Most businesses are probably aware that the law which applies to how businesses use cookies and similar technologies for storing information on a user’s equipment such as their computer or mobile device changed on 26 May 2011.
Following an EU Directive and subsequent UK legislation, businesses are now obliged by law to obtain the explicit consent of each of their websites’ visitors before storing any data on their device. Websites must also provide ‘clear and comprehensive information‘ about the purposes of the storage.
The UK actually introduced the amendments on 25 May 2011 through The Privacy and Electronic Communications Regulations 2011. However, website owners were given until May 2012 to make their websites compliant with the new legislation.
Since then most UK businesses appear to have taken little or no action. When was the last time you were asked to give consent to the use of cookies when browsing a UK website?
Consequently the Information Commissioner published a very comprehensive ICO guidance document on the new cookies Regulations (click to download Guidance On The New UK/EU Cookies Regulations ) a couple of months ago. This sets out the changes to the cookies law and explains in simple terms what steps businesses need to take to ensure they are compliant.
Every business with a UK or EU facing website needs to read and understand that document, and create a suitable implementation plan.
There are some key points:
- This legislation is not going to go away. Action is needed.
- All cookies are NOT equal. Some are much more intrusive and these are the primary target for the legislation. It is important to therefore understand what cookies are set by your website and how they are used.
- The Information Commissioner has been clear that he will take a practical and proportionate approach to enforcing these rules where organisations are making the effort to comply. Proportionality will largely be based upon the types of cookies deployed.
- There are very limited and tightly defined exemptions to this legislation. However session cookies deemed to be an essential part of a web transaction e.g. shopping cart/checkout are likely to be exempt.
Finally, most websites use cookies as part of their Google Analytics (or similar) to gather site usage data. These fall within the legislation and are not exempt. However the final few paragraphs of the 27 page document quoted below provides some comfort on this subject.
We only use analytical cookies – if nobody consents that will seriously restrict the amount of information we can get to improve and develop our website
The Regulations do not distinguish between cookies used for analytical activities and those used for other purposes. We do not consider analytical cookies fall within the ‘strictly necessary’ exception criteria. This means in theory websites need to tell people about analytical cookies and gain their consent.
In practice we would expect you to provide clear information to users about analytical cookies and take what steps you can to seek their agreement. This is likely to involve making the argument to show users why these cookies are useful. Although the Information Commissioner cannot completely exclude the possibility of formal action in any area, it is highly unlikely that priority for any formal action would be given to focusing on uses of cookies where there is a low level of intrusiveness and risk of harm to individuals. Provided clear information is given about their activities we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action.
In summary, it is the responsibility of the website owner to comply with this legislation. If you require information or guidance on how your website uses cookies, then the starting point is to talk to the company that built your website.
If you require assistance in building and implementing a strategy to comply with the legislation, then call WSI Chester on 01928 787026.
