Cookie Monster eating cookie
On the 26th of May 2011 new rules come into effect that cover how you can use cookies and other similar technologies to store information about visitors to your web site. In this post we explain the changes so you can understand whether you are affected, and suggest some sensible things you might do next.
UPDATE 27 May 2011
Last-minute deal means UK web site owners will get an extra 12 months to comply. The Information Commissioner has agreed to hold off on enforcing the new regulations for 12 months, following talks with Communications Minister Ed Vaizey.
But first, before worrying about the new stuff make sure you obeying the old rules properly! Many people don’t realise that there are laws that govern how you do business online. Fortunately the requirements are fairly simple to meet.
Basic rules for selling online
The key things are to be clear about who you are and your prices. All commercial web sites must give the company (or sole trader’s) name, postal address, email address, and also the company number and VAT number if you are registered. All prices on the web site must be clear and unambiguous. You must state whether the prices shown include taxes and delivery costs. Similar rules apply to your emails.
There’s a brief guide at Pinsent Masons free legal site OUT-LAW.
New rules on cookie consent
The new rules coming into effect on the 26th of May 2011 are all about cookies, and other ways of collecting and storing information about the person visiting your web site. The changes are prompted by an EU privacy directive that has already passed into UK law, and which comes into effect this month.
The Information Commisioner’s Office (ICO) has issued guidance that you can download here as a PDF about using cookies and similar tracking technology.
The item that is causing all the fuss is that you will now need to have each user’s active consent. Even the ICO recognises that “gaining consent will, in many cases, be a challenge”.
Fortunately there is some latitude, because cookies that are “strictly necessary” to provide a service already explicitly requested by the user are allowed. This should cover the use of cookies in things like shopping carts and in saving preferences about text size or colour. Unfortunately there is still plenty of ambiguity about how far this get-out clause extends.
Don’t panic
The important thing is not to panic, as vast numbers of web sites will be affected. It is unlikely that any heavy-handed enforcement activity will be directed at you or anyone else in the near future. We are likely to see new guidance and possibly some test cases with major players before ordinary small businesses are targeted.
However, we may get scare stories in the media. Since this rule change was prompted by an EU Directive, it could well produce a crop of “EU madness” stories. The change could also be seen as a classic example of red tape imposing an uneccessary burden on small businesses, which could spark more controversy.
The danger is that to make these stories more interesting journalists and politicians may talk up how widespread and burdensome the changes needed to the UK’s web sites will be. This would be bad if it led to small firms spending unnecessary time or money on a minor and not very urgent problem.
This would be doubly unfortunate if the ICO then agrees some fix or compromise that allows firms to solve the problem relatively easily. Another real possibility is that the major browser vendors will come to the rescue. For example, they could add new features to Internet Explorer, Firefox, Safari and so on to enable users to clearly signal their consent to particular types of cookie. Such a development wouldn’t let web masters dodge the law, but it might offer them simpler ways of complying with it.
So this is a time to:
- check your web site to make sure you are doing the basics necessary to trade legally online outlined above
- review your cookie use, but hold back on doing too much until the response of the wider business world becomes apparent.
To put this in perspective, of the 2,565 data breaches reported to the ICO last year, just 36 of cases have resulted in any form of action by the watchdog to date, and only four have resulted in civil penalties (reported in The Register).
The Information Commissioner is evidently more concerned with encouraging best practice and getting firms to consider privacy issues than in levying fines. Small self-employed business are very unlikely to be first in the firing line if the ICO decides it needs to get heavy.
“Good regulation is about getting the best result in the public interest” says the ICO itself in a recent report. “For a monetary penalty to be served the Information Commissioner has to satisfy a strict set of criteria including that the breach could have caused substantial damage or substantial distress to individuals and that the organisation knew, or ought to have known, that there was a risk that a breach may occur.”
So what is PRIME doing?
Not panicking! We are certainly affected, since we know we use cookies to distinguish between new and repeat visitors at our www.prime.org.uk web site. We use this information to tell new visitors about this web site, PRIME Business Club, in case they would rather come here. We stop telling repeat visitors to www.prime.org.uk after a small number of visits, as the message we display could become annoying.
We’re not sure if this comes under the “strictly necessary” get-out. So we could decide to comply with the new rules by simply leaving the message running, or turning it off altogether. But that would be overkill at this point. We don’t yet know what other reputable web site owners are doing on the cookie-consent front, and what other guidance will be issued.
Meanwhile another thing we can do is to check whether either of our sites sets other cookies we don’t know about. This is fairly likely. Few people who have web sites now get intimately involving in the technical detail. This is because it isn’t necessary with today’s heavily automated content-management tools. To put it frankly, we simply don’t know what’s happening down at the cookie-setting level. Who does nowadays?
So the next step for us is to audit our two web sites and have a look at what appears to be going on. There’s an article here about ways of doing this simply, by visiting you own site with a normal browser set up in a particular way.
Further Reading
Websites told to ensure cookies comply with UK law – BBC
EU Chews on Web Cookies – Wall Street Journal
Guest opinion: The EU’s legal war on cookies is barking mad – Wired
