The future for cookies under the European e-Privacy directive
16th May 2011
No doubt many readers would have heard about the impending European e-Privacy directive and that it is set to change the law relating to cookies.
The directive, which officially comes into force on 25-May 2011, states that cookies (small text files stored on a website visitor’s computer) must no longer be used unless the visitor grants the website “express permission” to place them on their computer.
The issue of consent is further compounded by the requirement that users be given clear and comprehensive information about the reasons for which cookies are stored by a particular website and how they may be accessed. Furthermore, websites will have to provide the opportunity to refuse storage and access of cookies.
The directive however makes an exception of cookies that are “strictly necessary” for provision of a service such as session cookies for e-commerce sites.
Cookies' use in 'remarketing'
Cookies are in fact immensely useful for all sorts of reasons, not least because they aid functionality by allowing computers to remember passwords, but, more controversially, allow marketers to analyse consumer habits. One manifestation is in the threatened field of remarketing, a behavioural advertising methodology whereby advertisers can track users to subsequent websites and show their tailored messages by virtue of previously stored cookies. An incredibly powerful tool, remarketing allows the marketer to keep displaying ads on third party websites to people who visited their website but made no transaction, or show successive products to people who did purchase something.
How may consent be gained?
The new law will mean that consent must be obtained for remarketing cookies and other forms of personalisation. As yet, however, there is a lack of clear guidance from the Information Commissioner’s Office on how the European e-Privacy directive is to be interpreted, how consent must be obtained and what constitutes “explicit consent”.
One method could be to ask users to confirm consent by way of a webpage pop-up. Another may be to read consent from users’ browser settings; Internet Explorer 9, for example, already includes a tracking protection setting. Yet another method may be one in which users sign up to a service that applies their preferences across different types of websites. Clearly any intrusive ‘opt-in rather that opt-out’ mechanism of consent is likely to present a barrier to users so developers are awaiting the guidelines from the ICO with interest.
What should businesses do?
Indications from the Department for Culture, Media and Sport are that how the new rules are to be implemented will not fully be established until after they come into force at the end of May 2011. However, businesses should be considering how they will ensure compliance with the new European e-Privacy directive and fully communicate to website users their use of cookies and the storage of cookie data.
Contact us
To speak to us about how the European e-Privacy directive may affect your online business or your website terms and conditions, contact a member of the Corporate Commercial law team using the details provided below.
The author, Muhammed Shaikh, is Marketing Manager at Pearson Hinchliffe LLP.