DGP - Website Pillar

4 years 4 months AGO

PILLAR & CRITERIA DETAILS

WEBSITES

IARD

1.1 Age-Affirmation Mechanism

Required for compliance

The age-gate mechanism can either be:

• A field where consumers must enter their full date of birth – day/month/year

• A field where consumers must enter their birthyear

• A question such as: Are you under the Legal Purchase Age?Where the user can click

on Yes/No; or green light/red light as answer options.

• A login through social media (provided the social media platform asks users for their age

when they sign up to the platform).

Required for full compliance: Whenever a user’s access is denied through an age-gate

mechanism, this user should receive an appropriate warning and/or be redirected to an

appropriate alcohol-related social aspects website, like drinkwise.org. The user should not

be able to access a commercial site.

If a user is redirected to a commercial site with alcohol advertising, this will not be considered a valid age-gate.

When it is necessary to follow the criteria

For all websites that have content related to alcoholic beverages, it is necessary to have an age gate before displaying the

content.

Where this criterion should be found

As no alcoholic content can be displayed before the user passes through the age gate, this page must appear before the user accesses the

site's contents.

How is the internal audit carried out in this criterion?

The DGP robot will verify through keywords the existence or not of the Age gate on the websites.

How is this criterion evaluated?

If the digital asset has the age gate mechanism, it will be "OK" for the criterion, otherwise it will be "NOK".

Pass/Fail

Examples:

Age Gate dateinsertion

Age Gate Question

1.2 Forward Advice Notice (FAN)

Whenever alcohol beverage companies controlled digital platforms allow users to share content, companies should

include a Forward Advice Notice (FAN) on the platform, clearly stating that the content should not be forwarded to

anyone under LPA in the country of viewing.

Wording examples:

• “Please only share our posts with those who are of legal drinking age”

• “Forward to those of legal drinking age only”

• “Please do not share or forward to anyone underage”

“18+ to follow/share”. Is not considered compliant because was considered too

vague as it did not explicitly state content can only be shared with users who are

over 18.

Important:

When it is necessary to follow the criteria

FAN is required on websites if the websites allow users to share content.

Where this criterion should be found

On the footer of the website.

How is the internal audit carried out in this criterion?

The DGP robot will verify through keywords the existence or not of the FAN on the websites.

How is this criterion evaluated?

If the digital asset has a sharable content, it is necessary to have the FAN. If is necessary and has the FAN the asset will be "OK" for the

criterion, otherwise it will be "NOK".

Pass/Fail

Examples:

1.3 Responsible Drinking Message (RDM)

Alcohol beverage digital marketing communications and/or alcohol beverage company-controlled digital platforms should

include a clearly visible Responsible Drinking Message (RDM) which explicitly advocates responsible drinking. The RDM has

to be included on the homepage. It should be well visible and readable.

Wording examples:

• “Please enjoy responsibly”

• “Drink with moderation”

• “Cheer responsibly”

• “Sip carefully”

• “Celebrate with moderation “

• “Don’t drink and drive”

When it is necessary to follow the criteria

RDM is required in all websites that has some alcoholic content.

Where this criterion should be found

On the footer of the website.

How is the internal audit carried out in this criterion?

The DGP robot will verify through keywords the existence or not of the RDM on the websites.

How is this criterion evaluated?

If is necessary and the website has the RDM the asset will be "OK" for the criterion, otherwise it will be "NOK".

Pass/Fail

Examples:

1.4 Corporate Official Information (COI) / Transparency

Alcohol beverage digital marketing communications should not misrepresent their commercial purpose and

should make it clear that theirs is the official brand page.

The commercial purpose is apparent when the profile/website/app is clearly identifiable as official and as

belonging to a brand/alcohol producer.

Required for compliance

It is necessary follow 3 requirements to be compliance with the COI.

1. Official Company Information.

2. Trademark.

3. Terms and conditions & Privacy Policy link working.

When it is necessary to follow the criteria

The COI is necessary for all websites owned by the company.

Where this criterion should be found

On the landing page above/below the age-verification mechanism OR in homepage at the top or at bottom.

How is the internal audit carried out in this criterion?

The DGP robot will verify through keywords the existence or not of the Official Company information, trademark and Privacy Policy &

Terms and Conditions. In addition, it will verify if the privacy policy and terms and conditions links are working correctly.

How is this criterion evaluated?

If the digital asset has the 3 necessary requirements (Official Company information, trademark and Privacy Policy & Terms and Conditions

link) the asset will be "OK" for the criterion, otherwise it will be "NOK".

Pass/Fail

Examples:

Trademark

Official Information

PP & TC Link

1.5 User Generated Content (UGC)

It needs to be clear that brands do not condone any user generated content that would promote inappropriate

or excessive alcohol consumption. Consumers need to be informed that UGC is monitored, and any irresponsible

content of this sort will be taken down. The UGC policy must clearly state that any user posts which condone

irresponsible drinking will be removed.

Required for compliance

It is necessary follow 3 requirements to be compliance with the UGC.

1. The link needs to be clear that is for the UGC content.

• “Please see our rules for engagement: [link]”

• self-evident link such as “www.bit.ly/PostGuide”

2. The link needs to be working.

3. The UGC page needs to have the UGC content clearly.

When it is necessary to follow the criteria

For websites, UGC is only required if the website does offer a space for users to post comments.

Where this criterion should be found

The UGC link can be on the landing page above/below the age-verification mechanism OR in homepage at the top or at bottom. The UGC

content can be on a specific page with just the UGC content, or it can be inside the terms and conditions page in a paragraph intended

for the UGC.

How is the internal audit carried out in this criterion?

The DGP robot will verify through keywords the existence or not of the UGC link and will verify if the link is working correctly.

How is this criterion evaluated?

If the digital asset has the 3 necessary requirements (Link Clear, link working and UGC content) the asset will be "OK" for the criterion,

otherwise it will be "NOK".

Pass/Fail

Examples:

• ..posts will be deleted if they promote inappropriate or excessive

alcoholconsumption..”.

PRIVACY AND SECURITY

2.1 Vulnerability Level

This criterion will identify the degree of vulnerability of the site in relation to information security and privacy.

It is measured by the Brand Protection team and the degree is defined through the need to use some tools to

guarantee the security of the asset.

Required for compliance

The degree of vulnerability is defined in 3 options (High, Medium, Low).

For the asset to be approved by the DGP, the vulnerability level can be Medium or Low only.

Assets that have a high degree of vulnerability will be disapproved.

• HIGH

• MEDIUM

• LOW

When it is necessary to follow the criteria

Security requirements are required for all websites

Where this criterion should be found

The tools responsible for ensuring the security of the website must be implemented on the website by the local Brand Protection team.

How is the internal audit carried out in this criterion?

The audit of security and privacy criteria is carried out by the Brand Protection Global team, which will verify through robots the

implementation or not of the necessary tools for the security of the asset.

How is this criterion evaluated?

If the vulnerability level is (Medium or Low) the asset will “OK”. If it is High, the asset will be “NOK”.

Pass/Fail

2.2 Risk Rate

This criterion will identify the Risk level of the website in relation to information security and privacy. It is

measured by the Brand Protection team and the degree is defined through the need to use some tools to

guarantee the security of the asset.

Required for compliance

The Risk rate is defined in 3 options (High, Medium, Low).

For the asset to be approved by the DGP, the Risk Rate can be Medium or Low only.

Assets that have a high risk rate will be disapproved.

• HIGH

• MEDIUM

• LOW

When it is necessary to follow the criteria

Security requirements are required for all websites

Where this criterion should be found

The tools responsible for ensuring the security of the website must be implemented on the website by the local Brand Protection team.

How is the internal audit carried out in this criterion?

The audit of security and privacy criteria is carried out by the Brand Protection Global team, which will verify through robots the

implementation or not of the necessary tools for the security of the asset.

How is this criterion evaluated?

If the Risk rate is (Medium or Low) the asset will “OK”. If it is High, the asset will be “NOK”.

Pass/Fail

2.3 PIA Completion

This criterion will identify whether the website has a privacy impact assessment (PIA) which is a tool for

identifying and assessing privacy risks throughout the development life cycle of a program or system.

Required for compliance

to be approved the PIA must be Completed. Any other stage of the PIA will be considered as

having failed.

• COMPLETED

• NOT COMPLETED/IN PROGRESS

When it is necessary to follow the criteria

Security requirements are required for all websites

Where this criterion should be found

The tools responsible for ensuring legality of the website must be implemented on the website by Legal team.

How is the internal audit carried out in this criterion?

The audit of PIA is carried out by the Legal team, which will verify through robots the implementation or not of the PIA.

How is this criterion evaluated?

If the website has a complete PIA it will be approved (“OK”), if not, it will be disapproved (“NOK”)

Pass/Fail

2.4 Cookie Banner implemented

The purpose of this criterion is to identify the correct use of the Cookie banner on the website.

Example:

When it is necessary to follow the criteria

Legal requirements are required for all websites

Where this criterion should be found

The cookie banner must appear somewhere on the website before the user accesses it for the first time.

How is the internal audit carried out in this criterion?

The internal audit will verify the existence and the correct implementation of the banner cookie through robots.

How is this criterion evaluated?

If the digital asset has Cookie Banner implemented the asset will be "OK" for the criterion, otherwise it will be "NOK"

Pass/Fail

2.4 Cookie Dropping Compliance

The purpose of this criterion is to identify whether the site is only using cookies that the user agreed to

share at the time of interaction with the cookie banner.

Therefore, if the user rejects all cookies, only strictly necessary cookies can be fired on the website. If the

user only accepts performance cookies, only performance cookies and strictly necessary cookies can be

fired on the website.

