On 26th May 2011 new legislation was introduced which regulares the use of cookies (or any other similar technology).

What is a Cookie?

A cookie is code that is put by a website onto your browser to store information, for example login details, language choice or tracking of sites and/or pages you have visited.

What are the new rules?

The new legislation prohibits the provider of a website from placing cookies on a user’s computer without first obtaining the user’s consent. Previously, it was sufficient that a website offered users the opportunity to refuse or object to the deployment of cookies. This is more commonly known as an “opt-out” scheme and does not require active consent. From May 2012 websites that use Cookies (or similar) will have to provide an "Opt In" option before a cookie can be placed on the user's machine.

The only exception to this rule is if the placement of the cookie is “strictly necessary” for a service requested by the user. Unfortunately, this exception is likely to be narrowly interpreted and will be limited to a small range of activities. The exception would not apply, for example, if the cookie is used to collect statistical information about the use of your website or because the placement of such cookies makes your website more attractive.

How to comply

The Information Commissioner's Office (ICO) has issued some guidance on the new rules:

1. Check what type of cookies and similar technologies are being used and how they are used.
2. Assess how intrusive the use of cookies are.
3. Decide on the best solution for obtaining consent.

The ICO suggests that a useful idea would be to think of this in terms of a sliding scale, with intrusive cookies at one end and privacy neutral cookies at the other. Efforts to achieve compliance should be prioritised for the more intrusive cookies, such as those that involve creating detailed profiles of an individual's browsing activity.

Third parties

The ICO guidance also specifically mentions the role of third parties. Firstly, where information collected about website use is passed to a third party then this needs to be made absolutely clear to users.

The ICO states that it is not just the website provider who needs to take note of the new rules. If your own content, software or other application (which uses cookies) is being used on another website, you may also be required to ensure that users of the other website are aware of any information being collected. In addition, such third party website must allow visitors to make informed choices about what is stored on their device.

Timescales and enforcement

The ICO may enforce the new rules in a number of ways including imposing significant fines for serious breaches. However, in recognition of the potential inconvenience that will be caused to both users and website providers, the ICO has stated that enforcement action will not be taken until May 2012. However, organisations must still take adequate steps to ensure compliance by May 2012 and the ICO may issue a warning to any website provider that it feels is failing to do so.

Steps must be taken to ensure compliance by May 2012.

Should you require any further information regarding these new rules then please do not hesitate to contact us

01865 920003.