UPDATE: The ICO have updated their guidance, read here. Explicit consent is no longer required.

How do you know if your website uses cookies or similar technologies?

To know what you have to do to comply with the EU Cookie Law, you first need to know what cookies your site is using. It might be more than you think.

For example, does your website have any of these technologies or features?

  • WordPress, or any other content management system
  • Google Analytics, or any similar website analytics program
  • A blog
  • Facebook, Twitter, Google+ or other social media “like” buttons or plugins
  • Flash
  • Google AdSense and/or AdWords
  • Personalised settings e.g. a welcome message, remember my email, “don’t show me popup ‘x’”
  • A shopping basket / cart

All of these features use cookies.

Strictly Necessary

You don’t need to get consent for all cookies, however. Cookies that are “strictly necessary” for the running of your website are excluded from the directive. The definition of “strictly necessary” is black and white though:

Cookies that are considered strictly necessary:

  • Cookies to remember items in a shopping basket
  • Cookies providing essential security measures
  • Cookies used for quick loading and distribution of content

However, some common web services are NOT considered strictly necessary:

  • Google Analytics, or similar software to analyse visitors
  • Cookies that remember user preferences
  • First and third party advertising cookies
  • Facebook like buttons

What should I do?

At the time of posting this, we have still to find an elegant solution to complying with this law.

Your options:

  1. Remove all cookies. Not recommended.
  2. Add a banner to your site allowing users to opt in to using cookies. This is full compliance. This is what the ICO did on their site and this saw a 90% drop in recorded visitors to their site. This shows people are uninformed about what cookies are and therefore would too scared to set them or indifferent about agreeing to allow them.
  3. Add a banner to your site allowing users to opt out to using cookies with a link to your Privacy Policy. This strictly does not make your site comply but does show you are taking steps to comply whilst you review your options.
  4. Add a banner to your site that informs users that your site uses cookies with a link to your Privacy Policy and a link to how to manually change your cookie settings in your browser. This is what the BBC have done. This strictly does not make your site comply but does show you are taking steps to comply whilst you review your options.
  5. Update your Privacy Policy. This strictly does not make your site comply but does show you are taking steps to comply whilst you review your options.

Don’t bury your head in the sand. In the first instance we would suggest you first review what cookies your site actually uses and also review your current privacy policy to ensure that it includes specific information about cookies and rename the ‘Privacy Policy’ page to ‘Cookies and Privacy Policy’ page. Then provide a way for your users to find out how you use cookies and link to it from the landing page(s), e.g. in header or footer. Here is ours.

We would also suggest you look at what others have done. Many sites are taking a ‘lite’ approach whilst they see what their competitors are doing, but you need to balance the ‘liteness’ of your approach with the risk of non-compliance.

Remember to use common sense. The law is vague and the guidance contradictory but all based on a desire to put people in control of their data to protect their privacy. So, try to operate in the spirit of the law. If you use intrusive cookies, accept you need to be more explicit about gaining consent. If you don’t, then focus on providing information to reassure users and the ICO that you haven’t just stuck your head in the sand!

CuCo will help their customers to apply a compliant solution to their websites once it is available. Each customer will have a responsibility to decide whether to switch their website to operate in this manner and to fund any design changes that might be necessary. Whilst unwelcome and inconvenient, it is a burden imposed directly by the UK Government.

What other high profile sites have done

As of posting this, the following do not comply:

  • http://www.parliament.uk/
  • http://www.royal.gov.uk/
  • http://www.justice.gov.uk/
  • http://www.homeoffice.gov.uk/
  • http://www.direct.gov.uk
  • http://www.libdems.org.uk
  • http://www.number10.gov.uk/

As of posting this, the following have taken steps to comply, but still don’t:

  • http://www.bbc.co.uk
  • http://www.itv.com/
  • http://www.channel5.com/

As of posting this, the following do comply:

  • http://www.conservatives.com/
  • http://www.labour.org.uk/home
  • http://www.ico.gov.uk/
  • http://www.channel4.com/

 

Disclaimer: CuCo does not provide legal advice. This article has not been reviewed for legal accuracy or correctness.