UK cookie cutter laws come into effect
The EU's revised privacy directive which outlaws tracking cookies without consent came into effect on 25th May 2011. The ICO said it would give companies twelve months grace to become compliant before it took legal action. Now that those twelve months have elapsed, can we expect a flurry of prosecutions?
The EU privacy directives say that websites which track their users via mechanisms such as tracking cookies must make it clear to the users that this information is being collected and allow the user to make an informed choice as to whether or not to allow such tracking to take place. It attempts to distinguish between those cookies which are essential to the operation of a service, such as using a cookie to maintain your log-in credentials or to hold your shopping basket data, and those cookies which are there purely so that people can keep tabs on you and build up a dossier on you and your behaviour. The way a directive is implemented in national law is a matter for each state within the EU.
As the UK's 2012 deadline approached, a number of sites have made changes in an attempt to become compliant. For instance, the BBC now displays the following message at the top of the page when you first visit its website:
"We use cookies to ensure that we give you the best experience on our website. If you continue without changing your settings, we'll assume that you are happy to receive all cookies on the BBC website."
If you didn't notice that message the first time you visited the BBC website, it will have set a cookie to say you are happy to accept BBC cookies and you won't see the message again. Other sites have used variations on this, and many are basically saying "We use cookies, if you don't like it, don't use the site." It seems the ICO is happy with such an approach yet if that is a valid way of complying with the privacy directives then one has to ask what was the point of the directive in the first place?
The heart of the problem is that this is seen as a "cookie law" instead of a privacy law, but it is not cookies themselves which are the problem. Somewhere between 60% and 80% of the cookies being issued today are tracking cookies for advertising networks and many people are saying you have to allow those cookies because adverts keep the web free. That too is a flawed argument. Advertisers can advertise without tracking the individuals who read their adverts. TV and magazines have managed to publish ads for years without their advertisers needing to know the identities of the people who view their ads, and without needing to know invasive details of your TV watching behaviour or link it to other personal details about you.
Ultimately, the ICO is unlikely to ever take any useful enforcing action; many websites will believe that in order to be compliant they need to write yet more of the tortuous pseudo-legal terms and conditions statements; politicians will congratulate themselves on a job well done; and the vast majority of tracking cookies will be unaffected anyway because they originate from advertising networks outside the EU. Meanwhile, all Skill Zone managed websites have been compliant with the EU directive since day one.
30th May 2012
This article comes from the SKILLZONE email newsletter, published monthly since January 2008, and covering topics related to technology and the internet. All articles and artwork in the SKILLZONE newsletter are orignal content.