Privacy and Security Law Blog

UK websites launch cookie compliance measures and rely on implied consent

By Bob Stankey

New pop-up windows about online cookies are now greeting visitors to popular UK-based websites.  The changes are part of the steps being taken to comply with the new European rules that require consent to the setting of cookies.

While the new rules were supposed to have been in effect since May 2011, the UK’s data protection authority – the Information Commissioner’s Office (ICO) – announced a one-year lead-in period in order to give websites time to prepare for the new requirements.  That informal transition period ran out on May 26.  As a result, in the last few weeks, pop-ups and banners have begun appearing on the websites of UK newspapers, broadcasters, telephone companies and any other company with a major online presence used by residents of Britain.

The nature and content of the new windows and banners vary widely across different websites.  Many disclosures are appearing as hover icons or top-of-the-page banners that persist for some number of seconds and then go away.  These icons or banners may appear just once, or re-appear for 4 or 5 visits to the site unless a user clicks to get the icon to disappear. 

While all contain some disclosure about the use of cookies by the site and generally encourage users to check a longer “cookies policy” for more information, the way in which consent to cookies is captured is controversial given the broad working of the EU cookie rule.  Many sites are relying on an implied consent to cookie use – if a visitor continues to use a website after seeing a pop-up about cookies, they are deemed to have consented to cookie use.  At the end of last week, the ICO published revised guidance(1) that generally supported this approach, particularly for use of cookies with a limited privacy impact.  Use of cookies for targeting (or use of any other technology for tracking users of computers or mobile devices) will likely be held to a higher standard of disclosure and consent.

The UK’s approach appears to be at odds with emerging requirements elsewhere in the European Union, where consent is deemed to require a greater affirmative sign of acceptance by site users.  The controversy will continue as EU policy-makers work on a broad re-write of Europe’s data protection legislation and negotiate with industry over online behavioral advertising practices in Europe.


Trackbacks (0) Links to blogs that reference this article Trackback URL
Comments (0) Read through and enter the discussion with the form at the end
Davis Wright Tremaine LLP
188 West Northern Lights Blvd.
Suite 1100
Anchorage, AK 99503-3985
(907) 257-5300
San Francisco
505 Montgomery Street
Suite 800
San Francisco, CA 94111-6533
(415) 276-6500
777 108th Avenue NE
Suite 2300
Bellevue, WA 98004-5149
(425) 646-6100
1201 Third Avenue
Suite 2200
Seattle, WA 98101-3045
(206) 622-3150
Los Angeles
865 South Figueroa Street
Suite 2400
Los Angeles, CA 90017-2566
(213) 633-6800
Washington, D.C.
1919 Pennsylvania Avenue, NW
Suite 800
Washington, D.C. 20006-3401
(202) 973-4200
New York
1633 Broadway
27th Floor
New York, NY 10019-6708
(212) 489-8230
Suite 701-704
Two International Finance Centre
8 Century Avenue, Pudong District
Shanghai 200120 P.R. China
(011) 86-21-6279-8560
1300 SW Fifth Avenue
Suite 2300
Portland, OR 97201-5630
(503) 241-2300
Attorney Advertising.

Prior results do not guarantee a similar outcome.