Using cookies in the UK

Details

Published on Tuesday, 10 May 2011 10:45

Written by Bob Mitchell

Here’s my take on reading the Information Commissioners Office (ICO) document titled ‘Changes to the rules on using cookies and similar technologies for storing information’ (version 1 – pub 09/05/11)

My worries revolve mostly around the implications for our own site (scl.com) and our customers using Web Analytics solutions, most notably the Unica (now IBM) NetInsight product – but the full implications go much wider than that – including the nearly ubiquitous Google Analytics.

 

While I am the current UK Country Manager for the Web Analytics Association (WAA) and I don’t think that I’m saying anything particularly contentious this isn’t written from any official WAA stance.

 

Most of the press coverage has repeated the summary that the ICO published – but that didn’t answer all of my questions – so I read the above document in the hope of understanding things better.

(all emphasis mine)

“These changes apply to storage or gaining access to information stored, in the device of a subscriber or user. This means the use of cookies and similar technologies for storing information.”

So – this impacts http cookies, flash LSOs, HTML 5 canvas hacks and anything that persists an ID by storing it on the client. It doesn’t seem to impact the use of ‘passive’ methods based on IP address, user agent or other ‘fingerprints’ (so long as we don’t try and store anything).

The new rules state that the user … “has given their consent.”

...”consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent.”

Woo! That means that we can just take the fact that the user agent allows the cookie so signify consent. But wait:

“At present, most browser settings are not sophisticated enough to allow you to assume that the user has given their consent to allow your website to set a cookie. [ ...] for now we are advising organisations which use cookies or other means of storing information on a user’s equipment that they have to gain consent some other way.”

Oh. That sucks. Still:

“You need to provide information about cookies and obtain consent before a cookie is set for the first time. Provided you get consent at that point you do not need to do so again for the same person each time you use the same cookie (for the same purpose) in future.“

There is one key exception – not that it will help web analytics users:

The only exception to this rule is if what you are doing is ‘strictly necessary’ for a service [explicitly] requested by the user.” (eg shopping baskets)

The guidance does acknowledge web analytics and clarifies that: “An analytic cookie might not appear to be as intrusive as others that might track a user across multiple sites but you still need consent.”

Based on this I think that our own use of cookies on www.scl.com needs to be eliminated and other, passive, methods used until visitors hit a site feature where they’re fairly committed already. Furthermore I can see no effective way to make Google Analytics compliant right now.

source: http://www.ico.gov.uk/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf