Cookies Digested

Written by Tim Davies
Written on Thursday, 26 July 2012

Cookies & the EU Privacy & Electronic Communications (e-Privacy) Directive

Cookies of the non edible variety have been making headlines recently and the question every website owner and operator should be asking themselves is; Are we compliant with the “Cookie Law”?

An EU-mandated “Cookie Law” came into force on May 27th 2011. The UK's Information Commissioner's Office (ICO), responsible for enforcement, gave UK companies a year’s grace to implement changes in order to meet the new requirements

What is a Cookie?

Many websites you visit will send a small amount of data to your computer which is then stored on your computer in the form of a file called a Cookie. Cookies can be used for many different purposes, such as recording options you set on websites and what pages you visited

What’s the problem with Cookies?

Fundamentally a cookie is quite harmless and often required for you to fully experience a website.

The real emotive issue however is the use of cookies for tracking purposes. Many websites use third-party tracking cookies that allow another unrelated company to gather data about your browsing history. Generally our browsing histories are used and sold by companies providing targeted advertisements on the internet.

What are the requirements of the “Cookie Law”?

The “Cookie Law” stipulates that cookies can only be stored after a user has given consent. A literal interpretation would mean a cookie could only be used after the user had implicitly agreed to store it.

In the eleventh hour the ICO released a statement indicating that “implied consent” was a “valid form of consent” for websites to gain compliance. This allows website owners and operators to assume users have already consented to the use of cookies by not blocking them in their browser settings. However, you are required to clearly state what cookies are being set.

How should my website deal with cookies?

Molokini recommends that the following steps are taken to ensure you are compliant with the “Cookie Law”

• Carry out a cookie audit - ascertain what cookies your website uses, what data is used, by who and for what reason.

• When a cookie has been set, make a clear statement on every page and link this to your privacy policy.

• Include details about what and why you use cookies in your website privacy policy. Indicate that your privacy policy has been updated in relation to the “Cookie Law”

• If you collect sensitive data such as medical or financial information then consider taking the law more literally and gain “explicit consent” before using cookies

Conclusion

A sweet irony to the new “Cookie Law” is that many government websites have failed to meet the legal requirements.

As a website owner or operator it is best to be upfront and clear on how your website impacts the user’s privacy with special details on how you use cookies.

For more information on the new "Cookie Law" see the ICOs website