Cookies, the tiny files that are saved onto your hard drive when you visit websites, are used to store information about the way you interact with a website. The idea is that, by using this information, the website can give you a more efficient and personalised experience. Using cookies, advertisers can also collate information about the sort of websites that a user accesses in order to deliver adverts specific to a user’s ‘tastes’. This is a key part of a now lucrative industry: the UK’s online ad industry saw a turnover of £1.75bn in the first half of 2009. However the law relating to cookies changed today (26 May) and a number of issues will need to be addressed.
Previously: the “informed opt-out” system
From 26 May 2011: the “prior, informed opt-in” system
Operators will need to obtain explicit consent from users before using cookies. There is debate over how this will be achieved in practice. Some suggest that internet browser providers could build-in settings that could allow users to specify what type of cookies they will accept in advance. Privacy groups argue that this does not represent ‘explicit consent’. The Information Commissioner suggests that browsers cannot presently be customised sufficiently well to enable a website operator to assume that a user has consented to downloading cookies via their browser settings.
Challenges and criticism
It has been said that the new rules overlook the technological complexity of the issue, that cookies play a crucial role in holding together the different layers of (often third party) content that make up modern commercial websites. A strict system of explicit consent for every cookie could unpick this construct, resulting in a poorer consumer experience as users are continually confronted with pop-ups seeking their consent. Some also speculate that tighter laws may lead to international publishers removing content from UK-targeted sites, or that key talent from within UK online advertising may relocate to less stringent locations like the US.
Guidance and enforcement
The Information Commissioner has noted that time will be needed for organisations to react to the new laws, so hard-line enforcement is likely to be some time away. In the meantime, the Commissioner has made it clear that organisations must be able to show that they are taking steps in response to the new rules. To help them do this, the Commissioner has published guidance which encourages focus on key areas such as:
- the type and purpose of cookies that are used;
- the level of intrusiveness involved; and
- the best way for gaining users’ consent.
The enforcement agencies will have key roles to play in finding a balance between privacy concerns, consumer convenience and commercial efficiency. The months ahead will shed light on what these laws will come to mean in practice.