Controversial Cookies

September 29, 2010

There has been much concern amongst website operators and advertisers over how the new opt-in requirement for cookies under the amended E-Privacy Directive will be implemented. The government has now issued its proposals on how the opt-in will work.

Online behavioural advertising is big business and so this issue is being closely followed by advertisers and website operators. Online behaviour advertising works by gathering data, generally through cookies, about users for the purpose of delivering tailored advertising. When a user accesses a website that is part of the ad network cookies will be places on the user’s computer, unless the browser is set to reject cookies. The data collected is used to create detailed user profiles and deliver personalised advertising.

The amendments to the E-Privacy Directive must be implemented by 25 May 2011. These require website users to consent to the use of cookies, having been provided with clear and comprehensive information about the purpose of the cookies, unless the cookie is strictly necessary for the provision of services to the user.

These provisions have caused much debate over whether implementation into UK law will require a complete overhaul of technology and practice, including reviewing currently available browsers and changes to the current system of opting-out as opposed to opting-in. There is also confusion over what exactly is required for “informed consent”, is a general opt-in sufficient or must each individual cookie be accepted? And the real question is, how is this going to work in practice and what will website operators be required to do?

The government in its impact assessment accompanying the consultation document considered two options to implement the provisions of the amended E-Privacy Directive:

• An opt-in consent system using pop-up windows or virtual labels on web-pages; and

• Allowing consent to the use of cookies to be given via browser settings.

Much to the relief of website operators and advertisers, the government has adopted a pragmatic approach to implementation and rejected the establishment of an opt-in consent system for cookies which would require users to consent to every cookie placed on their computer.

The government is relying on recital 66 of the amending directive which states that a user’s consent to cookies may be expressed by using the appropriate settings of a browser or other application, rather than requiring a separate specific opt-in for every cookie.

The government’s opinion reflects the concerns of online advertisers and website providers that an opt-in system would lead to a permanent disruption to services, online providers potentially suffering substantial losses, a loss of revenue from behavioural advertising of up to £740 million by 2012 and users switching from UK and EU sites to non-EU sties which are easier to use.

Although this approach will please those in the technology sector, it is likely to be at odds with the views of the EU Article 29 Working Party (the EU data protection authorities). The Article 29 Working Party issued a pre-emptive opinion on June 2010 demanding strict opt-in standards for the use of cookies. In the Working Party’s opinion most browsers accept cookies by default and this does not mean that the user has consented. Brower settings can only provide consent in very limited circumstances. The opinion of the Working Party is not binding, but is likely to be considered if the UK’s implementation of the Directive is ever reviewed by the European Commission.

In practice, what does this mean for website operators? They are likely to be hopeful, but not necessarily a great deal more enlightened about what will be required of them. The impact assessment suggested that browser manufacturers should make their privacy settings more user-friendly and visible to users and that web sites need to provide users with clear and comprehensive information about cookies and how to opt out of them.

As specific guidance is not provided, it seems to be a case of watch and see. However, at this stage we are hopeful that if the government maintains its current line of thinking a complete overhaul of existing technology and practice will not be required when these amendments are implemented into national law. 


Related pages:

Data protection privacy & emarketing more

Data Protection, Privacy and emarketing more

Technology, Media & Digital more

icons Addthis Print Contact Register

Contact

tel: +44 (0) 20 7628 2000
10 Finsbury Square, London, EC2A 1AF
View map

Accreditations

  • Top Ranked Chambers UK 2014 - Leading Firm
  • Ranked in Chambers Europe 2013 - Leading Individual
  • Ranked in Chambers Global 2014 - Leading Firm
  • Legal 500 - Leading Firm
  • The Lawyer UK 200 - Listed Firm
  • The Law Society Excellence Awards 2012 - Shortlisted
  • Investors in People - Bronze