Under the rules of ‘The Privacy and Electronic Communications Regulations 2003, an EU Directive, the use of cookies and other such technologies are regulated. These technologies store and access information on a ‘user’s’ device – mobile, laptop, PC etc., using cookies. A cookie is a simple and small file that contains information such as user IDs, campaign information, basket contents, preferences etc., etc.
So what’s the big deal and why is it all of a sudden a hot topic? In 2009 an amendment to Article 5(3) of the E-Privacy Directive was made that requires consent for cookies – in other words to store and subsequently access information of the users device. These changes were to be implemented by member States before 25 May 2011.
The basic tenant of the legislation is to protect user information, even if that information is not personally identifiable. Originally scoped to address concerns over technologies such as spyware, it now covers all such technologies irrespective of the motivation, need or intent. Another contributing issue is the lack of awareness of what cookies are and how they are used – hence the ‘desire’ for legislation.
So what are site owners expected to do? In short understand what cookies are used, provide suitably informative ‘usage’ information for users and deploy ‘specific measures to obtain consent’. Clearly where consent is not forthcoming then systems need to be altered to continue to function, which could be a very significant task.
Don’t think you’re not affected… The legislation covers all types of cookies such as Flash, web beacons et al, whether they are session, persistent or time limited, first or third party.
So what does consent really mean? The guidance from the ICO (Information Commissioners Office) essentially states: -
- Before a cookie is set information about cookie and information useage and storage must be provided and explicit consent obtained.
- The ICO know this is difficult, and therefore websites must be able to demonstrate that they are actively reducing the time before cookie information is provided and consent obtained.
- Use of persistent cookies should be considered and wherever possible time limited or session cookies should be used instead.
What about implied consent? Again guidance can be summarised as: -
- Any reliance on implied consent must be on the basis of ‘shared understanding’ of what will happen, i.e. a cookie will be set, what they do and that ‘they’ signify their agreement.
- The ICO believes that awareness of cookies is so low that reliance on implied consent is untenable at present.
So who has to give consent? One (frankly daft) part of the legislation is that consent must be gained from both the subscriber and the user. The subscriber is defined as the person that pays for ‘the line’ and the user is the person using the device. So in my personal case I pay for home Internet access and my children use various websites over that ‘line’… In practice it is near impossible to get consent from both, the ICO suggests that consent from one at least should be obtained.
The ‘subscriber’ issue is further complicated by determining whose consent is required – the user or the subscriber. In reality using the example above, as the ‘subscriber’ I can change the browser settings so that cookies are blocked. I have declined consent on behalf of the user if that user can’t change those settings. Now change this to an employer ‘subscriber’ and employee ‘user’ scenario – the employers wish to allow cookies should NOT result in unwarranted collection of personal data of the employee. So using the browser alone is out…
So are there any exceptions? In short, yes there are, but interpretation becomes harder. For example the sole propose of providing a subscription service or where it is ‘strictly necessary’. The point here is that an exception is where it is for providing what the user wants not what the website owner wants. So if I want to buy a product, a cookie can be used to allow my selected purchase to be put in the basket for example, but if that cookie is then used to analyse what pages were visited and which keywords clicked then no exception applies. The one other exception is compliance with the data protection law.
So who has to comply? Again this is not strictly defined, but the website has the primary obligation irrespective of whether the cookie is first or third party. So you need to know what is being stored and by whom and make that information and the facility to gain consent available to the user. With first party cookies the website has complete responsibility and for third party cookies that responsibility is shared with the third party.
What about Browser settings? The directive states: -
‘consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent.’
However the main issue is that browser technology today does not cater for differing types of cookie – they just have a global ‘enabled’ or ‘disabled’ control. As we have already highlighted certain types of cookie are permitted, browsers just won’t do – today. But in the future as browser technology is enhanced then potentially the browser can be used to signify consent.
So what could websites be doing now?
- Audit use of cookies and how they are used – (what information is being saved etc.)
- Assess whether under the ICO guidance you need to seek consent or not, or for that matter for which cookies you do or do not need consent
- Publish information about use of cookies and what type they are – making that published information easily accessible to the user
- Act now… implement consent gathering solutions – or at least have a plan and be working towards it…
When do websites need to comply?
The ICO essentially gave 12 months lead-time for compliance – which means compliance by 25 May 2012. Any website for which a complaint was received would need to demonstrate they are actively implementing measures to comply…
So what if websites fail to heed the ICO guidance? Well in short he can: -
- Require organisations to provide him various information – see 1 above
- Require websites to give an undertaking to a course of action – see points 1 through 4 above
- Issue an enforcement notice…
- Fine websites up to £500k
Supplementary issues: -
- Multiple websites for one organisation can be dealt with individually or collectively but it must be absolutely clear for what consent is or is not being given etc.
- Consent only needs to be collected once – unless the use changes in which another consent needs to be gained
- Consent does not need to be gained for each cookie but can instead be gained by function as long as suitable information is provided
- You need to provide for user to change their mind – either withdrawing or granting consent at anytime.
- The legislation covers more than just cookies – if an ‘alternative’ such as device fingerprinting is used the legislation still applies
- Analytical cookies are NOT excluded from this legislation
- The DPA still applies – this is additional legislation
Notice: - Please DO NOT take our word for it or take our advice as definitive or wholly accurate – it’s our interpretation… please seek your own compliance advice.