UK retailers will be breathing a sigh of relief today since they have this week been granted an extra year to comply with new regulations on cookies that come into force today. But they have been reminded that they should use the time to develop best practice for their websites.
New EU requirements on the law as it affects cookies – the files that a website puts on a user’s computer to remember information such as user preferences – prompted a revision of the Privacy and Electronic Communications Regulations that come into force today.
But the Information Commissioner, Christopher Graham, said this week that online retailers and other organisations now had up to 12 months to get their house in order before enforcement will begin. This will allow retailers time to consider how best to approach the law, given the circumstances of their business. The new law requires that retailers and other organisations running UK websites gain informed consent from consumers before putting cookies on their computers. The more intrusive the cookie, the higher the standard of consent required. However this has proved a complex area for retailers to tackle.
Graham, said: “I have said all along that the new EU rules on cookies are challenging. It would obviously ruin some users’ browsing experience if they needed to negotiate endless pop ups, and I am not saying that businesses have to go down that road.
“Equally, I have to remember that this law has been brought in to give consumers more choice about what companies know about them. That’s why I’m taking a common sense approach that takes both views into account.
“Browser settings giving individuals more control over cookies will be an important contributor to a solution. But the necessary changes to the technology aren’t there yet. In the meantime, although there isn’t a formal transitional period in the Regulations, the government has said they don’t expect the ICO to enforce this new rule straight away. So we’re giving businesses and organisations up to one year to get their house in order. This does not let everyone off the hook. Those who choose to do nothing will have their lack of action taken into account when we begin formal enforcement of the rules.”
Stephen Robertson, director general of the British Retail Consortium, said: “The retail sector supports the advice produced, especially the suggested approach that allows a ‘lead in’ period for businesses. We’ll continue to maintain close engagement with the ICO to support policy development that is clear, consistent and supportive of businesses and consumers shopping online.”
The Direct Marketing Association has encouraged its members to see the change in law as an opportunity, reminding them that the grace period they have been given to comply with legislation still requires them to act in the best spirit of the law, using the time to develop best practice. But, it’s director of public affairs, Caroline Roberts, said: “The DMA welcomes the long-awaited regulations and is reassured by the government’s decision to allow businesses more time to come up with workable technical solutions before enforcement of the new law begins in the UK.”
Malcolm Duckett, chief executive of on-demand digital marketing company Magiq, said the online industry had been expecting action to be taken since abuse of cookies and behavioural targeting was “beginning to get out of control” but that the regulation that has emerged was stricter than had bene expected. “If every website followed the rules set out in this lengthy document and had to gain informed consent from all users before setting up any cookies, users would be continually bombarded with pop-ups asking for permission. The world is watching the major players such as Google and Amazon, looking to them to set an example of how to comply. However by taking this approach of waiting and following an implied lead from these companies in an attempt to sidestep the issue, companies could be putting themselves in a fatal situation.” He said that British businesses may move away from hosting their websites in the UK as a result of these rules, to other parts of Europe and further afield where “the laws are more relaxed”.
The Information Commissioner’s Office (ICO) has itself reacted to the legislation by putting a header bar on its own website to give users information about the cookies that it uses and to explain to users their choices about how to manage them.
But, Graham said: “I am not saying that other websites should necessarily do the same. Every website is different and prescriptive and universal ‘to do’ lists would only hinder rather than help businesses to find a solution that works best for them and their customers. The initial advice that we issued earlier this month will continue to be supplemented with real-life examples as they come in.”
