Cookies, as you probably know, are small text files that web sites can send to your computer. They are used in many different ways, from analysing the way a site is used to remembering payment details during online shopping. At their best, they make the interaction between you and a website faster and easier. In fact, without cookies, it would be very difficult for a website to allow a visitor to buy anything, remember any of their details or even keep them signed in.
So what does it all mean?
The ‘new’ law is actually an Amendment to the EU’s Directive on Privacy and Electronic Communications which came into force in July 2002. At that time the Directive recognised cookies as a "legitimate and useful tool" for many activities and made it compulsory for web sites to:
- inform users if and how cookies were being used on the site;
- make users aware that they could set their computers to reject cookies.
From 25 May 2011 all businesses and organisations with websites in the EU will have to get a user’s consent if they want to store or access usage information from users’ computers.Reading the wording of the Amendment, it seems as though users should be notified every time a cookie is to be placed on their computer unless the cookie "is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested".
Take a look at this (tongue-in-cheek) interpretation of what this could look like...
http://www.davidnaylor.co.uk/eu-cookies-directive-interactive-guide-to-25th-may-and-what-it-means-for-you.html
People are rightly seeing that an immediate problem will be the interpretation of the phrase “strictly necessary” and worrying about the effect that such ambiguity could have on businesses. Others sensibly point out that the directive is currently just that: it will take time for national governments to incorporate the directive into their own laws – and for regulatory bodies (like the UK’s Information Commissioner’s Office - ICO) to clarify how it will actually be applied.
Here’s what’s been said so far by the ICO and the government.
- The UK’s Information Commissioner, Christopher Graham has announced:
“We are proactively working with the government, businesses and the public sector to find a workable solution. We recognise that the internet as we know it today depends on the widespread use of cookies and there are of course legitimate business reasons for using them. So we are clear that these changes must not have a detrimental impact on consumers nor cause an unnecessary burden on UK businesses. One option being considered is to allow consent to the use of cookies to be given via browser settings. Once the new regulations are published there will be a major job of education and guidance to be undertaken. In the meantime, both the business community and public sector organisations need to start thinking clearly about how they will meet the requirements of the new Directive.”Until we know exactly how the UK government will interpret and implement the directive it is virtually impossible for us to work out what we’ll need to do meet the new requirements. If they interpret it as being a browser choice which requires education we won’t have to do anything major to our sites (except, perhaps, beef up the cookie statement). But if they decide active permission has to be given by the user we will all have to make radical changes to our sites.
- A pragmatic approach appears to be being recommended by the Minister for Culture, Communications and the Creative Industries, Ed Vaizey:
“Businesses need to be working to address the way they use cookies [but] we recognise that work will not be complete by the implementation deadline. The government is clear that it will take time for meaningful solutions to be developed, evaluated and rolled out. We recognise this could cause uncertainty for businesses and consumers. Therefore we do not expect the ICO to take enforcement action in the short term against businesses and organisations as they work out how to address their use of cookies.”So – in the light of all this - what do organisations need to do right now while we wait for the decision?
- Be aware of the issue
- Include this awareness in our website planning
- Watch the ICO closely to see what they recommend
- Don’t panic!
Press release from the ICO:
http://www.ico.gov.uk/~/media/documents/pressreleases/2011/data_protection_officer_conference_news_release_08032011.ashx
More cookie chatter:
- http://econsultancy.com/uk/blog/4964-eu-no-cookies-without-consent-will-eu-affiliate-programs-be-killed
- http://www.out-law.com/page-10510
- http://www.dma.org.uk/news/nws-reitem.asp?id=6470&t=The+DMA+prepares+members+for+new+EU+legislation+on+cookies
- http://econsultancy.com/uk/blog/7275-why-eu-e-privacy-directive-is-not-a-real-threat-to-the-internet-industry
- http://www.iwr.co.uk/stm-and-legal/3010792/%E2%80%9CWake-up%E2%80%9D-to-new-EU-laws-on-cookies-warns-information-commissioner