That’s the way the Cookie crumbles – IMPORTANT UK/EU Cookie Law Compliance
You may have read recently that the regulations around cookies and storing User information online are changing. Don’t panic though – make sure you know how this may impact your company’s website and make the necessary changes.
Last year new legislation was introduced across the European Union and the UK surrounding privacy online and the explicit use of cookies. Companies will now have to ask Users to opt-in, thus giving prior consent, to allow sites to store cookies based on their activity online rather than the original opt-out model. Moreover, this new cookie law ensures that cookies can only be activated and User information stored if the User has given their express consent first. However, the law and corresponding actions only applies to Users visiting the site from within the EU. While the total effects of this cookie legislation are still not certain it will impact the way in which your website performs.
A cookie is a small text file containing a unique ID that is placed on your computer by a website and then stores files of information, such as the pages you visit or what information you enter. These cookies tend to be mutually beneficial, making for a smoother and more personalised User experience, whilst allowing companies to monitor site performance.
The legislation has been designed to protect customers’ online privacy and it aims to make Internet Users more aware of cookies by giving them choice and control over how they want to interact with websites.
It will affect any UK/EU website that conducts cookie activity that is unlikely to fall within the exception (see the table below for further information). This includes cookies from visitor tracking codes or advertising, as well as technologies that have similar behaviours to cookies like Google Analytics (third party) and Locally Stored Objects i.e. Flash Cookies, HTML5 Local Storage and anything else that stores information about a User. NB: this law applies to businesses that are based in the UK/EU that have websites hosted outside of this region.
As the ‘lead in’ period comes to an end online organisations that have not already reached compliance will need to demonstrate/provide evidence that they have taken measurable action towards cookie compliance. Additionally, information on why it was not possible to achieve full compliance by 25 May 2012 must be provided, as well as a time scale for the expected achievement of compliance and details of what work has been carried out to ensure the correct steps towards compliance are being taken.
Gaining Consent
Going forward, websites that use cookies to store or receive any data on a User’s computer or other devices with online capabilities (for example a smartphone or tablet must gain consent from its Users). The ICO has not stated exactly how websites should gain User consent because the “Information Commissioner wants to provide as much flexibility as possible for organisations to design solutions that meet their business needs and provide Users with the choices they require.” However, the ICO has clearly stated that “consent must involve some form of communication where the individual knowingly indicates their acceptance. This may involve clicking an icon, sending a newsletter or subscribing to a service…..the individual must fully understand that by the action in question they will be giving consent.”
Website owners are advised to decide what solution to obtain User consent will be best for both parties and to also consider that the more privacy intrusive an activity is, the more a website owner will need to do to gain meaningful consent. Once valid consent has been obtained from a User on a website, it does not need to be re-obtained each time they visit said site. There are various methods of obtaining User consent such as a pop-up box or a simple banner in the header or footer of a web page.
The ICO has published a very succinct guide to help you choose how to acquire User consent in order to meet compliant web standards – examples are available from page 14 onwards.
Cookies/Privacy Policy
Website owners should also inform their Users about cookies with an updated privacy policy that explains what the cookies are, which ones are on their website, how they are used and why they are stored on a visitors’ computer, mobile phone or other web-enabled device. Clear and comprehensive information about the purposes of cookies and should consider the general publics’ understanding of cookies and their functionality should be provided. Additionally, it should also explain how Users can withdraw consent for cookies, as well as a description of what – if any – consequences are after withdrawing consent, for instance, the impact on website functionality.
Detailed below are the ICO’s guidelines which states which cookies are and are not exempt from compliant standards. The information below has been referenced from pages 8 – 9 of the Guidance on the New Cookies Regulations document.
|
Activities likely to fall within the exception |
Activities unlikely to fall within the exception |
|
A cookie used to remember products the User wishes to purchase at checkout, or add to their shopping basket. |
Cookies used for analytical purposes (Google Analytics) to count the number of visitors to a site. |
|
Cookies used to remember login details, shopping address or billing address. |
First and third party advertising cookies. |
|
Cookies that assist in the speedy loading of content pages. |
Cookies used to personalise website experiences. |
Cookie activity that is likely to fall within the exception does not require User consent before being set on a website. Although, it is advised that going forward if a User does not consent to cookie activity that is unlikely to fall within the exception, or a User has simply ignored a consent communication, then a notice on each web page visited after this action or non-action – e.g. in the footer – should display information that encourages Users to read the updated cookie/privacy policy to find out about the basic cookies set on the website.
