [1] and [2] (e.g., different size, font, colour or inappropriate location), accessible with 1 click, not hidden by other banners in the websites, colour of text contrasts sufficiently with the background)
The website should make its “Privacy policy/notice/statement” easily accessible at the bottom of all pages
As per core requirement.
The option to open the Privacy Statement shall be located in an easily visible place for the user to find. Usually, this will be at the bottom of the page.
The option to open the Privacy Statement must be present in all the pages of the website (i.e. not only in the Homepage).
No reliance on deceptive design patterns [1] and [2] (e.g., different size, font, colour or inappropriate location, accessible with 1 click, not hidden by other banners in the websites, colour of text contrasts sufficiently with the background).
Consent validity timeframe (the time after which consent should be re-requested)
The consent validity timeframe (the time after which consent should be re-requested) for Utiq consents is aligned with your CMP consent validity timeframe and up to a possible 13 month maximum period.
martechpass TTL is 90 days.
Main CMP’s consent validity timeframe is no longer than 13 months.
Utiq shall not be enabled for users that have already consented unless consent is refreshed to cover Utiq consent
As per core requirement.
Utiq technology must be activated only to new users accepting Utiq consents. Utiq technology cannot be activated for users who previously “accepted” with another consent model before Utiq was implemented.
If the website/app was already live with Utiq technology with another consent model (e.g. standard “Integrated Model” or “Utiq Separate pop-up”) and then it moves to “Consent or Pay Model”, a refresh of consent collection/reprompt of consent banner to all users is required.
Evidence of consent
It should be technically possible for the Advertiser/Publisher to provide evidence of Utiq consents captured.
It should be technically feasible for Utiq to monitor that each consent has effectively been provided.
Ensure that you are keeping track of the version of your Consent Notices that includes Utiq consent.
Ensure that the Evidence of Consents feature in your CMP console is correctly capturing the user’s preferences for the Utiq consent.
Utiq consent withdrawal mechanism are in place
As per core requirement.
The following 3 ways for users to withdraw Utiq consents should be in place:
CMP: by re-opening the CMP and changing the Utiq preferences, the users can withdraw Utiq consent.
Manage Utiq via the consent revocation dedicated functionality: users can revoke their Utiq consent directly through your site. The revocation will only apply to your site in this case.
consenthub.
The above should be implemented in accordance with Utiq technical requirements to ensure correct synchronisation with consenthub.
[1] Also known as “dark patterns”, are considered as interfaces and user journeys implemented on platforms that attempt to influence users into making unintended, unwilling and potentially harmful decisions, often towards a decision that is against the users’ best interests and in favour of the platforms interests, regarding the processing of their personal data (EDPB Guidelines 03/2022) [2] ICO-CMA joint paper on Harmful Design in Digital Markets | DRCF
User testing
If you have any learnings or insights from user testings that could be beneficial also to Utiq consent and experience, we would greatly appreciate if you could share them with us.
Other Utiq Privacy Requirements
Please make sure you also comply with the other 2 requirements:
“2. Setup the dedicated “Manage Utiq” page linked via a footer hyperlink” → as per standard Utiq Privacy Requirements (UPRs) available here.
“3. Include reference to Utiq technology in the domain’s privacy statement” → as per standard Utiq Privacy Requirements (UPRs) available here.
Configuration in CMP console
Utiq’s consent text for the “Consent or Pay model”
The Utiq consent text has been carefully defined seeking to strike a balance between providing complete information on the processing and keeping the text brief and understandable for users as part of a layered approach to transparency. Specifically, the text addresses the purpose and scope of the processing, the nature of the personal data processed, retention periods, and the identity of controllers.
Utiq consent text to date (this may be subject to change):
EN
Layer
Text
1st layer
Use of Utiq technology powered by your telecom operator
If you accept and use a supported internet connection, we, [DATA CONTROLLER], will use marketing identifiers provided by Utiq for advertising or analytics activities. To create the identifiers, Utiq works with your telecom operator, which will use your IP address against internal data (e.g. mobile number), without disclosing it.
We use the identifiers to link the browsing activity across our property(ies) where Utiq consent is given, including of others using the same connection. You can reject Utiq now or withdraw consent later via "Manage Utiq" or in Utiq’s privacy portal (“consenthub”). If you “[BUTTON WORDING FOR PAY OPTION]”, Utiq will not be used.
You confirm that you are the telecom account holder’ or have permission from them to activate Utiq.
Use of Utiq technology powered by your telecom operator
If you consent, you agree to the following processing:
Eligibility check: Utiq uses your IP address to check if you’re using a supported internet connection. If you are not, Utiq will not be activated.
Activation of Utiq technology: Your IP address is shared with your telecom operator to create a secure identifier ("Network Signal"). To do this, your operator matches your IP address with internal data (e.g. mobile number), without disclosing it. Only this identifier is then provided to Utiq.
Creation of Utiq identifiers:Utiq uses the Network Signal to create additional Utiq identifiers, including marketing specific ones, stored in your browser with first party cookies and other device storage information.
