There has been much concern amongst website operators and advertisers over how the new opt-in requirement for cookies under the amended E-Privacy Directive will be implemented. The government has now issued its proposals on how the opt-in will work.
Online behavioural advertising is big business and so this issue is being closely followed by advertisers and website operators. Online behaviour advertising works by gathering data, generally through cookies, about users for the purpose of delivering tailored advertising. When a user accesses a website that is part of the ad network cookies will be places on the user’s computer, unless the browser is set to reject cookies. The data collected is used to create detailed user profiles and deliver personalised advertising.
These provisions have caused much debate over whether implementation into UK law will require a complete overhaul of technology and practice, including reviewing currently available browsers and changes to the current system of opting-out as opposed to opting-in. There is also confusion over what exactly is required for “informed consent”, is a general opt-in sufficient or must each individual cookie be accepted? And the real question is, how is this going to work in practice and what will website operators be required to do?
The government in its impact assessment accompanying the consultation document considered two options to implement the provisions of the amended E-Privacy Directive:
• An opt-in consent system using pop-up windows or virtual labels on web-pages; and
Much to the relief of website operators and advertisers, the government has adopted a pragmatic approach to implementation and rejected the establishment of an opt-in consent system for cookies which would require users to consent to every cookie placed on their computer.
The government is relying on recital 66 of the amending directive which states that a user’s consent to cookies may be expressed by using the appropriate settings of a browser or other application, rather than requiring a separate specific opt-in for every cookie.
The government’s opinion reflects the concerns of online advertisers and website providers that an opt-in system would lead to a permanent disruption to services, online providers potentially suffering substantial losses, a loss of revenue from behavioural advertising of up to £740 million by 2012 and users switching from UK and EU sites to non-EU sties which are easier to use.
In practice, what does this mean for website operators? They are likely to be hopeful, but not necessarily a great deal more enlightened about what will be required of them. The impact assessment suggested that browser manufacturers should make their privacy settings more user-friendly and visible to users and that web sites need to provide users with clear and comprehensive information about cookies and how to opt out of them.
As specific guidance is not provided, it seems to be a case of watch and see. However, at this stage we are hopeful that if the government maintains its current line of thinking a complete overhaul of existing technology and practice will not be required when these amendments are implemented into national law.