New EU cookie consent requirement
There is also particular concern regarding compliance with the new requirements in relation to so called “third party” or “tracking” cookies used in behavioural advertising, where information from cookies is shared with third parties. In these circumstances obtaining consent may be more complex and care needs to be taken to make sure users are made aware of what data are being collected and by whom.
Confused transposition process in the EU
Another particular concern is the lack of a harmonised approach to implementation of the new consent requirements in different EU Member States. Despite the 25 May 2011 implementation deadline only ten EU Member States have yet implemented the requirements into their national laws, including Estonia, Finland, Ireland, Latvia, Lithuania, Malta, Sweden, Hungary, Luxembourg and the UK. The table on page 3 summarises the current position.
There is also a lack of clarity on how in practice consent may be obtained and in particular whether browser settings can be used to obtain consent. It is understood that in Ireland, Luxembourg, Sweden and the UK the implementing legislation or guidance expressly provides that consent may result from the browser settings. Of these early adopting Member States national guidance has only been published, so far, in Ireland, Sweden and the UK although further national guidance may be published in due course.
In the UK, the Information Commissioner’s Office (the “ICO”) has issued guidance on what may constitute a sufficient opt-in consent:
- Settings–led consent – obtaining consent as part of the process by which the user confirms what they want to do, or how they want the site to work, for example, when selecting a feature as to the size of text they want displayed.
- Feature–led consent – placing text in the footer or header of the web page which is highlighted or which turns into a scrolling piece of text when wanting to set a cookie on the user’s device.
- Browser settings – using browser settings to obtain consent, although the view of the ICO is that most browser settings are not sophisticated enough to allow a website provider to assume that the user has given their consent to the website using a cookie.
To allow businesses to achieve compliance the UK has a grace period of 12 months until May 2012 during which time the ICO will refrain from using its enforcement powers although businesses are expected to take steps to comply with the new requirements. It is also understood that in Sweden a grace period, expected to be around 6 months, will also be applied.
Another question that is still not clear is whether national Member State laws implementing the new cookie consent requirement will apply to website operators not established in a Member State, for example a US website accessed by French consumers.
Practical steps to be considered by businesses now
While there are still some unanswered questions concerning the implementation and scope of the new EU cookie consent requirement it is important that website operators start to consider the new requirements now and how they may apply to their business. Some practical steps that can be taken now include:
- monitoring the implementation of the cookie consent requirement in different Member States over the next few months;
- evaluating consent options, taking into account customer impact, costs and applicable laws; and
John Casanova at firstname.lastname@example.org or on +44 (0)20 7360 3739, Jens Rinze at email@example.com or on +49 69 22 22 1 4020, William Long at firstname.lastname@example.org or on +44 (0)20 7360 2061, or the Sidley lawyer with whom you usually work.
1 Based on adopted or draft legislation or based on views of Government authorities or national Data Protection Authorities. Some of the information in this update is based on views of local counsel which is likely to change and where Sidley Austin LLP is not admitted.
This Sidley update has been prepared by Sidley Austin LLP for informational purposes only and does not constitute legal advice. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Some of the information in this update is based on views of local counsel which is likely to change and where Sidley Austin LLP is not admitted. Readers should not act upon this without seeking advice from professional advisers.
Attorney Advertising – For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300 and One South Dearborn, Chicago, IL 60603, 312.853.7000. Prior results do not guarantee a similar outcome.