This post is part 2 of a 5-part series on GDPR readiness. In this previous post, I compared GDPR preparedness to a football game and the importance of both a solid offense and defense to win the game. To tackle the processing requirements of GDPR compliance, your defensive strategy involves operational adjustments and a well-documented game plan. Now, it’s time to turn our focus to the offense and strategies to help your marketing practices thrive in a GDPR world.
Many Marketo clients are asking questions about using marketing automation and lead scoring features given GDPR’s strict permission-based requirements to collect and store personal data. My answer is marketing operations and GDPR can coexist, with adjustments to our current methods. I believe GDPR will force us to improve our core marketing skills, and our GDPR playbook should include leveraging the benefits of our offering and easing customer anxiety associated with data collection.
To further illustrate this thought, I’ll share The MECLABS Conversion Sequence Heuristic, which is perfect for this GDPR discussion:
C = 4m + 3v + 2(i-f) – 2a
If you are not familiar with the formula, the translation of it is:
Conversion = 4x the motivation + 3x value proposition + 2x (incentive less friction) – 2x the anxiety.
To state it another way, for your target customer to take the desired action, ample customer motivation, a solid value proposition, and an incentive to complete the action must be present, plus, operational friction and customer anxiety mitigated. Let’s take a look at how this can apply to real-life scenarios in a GDPR environment.
Consent for Data Collection
Scenario: You are offering a free white paper or informational guide and you are collecting the customer’s name, email address, and phone number as a prerequisite to downloading. Behind the scenes, you are appending additional data to the record, including income and location as well as tracking online browsing behavior to score the lead.
Challenge: Under GDPR, brands must now have an individual’s consent before you may track and store personal data. Opt-out or implied consent forms do not comply with GDPR; further, you must also declare how you will use the data and for how long, including if you are appending information or scoring based on it. Therefore, the challenge is being GDPR compliant without introducing too much friction or anxiety with your form.
To implement: On a recent internet search, I found one suggestion to use this copy in your data collection form:
This solution appears to be GDPR compliant and covers your bases…but it is lengthy and may “weigh down” your form. And, referring back to The MECLABS Conversion Sequence Heuristic, we may have also unnecessarily opened the door on customer anxiety. According to The Chartered Institute of Marketing, (September 2016), 57% of Europeans do not trust brands to use their data responsibly. Highlighting their concern will only increase apprehension. Thus, adding this verbiage to your form could reduce your conversion rate.
“The information set out in this form is registered in an electronic database for the purpose of [commercial prospection, HR…]. This information is intended to be communicated to [internal service of the company, commercial partners…] and retained for [the relationship, xxx months…]. In accordance with the applicable regulation, your rights to access and update your data, withdraw your consent or lodge complaint where applicable can be exercised by following this link [contact of the service, person or authority in charge…]”
Just keep in mind a couple of things with your opt-in checkbox:
- The opt-in checkbox cannot be a required field. Consent is an independent action from the marketing form action. In other words, if the form in question promotes a white paper, the user can download the white paper without opting in to further communication.
Short, sweet, to the point…on with the conversion. And the next example.
Scenario: You are using reverse IP lookup and cookies (AKA Munchkin Code) on your site to identify repeat visitors and customize the user’s experience.
GDPR challenge: You must have consent to track visitor behavior. “By using this site, you agree to cookies” messages implying approval upon closure do not meet GDPR compliance. This is a departure from Do Not Track legislation.
GDPR adjustment: Use a banner across the top of your website notifying first-time users of cookie usage, capturing user consent. Then work with your developer to load Munchkin code with the proper settings.
To implement: We found one example with this verbiage:
There are few issues with this message: 1. It’s not very friendly. And 2. It’s not GDPR compliant. The user must have consented to enable cookies; presumed consent from ignoring your message doesn’t count.
On with our search. We found another banner with this copy:
This example is better. Your legal team would probably give you the thumbs up as you have declared what GDPR requires and collected the appropriate consent. But, we’re also only looking at the legal aspects and missing the human element.
Let’s try presenting the cookies as a customer benefit and utilizing a friendlier format:
Activate a site takeover screen that appears within 5-10 seconds of entering your website: “We’re glad you’re here! Help us customize your site experience by enabling cookies so we can understand your interests and recommend related information. Should you choose not to enable them, you may still use our website; however, we can’t tailor your experience to your interests or location.”
(button for consent “Yes, customize my browsing experience.” And a button for denying consent: “No thanks. I’ll take my chances.”)
In closing, nobody signs up to get on a sales list. Customers DO subscribe or request to receive valuable, meaningful, and relevant information, and are willing to provide their personal information (and consent) in exchange for it. To enhance your success, leverage your benefits, be authentic in your approach and proactively anticipate anxieties your customer may have. Remember, the game isn’t won by merely complying with GDPR requirements. We are victorious when we earn the trust of our customers, which in my opinion, is the very essence of GDPR.
Obviously, these examples are just the beginning. I’ve seen many more questions within the Marketo community about privacy policies, whitelisting campaigns, data consent centers, and more. You have questions; we have a team of Marketo Certified Solutions Architects ready to develop custom solutions and Consultants prepared to make your team look like GDPR marketing rock stars. (That’s my shameless plug to contact us).
*Note: While we’re darn good marketers, we are not attorneys, nor do we even play them on TV–which means that this post isn’t intended to constitute legal advice. Be smart and cover your bases; make sure you enlist your real legal team to review and approve all policies and procedures related to GDPR.