UK websites launch cookie compliance measures and rely on implied consent

As reported in our last edition of IP/IT Update, while the new rules were supposed to have been in effect since May 2011, the ICO set a transition period to 26 May 2012. As a result, cookie consent requirements are already in force in a number of territories and in the last few weeks, pop-ups and banners have begun appearing on the websites of many businesses, especially those with a large presence in the UK.

The nature and content of the new windows and banners vary widely across different websites, with many disclosures appearing as icons or top-of-the-page banners that persist for a few seconds before disappearing.

While the banners and icons generally contain some information about the use of cookies by the site and prompt users to read a longer “cookies policy” for further information, the way in which consent to cookies is captured is controversial given that the EU cookie rule was heralded as requiring express consent to cookies. Many sites rely on an implied consent to cookie use whereby a visitor continuing to use a website after seeing a pop-up or banner about cookies, is deemed to have consented to cookie use. The ICO has published revised guidance that generally supports this implied consent approach, particularly for use of cookies with a limited privacy impact, such as some analytical cookies. However, it is expected that use of more intrusive cookies, for example those targeting or tracking users, will require a higher standard of disclosure and deemed consent will not be considered sufficient in that instance.

Elsewhere in the European Union, the implementation of the law seems to indicate a preference for “consent”, and “deemed consent” is not considered sufficient.

In a separate recent development on the new ‘cookies rule’, the Article 29 Working Party (the “Working Party”) has issued its opinion on the exemptions to the prior opt-in consent requirement for cookies, which for those businesses still working on compliance with the legislation, provides useful guidance and clarification.

As a brief reminder, these exemptions apply if:

1. the cookie is for the sole purpose of carrying out the transmission of a communication over and electronic communications network; or
2. the cookie is strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

The Working Party indicates that this second exemption should focus on the individual functionality requested by the user rather than the overall service.  Therefore, a test of whether a particular function would not be available without the relevant cookie, and whether the user has explicitly requested that function, should be applied.

While it was generally accepted that cookies for ‘shopping basket’ functionality would fall within the second exemption, the Working Party has indicated that the following would also fall within the exemption:

• multimedia player cookies (or “flash cookies”) where the user visits a website containing text and video contents as these are part of the service explicitly requested by the user;
• cookies necessary for customisation such as a language preference for a particular website; and
• social network content sharing cookies for users who are “logged in” to the relevant social network.
   

There are, however, some conditions attached to this exemption.  The Working Party expects this exemption to apply only to single purpose, session cookies.  It believes the reasonable expectations of the user are that such choices or preferences would not extend beyond a single session.  Persistent cookies for these functions are therefore still likely to require consent, as will any cookies which have purposes beyond simply providing the relevant functionality.

Otherwise, the opinion clarifies that all analytics cookies will require consent – although it is hopeful that this will change in the future.