Time to comply with the new rules on the use of cookies

I talked in an earlier blog (New rules on the use of cookies) about the new rules affecting website owners which came into force on 26th May 2011. Since writing the Information Commissioner’s Office (ICO) has provided a little more clarity about how the new rules will be policed.

The good news is that organisations and businesses which run websites aimed at UK consumers will be given up to 12 months to get their house in order before enforcement of the new EU cookies law begins. As a brief reminder, the main effect of the new rules is that (with one narrow exception) if you are a website owner you will need consent from a user of your site to store a cookie on their computer.

The ICO recognised that there had not been much time between the publication of the new rules and the date they came into force for website owners to comply – that was certainly true! So their sensible approach is to be welcomed.

Should you follow the ICO lead?
It’s interesting to see how the ICO has gone about complying. It says it is complying by having a header bar on its website which invites users to accept cookies, but that header also states that a cookie (which it indicates is essential for part of the website to operate) has already been set. A separate statement on the ICO website states that this is a session cookie which is deleted when a user leaves the site. I’m still trying to get my head around whether they really have complied since you can continue to navigate their site without ticking the box to accept cookies!

The ICO states that it followed its own advice by carrying out an audit of cookies used on its site and put together a plan aiming to provide users of its website with information and choices around those cookies before implementing its current solution. The ICO also updated its privacy policy to give more information about cookies including how to manage and delete them and says that it will continue to look at ways of giving users choices.

Doing nothing isn’t an option
The ICO says it would not necessarily expect other websites to do the same, as each site is different, and that it will supplement the recent guidelines to website owners as new examples come in. What is stressed by the ICO is that the twelve month timescale to comply is not an invitation to website owners to do nothing – those who choose to do nothing will have that lack of action taken into account when enforcement begins from May 2012. Once the ICO starts enforcement website owners could face fines of up to £500,000 for non-compliance, so take advantage of the next twelve months to prepare.

At Cousins Business Law we are following the ICO guidance by carrying out an audit of our site and looking at how we can comply with the new rules whilst not downgrading the experience of our visitor, not easy I have to admit. We remain hopeful that the promised efforts by the government to work with the main browser providers will mean a technical solution can be found.

I would recommend that all website owners carry out a thorough audit of the use of cookies (which may involve advice from your web developer), so that you will be in a position to decide what steps you may need to take to comply with the new rules. If you can comply now, then so much the better, but if you wait until the last minute before you even check your position, you may struggle to work out how to comply and implement a solution in time. We will be watching what is happening closely and will continue to blog on the topic and write about it in our monthly newsletter.

For more information on this or your legal issues relating to your website contact Sue Mann Commercial Solicitor, Birmingham.

For free advice on this topic please call us on 0845 003 5639.