In May 2011 there was an amendments to the 2003 EU e-privacy directive. This required websites to gain user consent for the use of tracking technologies, the most common of which are 'cookies'.
Updated advice from the information commissioner have been issued just hours before the new regulation was to come into force. The largest change was that they now state websites can imply that the users have consented to use their cookies.
“While explicit consent might allow for regulatory certainty and might be the most appropriate way to comply in some circumstances this does not mean that implied consent cannot be compliant.”
Implied consent is not a euphemism for “doing nothing”!
If you wish to rely on this implied consent then you need to be satisfied that your users understand that their actions will result in cookies being set. Without this understanding you do not have their informed consent.
Cookie information was usually part of a websites privacy policy accessed via a link at the bottom of the webpage. This needs to be changed to increase awareness of the websites cookie usage. The ICO have specific suggestions of how to do this.
- Move the link to the top of the page
- Make the hyperlink more obvious – “Read about our cookie policy”.
- Possibly change the formatting of the link so it stands out.
- You might consider a splash screen, pop-ups or similar techniques such as message bars or header bars to inform your users.
The ICO website users a header bar with a link to the privacy policy to inform the users of their cookie usage. It is worth noting that users do not have the option of not using cookies, they just need to be told that cookies are being used.
Further Reading
http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/cookies.aspx
Comments