The 2002 Privacy and Electronic Communications Directive is being amended by a 2009 Directive, which every member state in the EU must implement by 25 May 2011.
Under the revised Directive it is necessary to explicitly obtain the user’s consent before serving cookies to their computer, unless the cookie is “strictly necessary” to provide a service “explicitly requested” by the user.
There is dispute between the views of the advertising sector and the Article 29 Working Party (a coalition of data protection regulators from across the EU), over whether a website can rely on browser settings to indicate consent to cookies. Advertisers claim that websites can, whilst the Article 29 Working Party strongly disagrees, stating that informed consent can only be obtained if prior information about the sending and purposes of the cookie has been given to the user.
The UK government has indicated that it plans to implement the EU Directive word for word, which will leave the dispute between the advertising bodies and data protection regulators unresolved. It seems it will fall to the Information Commissioner’s Office to provide further guidance once the implementing Regulations are finalised.