What You Need To Do To Comply
The ICO recommends that you take these steps:
- Research what type of cookies your website uses and how they are used.
- Assess how intrusive the use of cookies on your website are.
- Decide which approach you would like to take to obtain consent from your visitors.
- Make the necessary design arrangements.
- Update your privacy policy.
If a website is investigated by the ICO after 25 May 2012 or a complaint is filed by a website User and said website is found to not meet the compliant standards, then the website owner will need to display evidence of their actions towards compliance.
What Happens If You Don’t Comply
The ICO has a range of regulations and enforcements available, including the power to serve penalties of any amount up to £500,000 to businesses that are discovered to be breaching the law. For further details on enforcement and penalties for non-compliance, please read pages 24-25 of the ICO guide.
What The ICO Says
The ICO has announced that companies have until 25 May 2012 to comply with the new law, stating that:
“The government’s view is that there should be a phased approach to the implementation of these changes. In light of this, if the ICO were to receive a complaint about a website, we would expect an organisation’s response to set out how they have considered the points above and that they have a realistic plan to achieve compliance. We would handle this sort of response very differently to one from an organisation which decides to avoid making any change to current practice.”
Recommendations
- Complete an audit to analyse what cookies and other storage technologies are currently used by your site and why.
- Make sure your privacy policy is up-to-date to include information on the storage of User information.
- Inclusion of device(s) on your website for Users to provide consent relating to cookies.
- Cookies also affect email through third party analytical tracking, get in touch to find out more.
- Make sure that the design and wording of your solution encourages the User to click ‘yes’ by communicating the benefits of consenting to cookie usage.
The Next Steps…
By 25 May 2012, any UK/EU website that sets cookies will have to legally obtain consent from its Users for the use and setting of any cookie activity. We would recommend that you seek legal advice regarding your privacy policies and terms, and conditions as they will need to be re-written and will need a section added specifically regarding cookies.
If you want your site to be as compliant and efficient as possible please get in touch. We can conduct a cookie audit of your website, help you update your privacy policy and install devices to obtain consent. To contact us and start the process for Cookie Law Compliance, please call 01943 872505 and speak to the team at PCD Agency.
You may have read recently that the regulations around cookies and storing User information online are changing. Don’t panic though – make sure you know how this may impact your company’s website and make the necessary changes.
Last year new legislation was introduced across the European Union and the UK surrounding privacy online and the explicit use of cookies. Companies will now have to ask Users to opt-in, thus giving prior consent, to allow sites to store cookies based on their activity online rather than the original opt-out model. Moreover, this new cookie law ensures that cookies can only be activated and User information stored if the User has given their express consent first. However, the law and corresponding actions only applies to Users visiting the site from within the EU. While the total effects of this cookie legislation are still not certain it will impact the way in which your website performs.
A cookie is a small text file containing a unique ID that is placed on your computer by a website and then stores files of information, such as the pages you visit or what information you enter. These cookies tend to be mutually beneficial, making for a smoother and more personalised User experience, whilst allowing companies to monitor site performance.
The legislation has been designed to protect customers’ online privacy and it aims to make Internet Users more aware of cookies by giving them choice and control over how they want to interact with websites.
It will affect any UK/EU website that conducts cookie activity that is unlikely to fall within the exception (see the table below for further information). This includes cookies from visitor tracking codes or advertising, as well as technologies that have similar behaviours to cookies like Google Analytics (third party) and Locally Stored Objects i.e. Flash Cookies, HTML5 Local Storage and anything else that stores information about a User. NB: this law applies to businesses that are based in the UK/EU that have websites hosted outside of this region.
As the ‘lead in’ period comes to an end online organisations that have not already reached compliance will need to demonstrate/provide evidence that they have taken measurable action towards cookie compliance. Additionally, information on why it was not possible to achieve full compliance by 25 May 2012 must be provided, as well as a time scale for the expected achievement of compliance and details of what work has been carried out to ensure the correct steps towards compliance are being taken.





























