If your website is based in the EU, or if users access your website from inside the EU, you have until 26 May 2012 to put a solution in place that will inform users of any cookies your website is downloading on their devices. You should also allow users the opportunity to consent to the use of these cookies to continue browsing your website.
I have added a list of free tools you can use and a jargon-busting list of terminology at the end of this post.
What are the new regulations on the use of cookies?
Cookies have been commonplace on most websites for some time. However, the new regulations on the use of cookies stipulate that users should be told about cookies and how they are being used. Users should then be given the choice if they want cookies to be used in this way and how they can manage cookies. The new rules are designed to protect the privacy of users, even where the information collected cannot personally identify the users.
Websites should give information about how cookies work so that users are more confident about using websites and more comfortable with how websites collect and use information about their online behaviour.
Consent from the user or subscriber
Either the user or subscriber should give consent for cookies to be downloaded on their device. The subscriber means the person who pays the bill for the use of the line. The user is the person using the computer or other device to access a website.
If you set cookies on your website, you should:
- tell users that the cookies are there,
- explain what the cookies are doing, and
- obtain their consent to store a cookie on their device.
Are there any exceptions?
The guidance on this is not very clear, but possible exceptions include:
- Cookies used to remember the goods a user wishes to buy when they proceed to the checkout or add goods to their shopping basket.
- Certain cookies providing security that is essential to comply with the seventh data protection principle for an activity that the user has requested – for example in connection with online banking services.
- Some cookies help that the content of your page loads quickly and effectively by distributing the workload across numerous computers.
Also see the ICO’s full Guidance on the New Cookies Regulations.
What should I do as a website owner?
- Check what type of cookies and similar technologies you use and how you use them.
- Determine if you want or have to use them and if not, remove them.
- If they are necessary, assess how intrusive your use of cookies is.
- Where you need consent, decide what solution to obtain consent will be best in your circumstances.
- Implement your solution. (You may also want to update your privacy policy and/or terms and conditions.)
One of the purposes of these regulations is to increase consumer awareness and understanding so they can decide whether they object to cookies or not. Websites should use these regulations to inform consumers why the cookies being used are beneficial.
The Information Commissioner states: “In practice we would expect you to provide clear information to users about analytical cookies and take what steps you can to seek their agreement. This is likely to involve making the argument to show users why these cookies are useful. Although the Information Commissioner cannot completely exclude the possibility of formal action in any area, it is highly unlikely that priority for any formal action would be given to focusing on uses of cookies where there is a low level of intrusiveness and risk of harm to individuals. Provided clear information is given about their activities, we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action.”
Are there any tools available to help website owners?
It is important to note that not all third party tools are completely accurate and that you should check every page of your website.
Here are some of the third party tools available:
- Attacat’s free cookie audit tool for website owners claims to “show you what cookies your site is using and help you decide how evil your cookies are”.
- Optanon Audit by the Cookie Collective will help you get started with a free cookie audit. They also provide a full consultancy service.
- Cookie Control is a mechanism for obtaining a user’s explicit consent for the use of cookies on their computer. They also provide a WordPress version.
- The EU Cookie Directive WordPress Plugin displays a notification to the user about the usage of cookies on the site.
Terminology
Cookies
Cookies are small files downloaded onto computers or mobile devices when users access some websites.
Cookies help websites to function better. For example, cookies are important during the process of adding items to a shopping basket when customers buy products online or to remember customer preferences. Cookies are also used to track visits to a website through analytics software such as Google Analytics. This enables website owners to find out which content is interesting, important and informative to users. They also allow website owners to plan content strategies and to fix errors on their websites.
For more information see: All about cookies
Session and persistent cookies
Cookies can expire at the end of a browser session (from when a user opens the browser window to when they exit the browser) or they can be stored for longer. The regulations apply to both types of cookies:
- Session cookies allow websites to link the actions of a user during a browser session. They may be used for a variety of purposes such as remembering what a user has put in their shopping basket as they browse around a site. They could also be used for security when a user is accessing internet banking or to facilitate use of webmail. These session cookies expire after a browser session so would not be stored longer term. For this reason session cookies may sometimes be considered less privacy intrusive than persistent cookies.
- Persistent cookies are stored on a user’s device in between browser sessions which allows the preferences or actions of the user across a site (or in some cases across different websites) to be remembered. Persistent cookies may be used for a variety of purposes including remembering users’ preferences and choices when using a site or to target advertising.
First and third party cookies
Whether a cookie is ‘first’ or ‘third’ party refers to the website or domain placing the cookie. First party cookies in basic terms are cookies set by a website visited by the user – the website displayed in the URL window. Third party cookies are cookies that are set by a domain other than the one being visited by the user. If a user visits a website and a separate company sets a cookie through that website this would be a third party cookie.
Subscriber
This means a person who is a party to a contract with a provider of public electronic communications services for the supply of such services – in this context, the person who pays the bill for the internet connection (that is, the person legally responsible for the charges).
User
This means any individual using a public electronic communications service. In this context a user would be the person sat at a computer or using a mobile device to browse the internet.
