The EU Cookie Directive’s deadline is tomorrow – 26th May 2012 – is your website compliant?
The EU Cookie Directive’s aim is to increase online security and data privacy, and to give users more control over what data can be held about them. It also addresses concerns with how personal information is held and used. Specifically the law requires:
a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.
(2) The requirements are that the subscriber or user of that terminal
(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) has given his or her consent.
Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR)
….this means that the legislation requires all websites of Member States of the European Union – old and new to
- be open and honest about the use of cookies within their site
- detail the information that each cookie holds
- detail how long the cookie will be held for
- request permission to use cookies from the website user PRIOR to them using the website – opt-in (instead of opt-out) – note: if your company has multiple websites then you may request permission for cookie use in one place if you ensure you explain where the cookie use applies to
- any subsequent change of cookie use must re-request the user’s permission for their use based on the new usage
- ensure any consent previously obtained can easily be withdrawn at any subsequent visit (and provide clear and concise details on how users do this, and any impact of withdrawing consent)
……this – the Directive states – should be in place by 26th May 2012 to comply with the law.
This is a change from the current practice which required websites to describe in their Privacy Policy how the website uses cookies and provide an option to opt out of accepting the cookie
Penalties for non-compliance with this directive can be up to £500,000 – obviously based on the severity of the non-compliance and subsequent effects to the user.
What sort of sites will use cookies (“session-based” or “persistent”)….? How will I know if my website uses them …?
A Simple check is – do you have
- an online shop then this almost certainly utilises cookies when it “remembers” your preferences and offers additional viewing choices – “persistent” (although cookies are allowed for the purpose of enabling the function of the website – eg. enabling your current shopping basket – “session-based”)
- a website that offers the ability to “remember preferences for enhanced user experiences” – for example your language preference – “persistent” or presenting a personalised greeting
- analytical counters that count the number of unique visits to a website
….then it’s almost certain that your site uses cookies! Also check your current Privacy Policy to find out whether or not (assuming this was reported correctly).
So what do you need to do …..?
The ICO (Information Commissioners Office) recommends performing a “cookie audit” on all your websites which should:
- identify which cookies are operating and where in your website
- confirm the purpose of each cookie and the exact data the cookie holds, and whether cookies are linked to information about uses such as usernames
- confirm the type of cookie – session or persistent and also it’s lifespan if persistent
- confirm whether it is a first (your website) cookie or a third parties (a link to another website or advert, for example) and who is setting it if third party
- double-check your privacy policy to ensure that it provides clear and accurate information of each cookie within your website (and also satisfy yourself that the link provider is complying with these regulations also)
You will need to ensure that your website complies will all requirements of the law! The ICO document (link here) details various ways in which you should change your site to either gain consent (where cookies are used) and/or to provide more clearer information on your cookie policy:
In addition, the Cookie Directive also requires that you give your Privacy Policy more prominence and suggests several easy ways of doing this (we have undertaken this automatically on behalf of all our customers for all our websites).
If you’re not sure about any of this then ZOOBLE TECHNOLOGIES CAN HELP!
Simply give us a call and we can check out your website and give you a free, no-obligation quote that will ensure that you comply with the requirements of the Directive, and provide you with peace of mind.
Here at Zooble Technologies we take our customers’ (and their customers’ ) privacy seriously. Being an all-round IT company that provides secure IT systems for a broad range of customer-base, we design all our websites with “Privacy by Design” rules in mind, and design data protection compliance into all our systems from the ground-up – are your web developers as conscientious?
Notes:
- It is a requirement for websites outside of the EU to comply with this directive also if they are targetting any EU Member states
- The UK Government has said that Analytics is as an essential tool and as such should be exempt from the Directive – but watch this space as to what the EU agree to!
For further information on what you need to do read ICO Guidance On The New Cookie Regulations or contact Zooble Technologies and let us help you make sure your website is compliant!