When it is necessary to follow the criteria

Legal requirements are required for all websites

Where this criterion should be found

The cookie dropping will be identified through the cookies that the website is using and saving after the user interacts with the cookie

banner.

How is the internal audit carried out in this criterion?

The internal audit will verify if only the categories of cookies accepted by the user are being used and stored by the website.

How is this criterion evaluated?

If the digital asset has the Cookie’s category used correctly the asset will be "OK" for the criterion, otherwise it will be "NOK"

Pass/Fail

WEBSITE DATA

3.1 CDP Implementation

This criterion will verify the correct use and implementation of the CDP tag on the website. The correct use

of this tool is super important to obtain information and insights about the use of the website by users.

Required for compliance

1. Correct implementation of the CDP tool.

When it is necessary to follow the criteria

The website data requirements are required for all websites

Where this criterion should be found

The CDP tool must be implemented on the website and used if the user consents.

How is the internal audit carried out in this criterion?

The internal audit will verify the correct implementation of the CDP tool through a robot.

How is this criterion evaluated?

If the digital asset has the CDP correctly implemented the asset will be "OK" for the criterion, otherwise it will be "NOK"

Pass/Fail

3.2 Google Analytics Ownership

This criterion will verify the correct use of the google web analytics tool on the website. The correct use of this

tool is super important to obtain information and insights about the use of the website by users.

Required for compliance

It is necessary follow 3 requirements to be compliance with the Google Analytics Ownership.

1. Google Analytics Tag ImplementationCorrectly

The website must have the google analytics tag configured correctly on all pages, having page view events being

triggered correctly.

2. Google Analytics Taxonomy Adherence

The Google analytics account for the site analyzed should follow the following taxonomy in its nomenclature:

Account name

Rule: ZONECODE_COUNTRYCODE

Example:

3. Google AnalyticsAccess

The google analytics account and property configured on the site should grant administrator access to the

following email:

abi-martech-global-wa@appspot.gserviceaccount.com

Example:

When it is necessary to follow the criteria

The website data requirements are required for all websites

Where this criterion should be found

The web analytics tool must be implemented on the website and used if the user consents.

How is the internal audit carried out in this criterion?

The internal audit will verify the correct implementation of the Google analytics Tag, access and taxonomy through a robot.

How is this criterion evaluated?

The three requirements will be audited separately (Implementation, Access, taxonomy), the asset will be "OK" for the requitements,

otherwise it will be "NOK"

Pass/Fail

PROPERTY EXCELLENCE

4.1 SEO Score

This criterion will audit the website's performance for SEO (Search engine optimization) which is a set of

techniques that aim to better position a page on Google and other search engines. This Score comes from the

Sem Rush platform that is a powerful website crawler that allows you to analyze the health of a website.

Good Practice:

1. SEO score greater than 75.

When it is necessary to follow the criteria

This criterion is used only as a follow-up. But we recommend using it on all websites

How is the internal audit carried out in this criterion?

The audit is performed by the SEMrush platform that will analyze the SEO requirement for the website.

How is this criterion evaluated?

The SEMRUSH tool analyzes the website and provides a score. A good grade is above 75

4.2 Page Speed Score

Page speed is a measurement of how fast the content on your page loads. Page Speed is a score given by

Google, out of 100, by its Page Speed Insights tool. Page Speed Insights, and web page performance tool

Lighthouse that powers it, takes raw performance metrics and converts these into a score of between 1 and

100.

Good Practice:

1. Page Speed score greater than 50.

When it is necessary to follow the criteria

This criterion is used only as a follow-up. But we recommend using it on all websites

How is the internal audit carried out in this criterion?

The audit is performed by the Google Page Speed platform that will analyze the velocity of the website.

How is this criterion evaluated?

The Google Page Speed tool analyzes the website and provides a score. A good grade is above 50

4.3 Accessibility

Accessibility is the practice of making a website usable for all individuals, regardless of their abilities or disabilities.

During the accessibility audit, we assess key elements such as navigation, images, and forms, using specific evaluation

tools. This thorough analysis enables us to identify and address accessibility issues, ensuring the website provides an

inclusive experience for all users.

Good Practice:

1. Accessibility score equal 100.

When it is necessary to follow the criteria

This criterion is used only as a follow-up. But we recommend using it on all websites

How is the internal audit carried out in this criterion?

Internal audit is conducted through a comprehensive evaluation of the website's practices and resources related to

accessibility.

How is this criterion evaluated?

This criterion is evaluated through a website audit, checking compliance with accessibility guidelines, like W3C's Web Content

Accessibility Guidelines (WCAG). A good grade is Equal 100 Means that the website has not violated any rules.

Share this article

Analytics

DGP - Website Pillar

DGP - Social Network Pillar

DGP Introduction

DGP - Website Pillar

RELATED CONTENT

DGP - Social Network Pillar

DGP Introduction