Cookies law introduced: websites must seek consent

Keyboard image
A change in the law means website must now seek informed consent Photo: ITV News

From Sunday websites must seek "informed consent" from users before installing cookies - small pieces of software which can identify web users - on user's computers.

During planning stages for the new law the Information Commissioner's Office (ICO) had said that implied consent would not work but on Thursday the ICO changed its mind and said that informed consent would suffice.

This change - putting the onus on the user and not the website - effectively says that websites can assume users have given their consent.

It's feared this could leave many British firms out of step with the rest of the EU and could lead to courtroom battles.

From Monday websites will be expected to tell users what cookies are being placed on their machine, most probably through a pop-up window.

To help in the battle against the mis-use of cookies the ICO is launching a tool for the public to report non-compliant websites.

The owners of non-compliant websites face fines of up to £500,000 but the ICO has said it will not be pursuing prosecutions until the new rules have had time to bed in.

Which is fortunate as last week the government admitted the majority of its websites will not be ready in time.

The ICO says May 27th is not a cut-off date but an attempt to help websites focus on their cookie use.

84% of web users aged 16-64 are aware of internet cookies

24% of web users aged 16-64 know about the new guielines

– Ipsos Mori poll commissioned by Truste

But there are serious concerns about the impact the new legislation will have on e-business especially in relation to EU competitors.

This time last year Brussels introduced amendments to the 2003 EU e-privacy directive in requiring websites to gain user consent for the use of tracking technologies, the most common of which are 'cookies'. The changes encouraged companies to be more open about what these cookies are and how they might be used. In the UK, the ICO gave companies a year-long grace period to implement these changes, which comes to an end on 26 May 2012.

But UK websites have complained the ICO now putting its foot down would put them at a disadvantage against European sites which had taken a more laissez-faire attitude to implementing the directive.

Given that the rest of mainland Europe is yet to take this directive seriously, it is a shame that UK Plc's online economy is being jeopardised. If the new cookie law were fully enforced by the ICO, it could make Europe – and the UK specifically – a less attractive place to do business, and less competitive globally.

– Vinod Bange, data privacy specialist at the law firm Taylor Wessing

To download a copy of the ICO new guidance click here.

For more information visit the ICO's website.

The ICO has also produced a Q&A video: