UK Cookie Law = are you ready?

This week the UK cookie law becomes enforceable. From 26th May persistent offenders could get fined a lot of dosh for not obtaining consent for stuffing cookies into website visitors browsers? 

To find our more why not visit cookie-cat.co.uk, a site that I have developed to help website owners to comply with the law.

PS. I am not a lawyer.

 

http://www.theregister.co.uk/2012/05/18/cookie_law_ico/

There's been a lot of scaremongering over this recently, I won't be putting a cookie warning on my site. Simple as - sue me. ;)

Even all the Governmental websites will miss the deadline http://www.theregister.co.uk/2012/05/18/most_gov_websites_will_miss_cookies_law_deadline/

A valid point.
However, the question is: Who is enforcing it? How is it enforced? Fined by whom? How much?

All serious questions. Anybody ANY idea for answers?

A good article here: http://www.theregister.co.uk/2012/05/18/cookie_law_ico/
(My personal summary of the article: Don't panic)

EDIT: Gareth beats me to it :-)

I have been in the online industry for around 16 years.
A good few years ago the government made it a legal requirement for companies to include registration/ vat/ head office details on their website.
I have never heard of anyone being fined for not displaying this information.

In about 18 months, 1 or 2 companies will be made scapegoats over the cookie law ... and then that'll be it.
Don't belive me? - revisit this thread in 18 months and tell me I'm wrong.

And what makes me laugh is that your cookie-cat site is breaking the law that you're telling us we all need to adhere to.

I am not a fan of the law, I think it's a load of tosh BUT I don't want to be one of the examples, and neither will my clients, hence I am protecting them all.

There is still not a definite written document on what the law entails but it does say you need to prompt your visitors to accept your cookies, which means you need a pop up window or similar to do this.

Some sites are just adding a cooke compliance page but reading through the documents, this doesn't seem to be enough BUT at least you can say you have done something to adhere to the law.

All of my clients are being contacted about their compliance and will be given the option of a cookie compliance page, and / or the cookie banner which I use on my sig link.

Ultimately it's down to you to want to be compliant, yes it can look ugly on the site but there are numerous methods where you can do this including pop ups, integrated into your design etc.

This is yet another law that won't be followed by many but is it worth the risk?

Frankly, my dear, this guy scares me more:

This law is targeting companies that use cookies to inflate prices fro returning visitors etc.  No normal web site will be at risk of prosecution.  If they are then the British courts will need expanding by a factor of 100!

 

EDIT: Our take on the cookie law as it relates to Kontrolit site owners...

http://www.kontrolit.net/news/uk-cookies-tracking-for-kontrolit-customers.htm

Lee is right. The cookie monster are seriously frightening. 

 

 

As for nothing written exists, I am afraid you have missed this little document from the ICO.  Light reading and just  27 pages long. 

Also, sorry Gareth G.  I disagree with you on this one....

• If there IS a law (and yes there is), it is written and published. Hence it is definite. It is also a British law, not some "EU law"
• You don't need a pop up window to comply. (the code snippets which are circling around primarily serve mainly one purpose, to drive traffic to its makers)
• To contact all your clients is joining the scaremongers. I'd rather be a cheesemonger tbh (Hello Neil Pie :-)) )
• Suggesting to clients to spend £19 or more to become compliant, is in my book spreading FUD (Fear uncertainty doubt). Just my opinion.
• You may want to amend the statement on your cookie compliance page that Goggle Analytics cookies are affected by this. They are not.

 

The only people benefitting from the cookie law are scaremongerers looking to make a quick buck.

As Gareth Mailer's links point out, even the ICO are saying they're probably not going to start fining anyone.

Additionally, having cookie warnings and pop downs only damages the user experience and undermines trust because the average visitor might panic and think you're saying you're going to steal their bank details or something.

The spirit of the law is to protect people's data and Internet experience, which is great, but the law is stupid and appears to completely forget the biggest privacy invaders, namely social media and search engines.

Don't spent money on this yet, the ICO does not care about small and medium businesses who simply use Google Analytics or cookies for shopping and accessibility, they care about rip off merchants using shady tactics and dangerous cookies invading people's privacy.

Just look at the numbers. There are many millions of UK based sites, are the ICO actually going to go around checking? No.

Michael -

Are you implying that Google Analytics cookies fall into one of the Exception categories that allows use of cookies without prior consent ? 

