New Cookie Law

Cookies have been around for longer than the internet has been but their future is now somewhat uncertain given the European Directive 2009/136/EC's amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("2003 Regulations").Under the 2003 Regulations, websites could use cookies if the website had a privacy policy giving clear and comprehensive information about the cookies and explaining opt-out methods.The amendments mean that websites will still need to give clear and comprehensive information about the cookies and explain opt-out methods but they will need to do so before the cookies are created or read. Practically speaking this means prior consent will be needed.

Currently the debate focuses on whether websites will have to ask new users for express consent or whether web browser settings that permit cookies can be taken to mean that consent has been given implicitly. Most web browsers can be configured to alert the user when a cookie is sent, or even to refuse cookies altogether.However, whilst"browser settings' consent" is likely to suffice for most first party cookies, behavioural advertising and 3rd party cookies are a different matter. The methods of gaining consent for these are still being discussed.

Not all cookies will need consent; if the use of the cookie is strictly necessary for a service provided by the website owner at the request of the user, no consent is required. This would include (for example) online merchants, commercial video on demand and subscription services. It would not cover non-commercial activities.

Businesses in the UK will not have to comply with the new cookie law until the Government issues regulations putting them into effect; the deadline for the Government to do this by is 25^th May 2011. Whilst the deadline appears to be looming ever closer, website owners should not fret as given the practical problems of implementationit is likely that the Information Commissioner's Office ("ICO") will not actively enforce the law for some months.The ICO will be issuing guidance on how they will approach enforcement in the forthcoming months.