Cookies law changed at 11th hour to introduce ‘implied consent’ [guardian.co.uk]

Today sees the new “EU Cookie Law” come into effect in the UK, but hours before the Information Commissioner’s Office (ICO) did a dramatic U-turn to say that website owners could now assume that consent had been given to set cookies, the complete opposite of their previous advice.

According to an article in The Guardian:

New EU regulations on the use by British websites of cookies have been watered down by the UK’s information commissioner just hours before they were due to come into force.

But they could mean that Britain is out of step with EU law in its implementation of the continent-wide directives, and lead to fights with European courts.

In an updated version of its advice for websites on how to use cookies – small text files that are stored on the user’s computer and can identify them – the Information Commissioner’s Office (ICO) has said that websites can assume that users have consented to their use of them.

In my report about how companies should implement the law I said that companies should partially comply at this stage as the law might change as it was unworkable; I didn’t expect things to change this fast though and will update my report ealy next week. Companies should still conduct a cookie audit and publish a cookie policy and make it prominent on the website, but at least the unworkable requirement about trying to ask for consent has been done away with.

UPDATE: I’ve briefly read the ICO’s updated report and from that believe that The Grauniad is wrong. The article says “websites can assume that users have consented to their use of [cookies]”, but skimming through the report indicates that this is only the case is some circumstances. The report also reiterates that doing nothing is not an option. I need to make time to study the new document in detail, but will update my recommendations accordingly if necessary.

Read “Cookies law changed at 11th hour to introduce ‘implied consent'” at guardian.co.uk

Categorised in: Online privacy

This post was written by David