With time ticking away before the end of the ICO’s moratorium on enforcement of the new Cookie Law, only the bravest of brands have taken the plunge to implement consent on their websites.
By 26th May, all but “strictly necessary” cookies will need opt-in consent. Both Government and the Information Commissioner’s Office have expressed concern that many website owners are leaving it perilously late to the deadline to get their houses in order.
The real challenge for websites is the scope of the law, which covers all cookies or other tracking technologies. Even Ed Vaizey, the Minister in charge of implementation, recognises the problems this presents. In a recent speech he said: "The ICO’s guidance is very useful on this point. It sets out very clearly which cookies they consider to fall in the strictly necessary category. Of course we all wish that category could be extended to include things like analytics but that isn’t what the law says."
Subsequently, the ICO has hinted in a statement that analytics cookies will not be at the top of its enforcement list. The Office is much more likely to go for cookie use which has a real privacy impact.
Meanwhile, the DMA’s email marketing council is leading the charge to exclude open tracking in emails. Skip Fidura, a member of the council and MD of Dot Agency, comments: “This law is clearly aimed at cookies used to build complete profiles of internet users which could eventually be sold on. These regulations were not aimed at marketers trying to ensure their emails reach the inbox and improve how they communicate with their customers.” Fidura acknowledges, however, that only the ICO can sort the cookie wheat from the chaff.
Sadly nothing will prevent the dawning of cookie day and, if the research into readiness is anything to go by, there is likely to be some last minute scrabbling towards compliance.
For a really useful summary of the story of the cookie law so far, see this article from Out-Law.com.
The new cookie law will form part of the Data Protection in Practice course being run by the IDM on 17 May.