EU Cookie Deadline Approaching
The 25th May is the deadline for implementing changes to the EU Privacy and Electronic Communications Directive. Organisations need to make efforts to comply with the regulations.
The changes mean organisations have to obtain consent from visitors (consumers) to their web sites in order to store on and retrieve usage information from users' computers. Whilst this is aimed at tracking cookies (e.g. behavioural advertising, site personalisation, remember-me functionality), the effect on cookies used for session management and tracking to defend privacy & security is not clear.
While the roll out of this new law will be a challenge, it will have positive benefits as it will give people more choice and control over what information businesses and other organisations can store on and access from consumers' own computers.
But what to do? Self regulation guidelines have just been issued by IAB Europe, the trade body for the European online advertising industry, but this pre-empts formal guidance. The Department for Culture, Media and Sport (DCMS) is leading on implementing the new measures in the UK while the Information Commissioner's Office (ICO) will be responsible for regulation, but the guidance is not expected until after the 25 May deadline. Part of this delay is likely to be due to wanting a joined up approach with the US Federal Trade Commission (FTC) who have been consulting on similar measures, and received a large amount of feedback. DCMS commissioned a report on regulation of internet cookies and this contains much useful information, but doesn't give any firm clues about what the guidance will be.
In the meantime, I would recommend organisation undertake the following steps if they don't already have this information:
- Identify all their web sites and applications.
- Determine which of these are accessed by consumers.
- Create a schedule of all the cookies created or used, including cookies from third-party content hosted on the site (e.g. analytics, advertising, widgets, code libraries).
- Detail other functionality which collects or stores information about users.
Then await for announcements from the DCMS and ICO.
Update today: The government's summary and response to its own consultation was published today after this item was posted. This confirms (see paragraphs 305-326) a non-prescriptive approach, that is not expected to affect the use of cookies strictly necessary for the provision of a service specifically requested by a user (e.g. session identifier, or a shopping basket). In addition, due to need for future phased implementation of technical solutions, it does not expect the ICO to take any enforcement action against organisations who are at least making some efforts to comply.
Posted on: 15 April 2011 at 08:10 hrs
Comments are filtered automatically and should appear shortly after they been checked.