Marketing Cloud Account Engagement - A clear yes to marketing cookies?
Data protection and data security, and in particular the question of users' consent to the use of their data, are central issues in digital marketing. What needs to be considered and which settings are required to set up Salesforce Marketing Cloud Account Engagement (MCAE, formerly Pardot) in such a way that user privacy is respected? This question may cause frowns. Shouldn't you expect consent management as a central element in account engagement to already be considered and functional? Well, Marketing Cloud Account Engagement or Pardot is a solution from the US provider Salesforce. Cookie policies are not interpreted as strictly in the USA as in Europe, where the General Data Protection Regulation applies. These framework conditions provide a bit of a thrill in the project to make the tracking settings in Account Engagement compliant with data protection regulations — at least when the adversities are known.
Taking visitors' privacy settings into MC Account Engagement can be an obstacle course. In this blog post, we would like to shed light on this and describe what needs to be considered when setting up consent management.
Getting started with Salesforce Marketing Cloud Account Engagement
Your company uses Marketing Cloud Account Engagement (MCAE). Your website may include native MCAE forms via iFrames or use native MCAE landing pages, e.g. as part of lead generation campaigns or simply for the confirmation page of a double opt in. In addition, it is obvious to place MCAE tracking code on the website, for example, to make visits to particularly relevant pages visible or to link to automated follow-up actions.
Having just started, we have already reached the first obstacle: In the default setting, MCAE or Pardot always sets cookies in the browser of your visitors, without their consent. The aim of this functionality is, of course, to measure visitor behavior and gain valuable insights for lead qualification. Where are cookies set by visitors? This happens when they come into contact with native MCAE assets, such as filling out a form or visiting a landing page. Important: Even though no marketing cookies were accepted via the consent management tool on the website, on which the form may be integrated via an iframe, they will be set as soon as the form has been submitted, unless the tracking opt-in preferences have been set otherwise in MCAE. If the configuration is inadequate, personal activities such as website visits (if MCAE tracking code is implemented) or landing page visits may become visible without visitors being aware of this.
So let's move on to solving the first obstacle: The Configuring tracking opt-in preferences. This functionality was developed retrospectively by Salesforce in response to GDPR and CCPA (California Consumer Privacy Act, 2018).
For example, it is possible to use an account engagement cookie banner to either obtain tracking consent from all visitors or to request tracking consent only from visitors from specific countries (see screenshot from Pardot Domain Management, under “Edit Tracking Opt-in Preferences”).
If no settings are made at this point (as seen in the example here), i.e. neither all visitors obtain consent, nor only visitors from specific countries, MCAE will always set cookies when visitors come into contact with assets that set account engagement cookies (e.g. MCAE/Pardot tracking code on the website, iframe forms, landing pages). To prevent this, the default setting should be adjusted so that either all visitors or those who come from countries where the GDPR or CCPA applies are asked for their consent.
The MCAE tracking preferences are therefore no longer the original default settings, and visitors are asked for their consent before their activity is tracked in Account Engagement.
That brings us to the second obstacle:
Duplicate cookie banners in Salesforce Marketing Cloud account engagement forms
As soon as certain settings are made via MCAE/Pardot's own consent management, a platform-specific cookie banner is displayed on Pardot landing pages, but also in iFrames that integrate a Pardot form — in addition to the one that visitors receive via the website. This is problematic in terms of user navigation and conversion rate: There is a high risk that visitors will be irritated by an additional cookie banner within the iFrame and jump off. It is also likely that different information will be provided via the website consent management than via the MCAE cookie banner — due to the fact that both systems do not communicate with each other for the time being.
Prospects who have accepted marketing cookies via the website consent management but not at the level of an MCAE landing page will not receive an MCAE cookie or will deactivate their tracking opt-in again due to the lack of consent on the landing page.
The solution: Tracking in Marketing Cloud Account Engagement should always be set up in such a way that the tracking opt in is queried for all prospects. The next step is to activate the Tracking & Consent JavaScript API in the platform settings. The MCAE cookie banner that is now actually displayed is suppressed by a script and the banner of the respective consent management system is played out instead. The prerequisite for this is, of course, that the corresponding Pardot Tracker domain has been stored in the CMS system beforehand. The CMS's own banner should then request the consent of website visitors for all types of cookies (including account engagement cookies, which are located under marketing cookies). In this way, account engagement cookies are generally prevented from being set.
Now let's take the third and final hurdle together:
Lack of communication between the consent management platform and Salesforce Pardot
The solution: This step usually requires support from experienced web developers, as the exact procedure is highly dependent on the consent management platform used (e.g. OneTrust, Cookiebot and Usercentrics). In principle, communication between the consent management system and Salesforce Pardot/McAE is also established via a script. The consent management tool then uses this script to inform MCAE of the decision of website visitors. Only if they have agreed to the marketing cookies will visit activities such as landing page views and visits to websites with account engagement tracking code be visible. By the way: Completion actions of MCAE-tracked links (so-called custom redirect links) are also only executed if a prospect has accepted the MCAE.cookies.
