Cookie law: websites must seek consent from this weekend

A person uses a laptop keyboard The EU wants to put a stop to tracking cookies logging a user's activity without their knowledge

Related Stories

Friday marks the last working day for UK businesses to prepare their websites for a new law governing the use of cookies.

From Sunday, sites must obtain "informed consent" from visitors before saving cookies on a machine.

Cookies are pieces of personal data stored when users browse the web, sometimes to power advertising.

The Information Commissioners Office (ICO) is to launch a tool for the public to report non-compliant sites.

It is expected that the vast majority of websites will not be ready in time.

However, the ICO has said it would not take immediate action over non-compliant sites, and would instead offer guidance.

Tracking data

The rules are designed to tackle privacy issues resulting from the growing use of cookies which track users' browsing habits.

The guidelines, set by the EU, mean visitors must be told what cookies are being placed on their machine.

Start Quote

Some organisations may be made an example of in order to set the parameters of compliancy moving forward”

End Quote Vinod Bange Data privacy lawyer

Typically, this will mean a pop-up window seeking consent.

The BBC, which brought its site in line with the guidelines on Thursday, allows users to opt out of certain cookies the first time they visit the website.

An Ipsos MORI poll, commissioned by privacy solutions provider Truste, suggested that while 84% of online consumers aged 16-64 were aware of internet cookies, just 24% knew about the new guidelines.

The owners of non-compliant websites face fines of up to £500,000, but the ICO has played down the threat of such serious action, telling the BBC it would take a soft approach to enforcement.

"Up until now, if we received a complaint about your website we would point you in the direction of our guidance," said Dave Evans, group manager for the ICO.

"Given that everyone has had a year [to comply], we're going to shift from that kind of approach to one which will be very much more focused on those people who don't appear to have done anything and asking them 'why not?''"

Last week the government admitted that most of its sites would not comply with the new rules in time. It said it was "working to achieve compliance at the earliest possible date".

Cookie flavours

Cookies are small files that allow a website to recognise and track users. The ICO groups them into three overlapping groups:

Session cookies

Files that allow a site to link the actions of a visitor during a single browser session. These might be used by an internet bank or webmail service. They are not stored long term and are considered "less privacy intrusive" than persistent cookies.

Persistent cookies

These remain on the user's device between sessions and allow one or several sites to remember details about the visitor. They may be used by marketers to target advertising or to avoid the user having to provide a password each visit.

First and third-party cookies

A cookie is classed as being first-party if it is set by the site being visited. It might be used to study how people navigate a site.

It is classed as third-party if it is issued by a different server to that of the domain being visited. It could be used to trigger a banner advert based on the visitor's viewing habits.

The ICO insisted this weekend was not a deadline, but an attempt to help companies focus on their general cookie use.

"We never said was that if you're not compliant by 27 May we will come and get you," Mr Evans told the BBC.

"What we want is good compliance, not rushed compliance. If it's focused people's minds, that's a good thing."

Changed stance

The ICO has come under criticism from businesses for not being entirely clear about what constitutes compliance.

Vinod Bange, a data privacy specialist from law firm Taylor Wessing, said many businesses were nervous about implementing solutions.

"A lack of education and clear guidelines from the ICO on what constitutes compliance has left many businesses unsure of how to meet the directive with only one working day to go," he said.

"Few businesses want to be the first to adopt a specific approach. This is a risky game, as some organisations may be made an example of in order to set the parameters of compliancy moving forward."

This concern was shared by Tim Gurney, managing director of Wolf Software, a firm which helps websites become compliant.

He said the lack of clear guidance had led to some firms adopting systems which damaged the way visitors interacted with sites.

Start Quote

What we want to do is look at where our resources can best be put”

End Quote Dave Evans ICO

"Some of the implementations are very poor. For me, they're making a mistake because users will stop using their sites.

"Those kind of solutions I can see being changed as the user starts to say 'I don't like that'."

Industry help

Mr Evans defended the ICO's approach, saying the ambiguity was to enable websites to interpret the rules to best suit their own audience and website design.

He also told the BBC that he believed that in the long term issues over cookie use should be regulated by the industry rather than government.

"What we want to do is look at where our resources can best be put," he said.

"If we were putting all our resources into investigating cookies, well, the people would quite rightly be asking where our priorities lie.

"Regulators have got resources that are not infinite. The best solutions are where industry sits down and develops it themselves. The more they can do, the easier it is for us to regulate."


More on This Story

Related Stories

The BBC is not responsible for the content of external Internet sites


This entry is now closed for comments

Jump to comments pagination
  • rate this

    Comment number 240.

    I'd rather be targeted by an online outfit that knows little more about me than the size of my screen and the pages I've seen than by an offline supermarket that even knows which teabags I buy. OK, they’re online too, but they're big enough to be the last to feel the impact of this. It's the small businesses more interested in a sale than in your data which will be the first to go under.

  • rate this

    Comment number 206.

    Another piece of pointless legislation (and I say that as owner of an internet software developer, which will do well from the sales of upgrades).

    If people don't want cookies they can use their browser to block them.

    This law is just extra expense for businesses, more hassle for website users and won't help to protect people (since much of the internet won't work with cookies off).

  • rate this

    Comment number 151.

    This will have a crippling effect on small businesses that rely on third-party embedded technology that uses cookies they have no control over. Full bespoke development can be too expensive for the small business. Visitors and trade will disappear overnight.

    Watch as Europe get left in the dark ages while the the rest of the world continues to take maximum advantage of internet efficiency.

  • rate this

    Comment number 109.

    There are far too many people bothered about privacy these days. Honestly, why should I care that a company wants to track my browsing habits? How does it detrimentally affect me? If it leads to them offering me a better service, then that's great. If it means they want to target adverts at me, I still don't have to spend any money with them. 99.9% of privacy complainants are completely misguided.

  • rate this

    Comment number 88.

    I suspect the powers that be know this regulation is vague and impossible to enforce, but it will be a useful legal tool to enable the swift closing down of any website they disagree with. I call this a major blow for freedom of speech and information.


Comments 5 of 9


More Technology stories


Features & Analysis

  • Cartoon of women chatting on the metroChat wagon

    The interesting things you hear in a women-only carriage

  • Replica of a cargo boxSpecial delivery

    The man who posted himself to the other side of the world

  • Music scoreFinal score Watch

    Goodbye to NYC's last classical sheet music shop

  • Former Secretary of State Hillary Rodham Clinton checks her Blackberry from a desk inside a C-17 military plane upon her departure from Malta, in the Mediterranean Sea, bound for Tripoli, Libya'Emailgate'

    Hillary gets a taste of scrutiny that lies ahead

BBC Future


The future of CGI... from 1982

How we forecast computer animation back then


  • A cyborg cockroachClick Watch

    The cyborg cockroach - why has a computer been attached to this insect’s nervous system?

Try our new site and tell us what you think. Learn more
Take me there

Copyright © 2015 BBC. The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.