Category Archives: cookies eu compliance

EU Cookie Directive Update

Deadline Day Today

Today is the ‘deadline’ for the EU Directive on the use of cookies on EU websites. So where are we as far as implementation is concerned?
At a recent press conference David Smith, deputy commissioner of the ICO (Information Commissioner’s Office) provided some clarification of what UK businesses need to do regarding cookies.
He also gave details of the action they will be taking over the coming months, which, in summary are:

• The ICO will send out letters to owners of the UK’s 50 largest websites asking them to show how they are asking for user’s consent to use cookies
• Evidence of taking action is currently the most important factor – like updating privacy statements, completing a cookie audit and making an action plan.
• But no fines are planned at present – evidence of taking action is the important factor.
• Sites outside the EU don’t need to comply, so Facebook, Google, etc are in the clear.

On the ICO website they also provide additional information around the issue of implied consent:

• Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies.
• If you are relying on implied consent you need to be satisfied that your users understand that their actions will result in cookies being set. Without this understanding you do not have their informed consent.
• You should not rely on the fact that users might have read a privacy policy that is perhaps hard to find or difficult to understand.
• In some circumstances, for example where you are collecting sensitive personal data such as health information, you might feel that explicit consent is more appropriate.

The ICO also state:

Cookies or similar devices must not be used unless the subscriber or user of the relevant terminal equipment:

(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) has given his or her consent.

The ICO provide information and a PDF download about the new law here.

Contact your web team if you are uncertain what you need to do and they should be able to help you.

EU Cookie Directive

Is Your Website EU Compliant?

Probably not. But don’t panic!

On May 25th 2012, all sites within the Member States of the European Union will be required to be sure that:

“…users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible.”

What does this mean?
This means that any website that gathers visitor information should clearly state what this is and provide an ‘opt-out’. And nearly every website does gather visitor information. Do you use Google Analytics? Yes? Then there is a cookie collecting visitor information, and from May 25 you are breaking the law – in theory.

However, after much delving into this it seems that many in the industry are waiting to see what exactly the law requires. So for the moment it’s a case of what to do and how to do it.

What you need to do
It’s important to have everything in place so that you are showing a willingness to comply and are ready to modify and adjust your strategy to the directive.

1. Update your Privacy Policy page listing the cookies your site is using and what they do.
2. Provide a cookie opt-out system – bt.com have a good example of this on their homepage. See www.bt.com – in the footer.
3. Ensure your web developer/designer/specialist keeps your site up to date as the new regulations are firmed up.

There are certain to be some companies out there who will try to exploit this and tell you that non-compliance will result in a £50,000 fine and you need to act NOW and buy their ‘EU Compliance Package’. All I can say is that the BBC (www.bbc.co.uk) have a Privacy and Cookies page that currently advises you to use your browser to delete any unwanted cookies on their site . . .