UK websites launch cookie compliance measures and rely on implied consent

By Bob Stankey New pop-up windows about online cookies are now greeting visitors to popular UK-based websites.  The changes are part of the steps being taken to comply with the new European rules that require consent to the setting of cookies. While the new rules were supposed to have been in effect since May 2011, the UK’s data protection authority – the Information Commissioner’s Office (ICO) – announced a one-year lead-in period in order to give websites time to prepare for the new requirements.  That informal transition period ran out on May 26.  As a result, in the last few weeks, pop-ups and banners have begun appearing on the websites of UK newspapers, broadcasters, telephone companies and any other company with a major online presence used by residents of Britain. The nature and content of the new windows and banners vary widely across different websites.  Many disclosures are appearing as hover icons or top-of-the-page banners that persist for some number of seconds and then go away.  These icons or banners may appear just once, or re-appear for 4 or 5 visits to the site unless a user clicks to get the icon to disappear. While all contain some disclosure about the use of cookies by the site and generally encourage users to check a longer “cookies policy” for more information, the way in which consent to cookies is captured is controversial given the broad working of the EU cookie rule.  Many sites are relying on an implied consent to cookie use – if a visitor continues to use a website after seeing a pop-up about cookies, they are deemed to have consented to cookie use.  At the end of last week, the ICO published revised guidance(1) that generally supported this approach, particularly for use of cookies with a limited privacy impact.  Use of cookies for targeting (or use of any other technology for tracking users of computers or mobile devices) will likely be held to a higher standard of disclosure and consent. The UK’s approach appears to be at odds with emerging requirements elsewhere in the European Union, where consent is deemed to require a greater affirmative sign of acceptance by site users.  The controversy will continue as EU policy-makers work on a broad re-write of Europe’s data protection legislation and negotiate with industry over online behavioral advertising practices in Europe. (1) http://www.ico.gov.uk/news/blog/2012/updated-ico-advice-guidance-e-privacy-directive-eu-cookie-law.aspx