Sharing and use of marketing identifiers: Utiq only shares with us marketing identifiers that we can use to understand your browsing behaviour and connect visits across our property(ies) (only if you agree to the activation of the Utiq technology on each one separately). This helps us, for example, to personalise or customise content in our property(ies), to recognise you when you return, or to enable us or our selected partners to create audiences for advertising or analytics, as explained below. If the connection is shared, the same identifiers are assigned to each consenting person on that connection, linking their browsing behaviour.
Sharing of Utiq identifiers to advertising and analytics platforms: Certain Utiq identifiers will be transferred to these platforms that work with us and/or Utiq. We supplement these identifiers with data we hold about your browsing activity and profile, which is further processed in these platforms to show you personalised ads (our own or our partners’) or conduct analytics, according to the consents you have given us. This can involve display of ads, managing how frequently ads are shown or measuring the performance of the ads. The analytics activities can involve comparison analysis to produce aggregated reports or select audiences for activation. For more detailed information on how these activities are supported by Utiq see the dedicated section in Utiq’s privacy statement.
The Utiq technology is designed with privacy in mind: it uses minimal personal data, secure, temporary identifiers, and limits data sharing. Utiq also offers a privacy portal (“consenthub”) to exercise your privacy rights.
¿Quieres activar la tecnología Utiq impulsada por las operadoras de telefonía?
Si das tu consentimiento y usas una conexión a internet habilitada, nosotros, [RESPONSABLE DEL TRATAMIENTO], utilizaremos identificadores de marketing que nos proporciona Utiq para llevar a cabo actividades de marketing digital o análisis. Para crear estos identificadores, Utiq trabaja con tu operadora de telefonía, que usa tu dirección IP y otros datos (como tu número de teléfono móvil), pero sin compartirlos.
Estos identificadores nos ayudan a conectar la actividad de navegación dentro de nuestra(s) propiedad(es) digital(es) donde se haya dado un consentimiento Utiq. Esto incluye tu actividad y la de los que compartan tu conexión.
Puedes rechazar Utiq ahora o retirar tu consentimiento en cualquier momento a través de “Administrar Utiq” o en el portal de privacidad de Utiq (“consenthub”). Si tu “[BUTTON WORDING FOR PAY OPTION]”, Utiq no estará en uso.
Al dar tu consentimiento, confirmas que eres el titular de la cuenta de internet o que tienes su permiso para activar Utiq en esa conexión.
Uso de la tecnología Utiq impulsada porlas operadoras de telefonía
Si das tu consentimiento, aceptas el siguiente tratamiento de datos:
Verificar si la tecnología es de aplicación para ti: Utiq utiliza tu dirección IP para verificar si estás usando una conexión a Internet habilitada. Si no lo estás, Utiq no se activará.
Activación de la tecnología Utiq: Tu dirección IP se comparte con tu operadora de telefonía para crear un identificador cifrado ("Network Signal"). Para ello, tu operadora utiliza tu dirección IP con otros datos asociados a la cuenta de cliente de telecomunicaciones (p. ej., número de teléfono móvil), pero sin compartirlos. Solo el identificador cifrado se proporciona a Utiq.
Creación de identificadores Utiq: Utiq utiliza el Network Signal para generar identificadores adicionales, incluidos algunos específicos de marketing, que se almacenan en tu navegador junto con cookies propias y tecnologías similares.
Provisión y uso de identificadores de marketing: Utiq solo comparte con nosotros identificadores de marketing que podemos usar para entender tu comportamiento de navegación y conectar tus visitas en nuestra(s) propiedad(es) (solo si aceptas la activación de la tecnología Utiq en cada una). Esto nos ayuda, por ejemplo, a personalizar el contenido en nuestra(s) propiedad(es), a reconocerte cuando regreses, o a permitirnos a nosotros o a nuestros socios seleccionados crear audiencias para publicidad o análisis, tal y como se explica más abajo. Si la conexión es compartida, los mismos identificadores se asignan a cada persona que haya dado su consentimiento en esa conexión, vinculando así su comportamiento de navegación.
Provisión de los identificadores a plataformas de publicidad y analítica: Ciertos identificadores Utiq se transferirán a estas plataformas que trabajan con nosotros y/o con Utiq. Complementamos estos identificadores con los datos que tenemos sobre tu actividad de navegación y tu perfil, los cuales se procesan en dichas plataformas para mostrarte anuncios personalizados (nuestros o de nuestros socios) o realizar análisis, de acuerdo con los consentimientos que nos hayas dado. Esto puede incluir la visualización de anuncios, la gestión de la frecuencia con que se muestran o la medición de su rendimiento. Las actividades de analítica pueden implicar análisis comparativos para producir informes agregados o seleccionar audiencias para su activación. Para más información sobre cómo Utiq apoya estas actividades, consulta la sección correspondiente en la Política de privacidad de Utiq.
La tecnología Utiq está diseñada con un enfoque centrado en la privacidad: utiliza los datos mínimos, identificadores cifrados y con validez limitada, y limita la comunicación de datos. Utiq también ofrece un portal de privacidad (“consenthub”) para ejercer tus derechos de privacidad.