I've read the ICO Guidance PDF (the one that you linked to) and can't see how Google Analytics could be shoe-horned into the 'strictly necessary' category (pages 8,9,10,27).  If Gareth's changed his web page then I might be misinterpreting what you said.

Overall, my opinion is that it's a very poor implementation of what should have been a finely targetted law. However those of us doing website work should be up to speed on it and have something to offer a client if they want to comply.

I don't think Gareth's scaremongering by advising his clients of what the law now says. Sounds more like acting responsibly to me.

Thanks Steve, it's advice I am giving (have done at 4N today) and will continue to do so, it's in my best interests to give people the information and they decide what to do with it IMHO.

Michael

1) It is an EU law, whcih is being pushed out across all EU nations. The ICO are handling the law in the UK on behalf of the EU.

2) Where did I say there had to be a pop up? I found it's the less obtrusive as it hides itself (and really quick to add to a site). There are numerous ways to add the compliance code without pops up, it depends on how you want to implement it.

3) I am not scaremonging, I am giving my clients the necessary information as it's relevant to their business. If they act on the advice I give then I would be happy BUT if they ignore it then it's their own perogrative.

4) I am not suggesting someone spends £19 to be compliant as in my website I link to a website which has the tutorial to do it, and I do say talk to a professional. One person at 4N today asked me about the cookie compliance and I gave them the advice and told them to go back to their developers as it's easier for them to deal with it.

5) Read the documents and as my website says, any cookie that isn't a necessary function of the website is covered by the law, and this includes GA as last time I checked, you can use a website without tracking software.

There is a lot of BS going around about this law, and I am not sure what is going to happen on Friday but I know I am compliant and will be, I just cannot take the risk as there are too many variables which could hurt my business by not being compliant.

Andy, the ICO will be checking websites but they will also rely on reports from the members of the public, so you could potentially be reported by a competitor of yours, all for having a small button or banner on the website.

As long as you have an explanation of the cookies (my banner links to a page on cookies, so the non-web user will have a point of reference)  then I can't see it hurting user experience BUT you may hurt your own reputation as someone may expect to see it on your website.

My last word on this is:

If you want to know more about the cookie law, read the ICO's website and get professional advice (from someone with a web background) and make the decision based on your own research and understandings.

I don't see the problem. We implement a simple Cookie infomation system yesterday on our website and it took me all of about 15 to 20 minutes to install. 

Job Done.

Compliant and I didn't stress over it. It isn't a big thing. I would rather put in teh 20 minutes than get a fine. 

That made me laugh.

"This website is not jumping out at me, explicitly explaining it's not stealing my details - therefore I shall not use it any longer" - No one ever, anywhere, in the entire history of the internet.

 

OMG! I's the Y2K bug all over again! Don't PANIC!

Seriously.

If anyone is still interested ... the ICO has just put out version 3 of cookie guidance.

This makes it clear that implicit consent can be acceptable for cookie placement:

http://www.ico.gov.uk/news/blog/2012/~/media/documents/library/Privacy_and_electronic/Practical_application/cookies_guidance_v3.ashx

See page 6.

So many issues have been raised above. One in particular, Steve, I absolutely agree that Google Analytics cookies are covered by the law.  The ICO wouldn't have said they are "not currently a priority" if they aren't strictly covered.  Don't forget, of course, that ICO guidelines are just guidelines; they are not law.  The Regulations are the law.

Legislation around Data Protection has largely been enforced in the context of large public sector organisations - I find it hard to imagine monetary penalties being imposed on small private sector organisations.  I see compliance in this area as being a risk management issue:

1. know what the law says
2. consider the costs and benefits (including the risk of regulatory sanctions) of compliance
3. decide at what level to comply (I don't believe any organisation is 100% compliant with the Data Protection Act)

In spite of some of the comments above I believe that the major issues actually relate to confidence and perception of website visitors.  As a very sad person, I have an ongoing search on Tweetdeck for "Data Protection" tweets on my desktop.  When I started this about a year ago, there was maybe one tweet every 15 minutes, now they literally arrive every few seconds.  The public interest in data protection/privacy/ identity theft is growing enormously and I believe it has now reached the point where a it is worth making a small amount of effort to demonstrate to visitors that you take this seriously.

As for action from the ICO, I think anyone who says small business will get large penalties is in cloud-cookie land!  Realistically, I think the only chance of any small business having their website checked by the ICO is if someone complains, and it will probably need several complaints.