The Information Commissioner's Office ("ICO") has issued guidance on the imminent changes to the law governing the use of cookies by businesses. For more information on the specific changes please see our article last week.
The ICO are keen to point out that their guidance is just that, guidance, and that they accordingly will not tell businesses how to comply with the changes. However, they have indicated that they will issue more comprehensive advice in the future, in particular regarding the issue of obtaining consent for certain types of cookies.
The ICO guidance sets out a three step approach to tackling the issue of prior consent:
1. Check what type of cookies you use and how you use them
Cookies which are "strictly necessary" might not need consent.
2. Assess how intrusive your use of these cookies is
The ICO's basic rule is "the more intrusive your use of cookies is, the more priority you will need to give to considering changing how you use it…..the more privacy intrusive your activity, the more priority you will need to give to getting meaningful consent."
3. Decide what solution to obtain consent will be best in your circumstances
With regard to browser settings-led consent, the ICO's view is that businesses that use cookies cannot rely on this currently to indicate consent. They do point out, however, that this position is likely to change in the future as browser technology develops.
Whilst there is no doubt that this guidance is useful, it only goes some way in helping businesses deal practically with the effects of the changes. Hopefully more detailed guidance from the ICO will be forthcoming in the next few months.
© Thorntons Law LLP
19 May 2011
Lucy Bennett