Vols activar la tecnologia Utiq impulsada per les operadores de telefonia?
Si dones el teu consentiment i fas servir una connexió a internet habilitada, nosaltres, [DATA CONTROLLER], farem servir identificadors de màrqueting proporcionats per Utiq per a activitats publicitàries o d’analítica. Per crear aquests identificadors, Utiq treballa amb el teu operador de telecomunicacions, que farà servir la teva adreça IP en relació amb dades internes (per exemple, el número de mòbil), sense divulgar-les.
Fem servir aquests identificadors per vincular l’activitat de navegació a través de les nostres propietats on es dona consentiment a Utiq, incloent-hi les d’altres que utilitzen la mateixa connexió.
Pots rebutjar Utiq ara o retirar el consentiment més endavant a través de “Gestionar Utiq” o al portal de privacitat d’Utiq (“consenthub”). Si “[BUTTON WORDING FOR PAY OPTION]”, Utiq no s’utilitzarà.
Confirmes que ets el titular del compte de connexió o tens permís per activar Utiq.
Ús de la tecnologia Utiq impulsada per les operadores de telefonia
Si dones el teu consentiment, acceptes el següent tractament de dades:
Verificar si la tecnologia és aplicable per a tu: Utiq utilitza la teva adreça IP per comprovar si estàs fent servir una connexió a Internet habilitada . Si no és així, Utiq no s’activarà.
Activació de la tecnologia Utiq: La teva adreça IP es comparteix amb la teva operadora de telefonia per crear un identificador xifrat (“Network Signal”). Per fer-ho, la teva operadora utilitza la teva adreça IP juntament amb altres dades associades al compte de client de telecomunicacions (p. ex., número de telèfon mòbil), però sense compartir-les. Només l’identificador xifrat es proporciona a Utiq.
Creació d’identificadors Utiq: Utiq utilitza el Network Signal per generar identificadors addicionals, incloent-ne alguns d’específics per a màrqueting, que s’emmagatzemen al teu navegador juntament amb galetes pròpies i tecnologies similars.
Provisió i ús d’identificadors de màrqueting: Utiq només comparteix amb nosaltres identificadors de màrqueting que podem utilitzar per entendre el teu comportament de navegació i connectar les teves visites a la nostra o les nostres propietats digitals (només si acceptes l’activació de la tecnologia Utiq a cadascuna). Això ens ajuda, per exemple, a personalitzar el contingut, reconèixer-te quan tornis o crear audiències publicitàries. Si la connexió és compartida, els mateixos identificadors s’assignen a totes les persones que hagin donat el seu consentiment en aquesta connexió.
Provisió dels identificadors a plataformes de publicitat i analítica: Certs identificadors d’Utiq es transferiran a aquestes plataformes que treballen amb nosaltres i/o amb Utiq. Complementem aquests identificadors amb les dades que tenim sobre la teva activitat de navegació i el teu perfil, que es processen per mostrar-te anuncis personalitzats o realitzar anàlisis, d’acord amb els consentiments que ens hagis donat. Per obtenir més informació sobre com Utiq dona suport a aquestes activitats, consulta la secció corresponent de la seva Política de privadesa.
La tecnologia Utiq està dissenyada amb la privadesa com a prioritat: utilitza una quantitat mínima de dades personals, identificadors segurs i de durada limitada, i restringeix l’intercanvi de dades. Utiq també ofereix un portal de gestió de consentiments (consenthub) perquè puguis exercir els teus drets de privadesa.
If the website’s CMP is not listing any other vendors (and only listing the purposes), the configuration of “Utiq as vendor” can we omitted.
If the website’s CMP is listing other vendors, Utiq must be configured also as a custom vendor
Set up the functionalities in the Utiq Integrated Model text
Configurable elements
The Utiq consent text (1st layer) contains the following configurable elements:
[DATA CONTROLLER] → Data Controller’s name and legal form (i.e. the legal entity that owns the website as mentioned on the website’s Privacy Policy page)
[BUTTON WORDING FOR PAY OPTION] → label/wordings used for the “Pay” option button
for advertising or analytics activities → this function will open the Advertiser/Publisher’s own privacy statement.
across our property(ies) → https://consenthub.utiq.com/pages/digital-properties?domain=[INSERT DIGITAL PROPERTY] with already pre-filtered the digital property (e.g. website/app) the user is coming from. This page lists the cross domain websites in scope (i.e., all digital properties that would make use of the same martechpass value), providing transparency also on Group of companies and Data Controllers.
You can reject Utiq now → a function to open the second layer of the CMP.
Consent synchronization with CMP-consenthub-“Manage Utiq” withdraw function
There are 3 ways for users to withdraw Utiq consents:
via the CMP: by re-opening the CMP and changing the Utiq preferences, the users can withdraw Utiq consent.
via the consent revocation dedicated functionality in the “Manage Utiq” page: users can revoke their Utiq consent directly through the site. The revocation will only apply to that site in this case.