Websites to require consent to store cookies under new privacy law 

Wednesday, May 18 2011 by John Burns

New European privacy laws on the storage of cookies could affect internet consultants working on editable websites. Under the directive, which will take effect on May 26, businesses will have to gain the express consent of website users to receive all but the most essential cookies. Breaches of the new law will carry a fine of up to £500,000, making it an important piece of legislation for all companies with websites to understand.

A cookie is a small file of letters and numbers downloaded on to a device when the user accesses certain websites. They allow a site to recognise a user's device. The Information Commissioner's Office (ICO) has published guidance for the many businesses that will be affected.

The old regulations gave the user the chance to block cookies. The new law means that companies will have to provide "clear and comprehensive information about the purposes of the storage of, or access to, that information". Users will have to give their express consent to allow cookies.

According to the ICO, the only exception to this rule is if the storage of cookies is "strictly necessary" to the request made by the user, such as progressing to checkout or adding items to an online shopping basket.

The ICO says businesses will have to check what type of cookies they use and how these are applied. It stressed that this could include a "comprehensive audit" of a website. Next, it is up to firms to assess how intrusive the cookies are.

Browser settings will not be enough to indicate consent to allow cookies, the ICO said. It notes that most browser settings are not sophisticated enough to assume this. In future, however, many websites will be able to rely on a user's browser settings for consent.

In the meantime, the ICO suggests a few alternatives. These include pop-ups, which it says "might initially seem an easy option to achieve compliance", but could also "spoil the experience of using a website".

Businesses can also use the terms and conditions when users sign up to gain consent. "However, it is important to note that changing the terms of use alone to include consent for cookies would not be good enough even if the user had previously consented to the overarching terms," the ICO said in its guidance. "To satisfy the new rules on cookies, you have to make users aware of the changes and specifically that the changes refer to your use of cookies."

Living Streams "Improving clients' profitability through better use of the internet".