Cookies and the UK’s response: what’s new?

Claire Walker

As promised in my  post earlier today, here is a  summary of the UK Government’s latest announcement on transposition of the new cookie rules.  Much of it confirms what we already knew, although there are a few new crumbs of information for those tracking the issue closely. In short: users of behavioural advertising are being encouraged to abide by the “sprit of the revised Directive” until browser-based technical solutions are developed by industry, and guidance from the ICO is promised in time for the transposition deadline of 25 May; enforcement actions are not expected  in the short term.  See below for a more detailed analysis.

What’s new? (and what isn’t?)

The latest twist in the long running cookie saga is the publication today (15 April) by the DCMS of its 87 page response document “Implementing the revised EU Electronic Communications Framework”.  In relation to cookies (see pages 71 to 76) some of it confirms what we already knew, although there are (if you will indulge this Dataonomist  a terrible pun) some crumbs of new information.

The document covers a range of issues relating to the EU telecoms regulatory package, but it is the rules relating to website cookies which have attracted widespread attention because these affect all online businesses which use the technology to track users’ behaviour.    As Datonomy readers will be familiar by now, the controversial changes increase the obligation on website operators from merely providing “clear and comprehensive information” and an opportunity to refuse cookies, as required by current legislation, to a requirement for users’ opt- in consent. 

The Government announced in March that:

  • it would not be in a position to fully transpose the rules in time for the EU deadline of 25 May; 
  • it is working with browser manufacturers on a technical solution which would use enhanced browser settings to obtain the requisite consent; and that 
  • this preferred option was informed by research carried out by PricewaterhouseCoopers LLP, which has been  available for some time on the DCMS here.  The research makes interesting reading as it compares the impact of three potential solutions: opt in consent; “enhanced information” and enhanced browser settings.

The document published by the DCMS on 15 April does not provide us with the regulations, the guidance nor a firm timetable, but it does tell us a little more about the UK’s implementation.  It:

  • summarises industry and stakeholder feedback to the 2010 consultation on the practical pros and cons of different approaches to obtaining consent;
  • confirms that the UK regulations once published will simply “copy out” the requirements of the Directive, but will also refer to the text in Recital 66 relating to browsers;
  • confirms the Government’s preferred approach is to work with browser manufacturers on a solution which will use enhanced browser settings to obtain the requisite consent: “users will be provided with more information as to the use of cookies and will be presented with easily understandable  choices with regard to the import of cookies onto their machine”;
  • confirms that the Government supports cross-industry initiatives on third party cookies in behavioural advertising, which it views as a “major component of the Government’s plans for meeting the requirement of the revised provisions”;
  • emphasises that there is no “one size fits all” solution and will therefore set up a second working group, to “explore other options” with industry to complement forthcoming guidance from the ICO;
  • suggests that some businesses “may want to develop their own bespoke approaches for business reasons”;
  • confirms that the implementation of the technical solutions will be phased in according to a transition schedule and confirms that it does “not expect” the ICO to take enforcement action during this limbo period; and
  • states that the ICO will provide compliance advice for businesses before the 25 May deadline. 

The Government’s document acknowledges the uncertainty created by the delay in developing “meaningful solutions” but concludes by urging businesses to “abide by the spirit of the revised Directive and develop best practice ahead of full implementation” .  Beyond “looking at their own use of cookies”, however the document does not shed any light on the practical steps this might entail.  Surely, wonders Datonomy, the Government is not suggesting that (aside from the two working parties mentioned in the document)  UK businesses  just work out for themselves what the rules mean in practice??

Datonomy is aware that other EU Member States are grappling with the same issue, and would love to hear from Datonomists around Europe on the state of play in their jurisdictions.

One thought on “Cookies and the UK’s response: what’s new?”

Leave a Reply

Your email address will not be published. Required fields are marked *