On 26 May 2011 the new rules governing the use of cookies came into force in the UK.

Cookies are text files that are downloaded on computers the first time a user visits a website. On the following occasions the user visits the website it recognises the user and in some cases remembers their browsing preferences. There are different types of cookies that vary in terms of the level of intrusiveness to a user's privacy and the new rules seek to further safeguard users from these types of cookies in particular.

Until now, under the Privacy and Electronic Communications Regulations 2003, organisations were allowed to use cookies as long as they warned users they were using them and provided a mechanism to ‘opt-out’. The major change under the new rules is that a user's consent must now be explicit i.e. users must ‘opt-in’; simply including a term in the website's privacy policy will no longer be sufficient.

One exception to the requirement to obtain consent is where the use of a cookie is "strictly necessary" for the user's experience e.g. a cookie to record purchases in a user's online shopping basket. According to the Information Commissioners Office's guidance, satisfying the test to be deemed a "strictly necessary" cookie is very difficult and therefore should only be relied upon in limited cases.

Thankfully, the Government have realised that these new rules reflect a big change to the status quo and so the ICO have stated that there will be a grace period of 12 months for all websites to comply with the new rules.

For now, the ICO recommends that business should consider:

• What type of cookies does your website use?
• How intrusive are the cookies?
• What are the best ways of obtaining user's consent whilst minimising the impact on the user experience?

If you require any further advice or assistance please contact Lucy Folley or a member of the Commercial team at Wortley Byers on 01277 268311 or lfolley@wortleybyers.co.uk.

<< Return to News page