If, like most people, you haven’t heard of what’s being termed the ‘EU Cookie Law’, last year a new UK law was introduced to implement the EU Privacy and Communications Directive. This law says websites have to explicitly get permission from visitors before storing cookies on their computers. The Information Commissioners Office (ICO) is in charge of enforcing the new law, and will start to enforce it from May 26, 2012.

If you need further information on cookies or background on the new regulations, these links will describe the basic issues:

What is a cookie?

The EU Cookie law

The new regulations mean that, from a technical point of view, most UK websites are already breaking the law. In our opinion, the EU have used a sledgehammer to crack a nut. Instead of solving the problem at the browser level or limiting the regulations to the most intrusive types of tracking cookie, instead they have put an unacceptable burden on business owners to have their websites checked and amended.

To further complicate matters some cookies are allowed under the regulations, but the ICO advice doesn’t explicitly describe which. Cookies are allowed if they are “essential to provide the service requested by the user”.

Wizzy Design has held off from issuing any advice or warnings in the hope that this daft regulation would be better defined, repealed or further postponed, but it’s pretty clear now that it’s here to stay. The only crumb of hope is the ICO’s statement that when it comes to enforcement, “The primary focus of the cookie law are behavioural targeting and re-marketing cookies.  1st party web analytics are the tertiary focus.”

The majority of websites we’ve built or host will use the following types of cookie:

• ASP/ASPX session cookies:
  The Microsoft technology we use automatically creates a session cookie when you visit a website. The cookie is destroyed when you leave the site and contains no personally identifiable information. As this technology is fundamental to how some of our websites work, there’s nothing we can do about this behaviour.
• Login preferences cookies:
  If you log into a website and tick a “remember me” option it will create a cookie to enable this to happen. Our Apex CMS sites create a cookie with a lifespan of one year. We would argue that this falls under the heading of ‘essential’.
• Analytics cookies:
  Analytics cookies, such as those used to make Google Analytics work, would appear to fall foul of the new regulations. However, the UK Government Digital Service said that analytics cookies are “essential to the effective operation of government websites” and “at present the setting of cookies is the most effective way of doing this”. The ICO guidance states that “provided clear information is given about their activities we are unlikely to prioritise first-party cookies used only for analytical purposes in any consideration of regulatory action.” So your options are, remove analytics, get user consent for analytics cookies or carry on using analytics because ‘if the UK government thinks it can get away with it, so can I’.
• Ecommerce cookies:
  All our e-commerce websites use cookies to remember what’s in your shopping basket. This is an essential function and exempt from the regulations.
• Tracking cookies:
  We can’t think of any sites we’ve built that use these sort of cookies, for instance those used to follow your product browsing habits and then suggest similar products to you. However they could have been added to a CMS site using the page editing functions by a site owner, so

To try and help you decide what to do next we’ve answered some basic questions:

Does my site use cookies?

You can find this out easily by using an online audit tool such as attacat’s: http://www.attacat.co.uk/resources/cookies. Alternatively you can contact us to arrange for us to do an audit on your behalf.

Can I just get rid of the cookies on my site?

If the site was originally developed in a technology that automatically creates cookies or in a way that depends on cookies, then you can’t simply remove them (at least not without breaking something).

If you have optional cookies like Google Analytics, then you could remove that functionality (but of course you’ll lose your analytics data too).

Can you tell me what to do next?

We can’t tell you if you should have your website altered to comply with the Cookie regulations. If your site uses cookies that aren’t essential, you can choose to ignore the issue until the ICO sends you a warning letter, or act now and have modifications made to make it as compliant as possible.

What you should do is have an online privacy policy on your website. This policy should state as a minimum:

• What information you collect.
• What the information is used for.
• How the information is protected.
• What cookies are used and what are the used for.

Business Link has a sample privacy policy here: http://www.businesslink.gov.uk/bdotg/action/detail?itemId=1076142085&type=RESOURCES

If my site uses no non-essential cookies and I have a privacy policy in place, what more do I need to do?

As far as we know, nothing more needs to be done.

If I move my website hosting out of the EU am I exempt?

Not unless you move your company outside of the EU too.

If I choose to have my site made compliant, how will this be done?

You would need to have a notification and consent box added to all pages of your site, like the one on the ICO website http://www.ico.gov.uk/ .

If I choose to have the site made compliant, how much will it cost?

That would depend entirely on the type and scope of the cookie use and how we make it compliant. Contact us to discuss it further.

Isn’t this all just a huge waste of everybody’s time and money that’s only going to be ignored by most companies?

Probably.