EU Cookie Law Update
18/05/2011
This is an update to our earlier article on the EU Cookie Law
From the 26 May, website providers will need to comply with the EU Privacy and Electronic Communications Directive (PECD).
This states that websites will need to receive explicit consent from users in order to store cookies on website users' devices so that the website can recognise the user's device in future. Under the Directive, web-users will need to 'opt-in' to the storage of data using cookies and there will be a requirement for users to be fully informed as to the content and extent of the information which is going to be stored.
The ICO have now produced a non-exhaustive list of methods of obtaining consent. These are intended to help businesses prepare for the new rules. The recommendation is that these consent methods should be highly visible through (annoying) pop up boxes.
The Government's recent consultation response suggests that, "through clicking on the icon, the consumer will be informed about: each specific Internet advert; the advertiser; the server; who the advert was customised by; and an option to refuse those and other cookies (including an option to refuse all cookies from that server)".
Actions required to comply with the EU Privacy and Electronic Communications Directive (PECD).
1. Web providers need to check what cookies are currently used by carrying out a website audit or checking what data is placed on the user's computer.
2. An analysis of whether the information gathered is 'strictly necessary' and whether it is gathered by informed consent.
3. Check how intrusive the cookies are to the individuals privacy. If the information gathered creates a detailed browsing profile, more comprehensive consent methods may need to be adopted.
4. Decide how consent will be obtained i.e. through pop-ups, terms and conditions when entering the website, or scrolling text footers or by some other method.
We see three approaches to dealing with this.
Marketing websites can actually turn this directive on its head and use it to their advantage, as an excuse for annoying pop ups which include a small icon linking to privacy details and a large attention seeking offer.
Informative websites have more of a dilemma as many use Google Analytics for gathering data. This is one of the 3rd parties. The question is whether users must say yes to this tracking code.
Some websites provide 'extra information' such as Google map data, and one option here will be to turn this into essential data, and then use of the Cookie is OK.
