The rules on cookies are changing – are you prepared?

Most people will be aware that the rules on the way in which you are able to use website cookies are about to change. The new rules are causing quite a fuss in the media, but will they really make any difference to the way businesses operate their websites?

For now, I think the answer to that is probably no.

The EC Directive governing use of cookies - the EU Privacy and Electronic Communications Directive, otherwise known as the “e-Privacy Directive”, currently requires website owners to inform visitors about the use of cookies, the purpose for which they will be used and the right to opt-out. The amended Directive places an obligation on website owners to obtain “explicit consent” from visitors before using cookies.

But at the moment the Government is unsure how to tackle these changes.

As a result, it has not yet published any guidance or recommended solutions for implementing the new rules before they come into force on 25 May. The Information Commissioner’s Office (ICO), who will be responsible for enforcing the rules once they come into force, has also confirmed that it is unlikely to take any enforcement action against businesses in the short term. So come 25 May, in practice the new rules will have little impact.

However businesses do need to start thinking about what they should be doing to comply with the rules now. Why? Well here are some examples:

1. You don’t want to be caught unawares and then face a mad panic to comply when things start moving forward.
2. It will probably take some time to decide on a useful and workable approach for your business.
3. Once the Government’s guidance is published, the ICO is likely to be less lenient in enforcing the rules.

So, although the new rules will not make much difference at this stage, they are likely to at some point in the near future. As a result, I would recommend adopting the famous scouting motto - Be Prepared!

Comments

[Peter]

I think it will be interesting to see how far the exception for services "explicitly requested" by users can be stretched (see changes to Article 5(3) - http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011:01:EN:HTML). Presumably fine for registered users of sites like Facebook and probably for internet shopping on Amazon; presumably not OK for websites that simply provide information to visitors.