1.0 Executive Summary
The purpose of this policy is to describe how and when JMP will audit the use of cookies and related technologies, including trackers, on our websites.
2.0 Scope
This policy is maintained and administered by the Legal department and it applies to the following JMP departments:
- Marketing
- Digital Operations
3.0 References
3.1 SAS Privacy Statement (www.jmp.com/privacy)
3.2 SAS Statement on the Use of Cookies and Related Technologies (https://www.sas.com/en_us/legal/privacy/use-of-cookies-relatedtechnologies.html)
4.0 Definitions
4.1 Cookies. Cookies are small text files stored on a user’s computer or mobile device generated by a website through users’ browsers when they visit a website.
4.2 Required cookies or related technologies. Used to provide basic functions on the website and without which the website would not work as intended.
4.3 Functional cookies or related technologies. Allow websites to track and “remember” a user’s past preferences and choices on the website to provide a more personalized experience, e.g., username, password or login, region, and language.
4.4 Advertising cookies or related technologies. Used to manage the performance and display of advertisements and to build user profiles.
|
Cookie or
Related
Technology Type
|
Purpose
|
Consent Required
|
Examples
|
|
Required
(Strictly
Necessary)
|
Ensure the website performs its basic operations. Without these, the site may not work properly.
|
No (because they do not collect personal data for tracking or marketing purposes)
|
Authentication: They are essential for verifying consumer identities and providing secure account access.
Session Management: They maintain consumers’ browsing activities in a single session, providing a consistent and seamless experience.
Security: They help protect the site and consumers from malicious activities by detecting irregularities and enforcing security measures.
Examples:
- Tracks active session, bot protection
- Authenticates logged-in users, preventing or detecting fraud
- Preventing or detecting technical faults
- Technical cookies required by certain IT systems
- Accessing secure areas of the site
|
|
Functional
|
Enables personalized experiences and remembers user
settings. Analytic cookies gather information about how consumers interact with a website.
|
Yes
|
- Page views, bounce rates, playing videos.
- Stores language preference
- Saves login/email (username, password) for future visits
- Auto-selects region-based settings
- Remembers video/audio volume
|
|
Advertising
|
Deliver ads relevant to the consumer and their interests. Tracks users for
profiling, remarketing, and behavioral advertising.
|
Yes
|
They can remember that a consumer has visited a website, share this information with other businesses like advertisers, and limit the number of times a consumer sees an ad.
Targeted ad placement, social media, building user profiles
- Tracks content the user views and links the users follow
- Tracks user’s browser and device information, IP address
- Ex. Facebook Pixel for targeting, Google Ads, LinkedIn
|
5.0 Audit Policy
5.1 Reviewing the audit report.
5.1.1 On a quarterly basis, Marketing and Digital Operations will work together to review the current cookies from the report received from TrustArc (January 1, April 1, July 1, October 1). The review should include discussing the following questions:
- What is the business use case/ purpose for each cookie or related technology?
- What is the duration of the cookie or related technology?
- Will tracking data be shared with a third party?
- What is the Privacy Sensitivity Index (PSI) privacy security rating?
- Are we engaging in a sale or sharing data?
- What is the function of each third-party cookie?
- Is this third-party cookie necessary for the platform’s current operations or are there any that can be removed without affecting performance or marketing?
- Are any of these third-party cookies redundant or unnecessary?
- Are the durations of third-party cookies (session vs. persistent) appropriate and do they align with user consent requirements?
- Does this cookie or related technology require user consent and are we collecting and managing this consent correctly?
5.2 Annotating the audit report.
- 5.2.1 Within fifteen (15) business days of receiving the report, Marketing and Digital Operations will review the audit report and ensure the tracker purpose and third-party sharing columns are completed for each line item. Additionally, Marketing and Digital Operations will color code each line item in accordance with the legend below.
- Note: When changing the category of a cookie or related technology from either Advertising or Functional to the Required category, written Legal approval is required. The requestor must submit a Jira ticket under “Cookie Request [Legal Team]” prior to the meeting with JMP Legal (see 5.3.1).
- 5.2.2 Within 10 (ten) business days after receiving the annotated report from Marketing and Digital Operations, the Digital Operations manager will add a “Manager Notes” column to include supporting information, when necessary, and approval of each line item. The final annotated and approved report should be submitted in Jira under “Cookie Request [Legal Team]”.
5.3 Final review and submitting the audit report.
- 5.3.1 Within one week of the submission of the Jira ticket, Marketing and Digital Operations shall host a review meeting with the Legal department. If any changes are required by Legal, Marketing and Digital Operations will complete the changes within three (3) business days.
- 5.3.2 Immediately following the final changes, Marketing and Digital Operations will send the final annotated report to TrustArc. The submission to TrustArc shall always occur before the upcoming quarterly report is run by TrustArc.
- 5.3.3 Digital Operations must verify that any changes integrated in the Cookie Consent Manager are accurately reflected in JMP’s Tag Management System (TMS), to verify that any new tags are properly added to the system and that the correct blocking triggers are properly configured.
- 5.3.4 Once TrustArc confirms the changes have been made, Marketing and Digital Operations will perform testing to ensure the cookies and related technologies have either been deleted or categorized correctly within ten (10) business days. If additional changes are required, Marketing and Digital Operations will work with TrustArc until complete.
6.0 New Cookies or Related Technologies
6.1 If a new cookie or related technology is needed on a JMP website, the requestor should submit a Jira ticket under “Cookie Request [Legal Team]”.
6.2 If the new cookie or related technology requires a contract, the requestor should submit a procurement request in Zip.
6.3 Legal will review the request and provide written approval or denial to the requestor.
