The deadline of 26 May 2012 for businesses to comply with new EU website cookie consent requirements in the UK has now passed. Under the EU’s amended e-Privacy Directive 2002/58/EC new rules were introduced last year for businesses to obtain the consent of website users to place cookies on a user’s computer. Although EU Member States were required to implement the consent requirements by 25 May 2011, the UK’s Information Commissioner’s Office (“ICO”) gave businesses a 12 month grace period to become compliant with the new law which ended on 26 May 2012. Many other EU Member States have still to implement the cookie consent requirements with only 20 of the 27 Member States having so far implemented the requirements into their national laws.1
The new EU cookie consent requirements contain an exception where the website is using a cookie “that is strictly necessary” to provide the service explicitly requested by the user. The ICO considers this exception should be narrowly interpreted and cannot, for example, be used to exclude cookies used for analytical purposes, such as counting the number of visits to a website, from the new consent requirements. Failure to comply with the EU cookie consent requirements can lead to enforcement action including fines from national data protection authorities.
Regarding the scope of the UK Regulations, the UK Guidance states that websites based outside of the EU, designed for the European market or providing products or services to customers in the EU, should consider that their users in the UK and the EU will clearly expect that information about cookies will be provided to them and their consent to set cookies obtained.
Providing clear and comprehensive information to the user
In addition to obtaining consent, the requirements under the ePrivacy Directive include that the user is provided with “clear and comprehensive information” about the purposes for which the information, such as that collected through cookies, is used.
Responsibility for compliance
Potential solutions to gain the consent of the user:
Feature-led consent – some information is stored in the user’s computer when the user decides to use a particular feature of a website such a watching a video or when the website remembers what the user did on a previous visit in order to personalise the content of the website. In these cases the website can ask for the consent to set a cookie at this point.
Browser settings – the view of the ICO is that most browser settings are not currently sophisticated enough to allow a website provider to assume that the user has given his consent. The UK Guidance confirms that the ICO and the UK Government are currently working with the major browser manufacturers to establish a new browser solution.
Steps to take now
Cookie Audit – businesses should check what cookies they are using on their websites, confirm the purposes, what data each cookie holds and the type of cookie (i.e. session or persistent and first or third party cookie). This could involve carrying out a comprehensive audit of the websites. The cookies used should also be analysed to determine which, if any, are “strictly necessary” and therefore might not need consent.
Cookie Assessment of Intrusiveness – the more intrusive a cookie the more priority should be given to getting meaningful consent. Some analytical cookies may have a limited privacy impact while cookies involved in creating detailed profiles of an individual’s browsing activity can have a significant privacy impact. An assessment of the intrusiveness of the cookies used should also be undertaken.
Cookie Consent Solution – in addition to deciding on the most appropriate of the cookie consent options, which are referred to above, it is also necessary to consider the information on cookies that should be provided to users. According to the ICO, for most users it may be helpful to provide a broad explanation of the way cookies operate and the categories of cookies that are used on the website.
If you have any questions regarding this update, please contact:
John Casanova, Partner
+44 20 7360 3739
William Long, Counsel
+44 20 7360 2061
1 Austria, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Malta, Slovakia, Spain, Sweden The Netherlands and the UK.
This Sidley update has been prepared by Sidley Austin LLP for informational purposes only and does not constitute legal advice. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this without seeking advice from professional advisers.
Attorney Advertising – For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300 and One South Dearborn, Chicago, IL 60603, 312.853.7000. Prior results do not guarantee a similar outcome.