For anyone responsible for a website that interacts with users,
a change in UK law next month (25th May 2011) will have significant
impact, according to intellectual property lawyer Martin Noble of
Stratford-upon-Avon law firm, Needham & James.
"On 25 May 2011, the UK law relating to cookies will change,
courtesy of a European Directive," explains Martin.
"This is likely to have an impact on anyone responsible for a
website that interacts with users, especially when they browse an
online catalogue or buy goods/services online.
"The difficulty is that neither the Government nor the
Information Commissioner, responsible for policing this area, has
made it clear how the law will be applied after 25th May, despite
the Government publishing its final plans on Friday 15th April
2011.
"Website operators should review their online policies and keep
a close eye on legal developments," he warns.
"Cookies are pieces of text that are usually saved on a user's
computer by a web browser," explains Martin. "In most cases they
are harmless and are simply there to enhance the user's experience.
For example a cookie could be used to personalise a website by
remembering the username on each visit so that it does not have to
be re-entered. There is often a tick box to allow this. However,
they can also be used to track where users have been roaming
online.
"This is a fertile environment for advertisers who tend to have
a much higher conversion rate for targeted behavioural
advertising.
"The current recipe gives users the right to refuse cookies at
any point, but the new recipe means that users have to say they
want the cookies in the first place. The issue is how the consent
will be given under the new 'baking regime'. At present, the most
common way of dealing with consent is for website owners to publish
their cookie usage within a privacy policy on the site. In
addition, users can change their web browser settings to accept or
reject specific or certain types of cookies. Privacy groups argue
that this is not sufficiently transparent. Some argue that consent
should be obtained before each specific cookie is inserted onto a
user's computer."
However, the difficulty is that many websites would be
inaccessible if the ability to download cookies is removed, as
Martin explains: "The Government does not think that the new law
requires an opt-in approach where cookies are strictly necessary
for the provision of a service specifically requested by the user.
In its view, the use of cookies relating to a virtual shopping
basket would be permitted if the web browser settings allowed it.
What is 'strictly necessary' has not been made clear beyond this
example.
"The concern for website operators is there is no specific
guidance currently available on the new law. The Government
recognises that there will be no pre-approved technical solutions
in place by 25th May, despite having several years to implement the
new law. There is a working group containing browser manufacturers
that will look into browser settings as a means of obtaining
consent, the current use of settings has been deemed to be not fit
for purpose. The largest area of concern, behavioural advertising,
will also be looked at in more detail. A second working party group
will also be set up to look into other options.
"What can we expect? Operators may be relieved to know that the
Information Commissioner is not expected to take enforcement action
in the short term against those that are working to address their
use of cookies or are engaged in development work on browsers
and/or other solutions.
"If your website was not designed by you, then you may not be
familiar with the types of cookies it uses. Given the uncertainty
ahead, you would be well-advised to find out how invasive your
site's cookies are so that you can start taking steps to make such
use more transparent and/or react to the ICO guidance and measures
that can be expected in the not too distant future."
For more information on the legal issues affecting websites,
please contact Martin Noble on 0845 620 9432 or E:
martin.noble@sp-legal.co.uk.