The UK Cookie Law - How to Keep on the Right Side of the Law

There's been a lot of confusion over the UK cookie law. What does it mean? What do you have to do? Which cookies are okay and which cookies aren't? The government didn't help things by being very vague and not actually saying what you had to do. I wrote an article on this a couple of months ago based on the International Chamber of Commerce report which was widely regarded as the best advice at the time. Unfortunately the day before the law was due to be enforced the government rewrote parts of it, just to make life a bit easier!

The upshot of this is that I don't believe the International Chamber Of Commerce report and guidance is correct any more. The way it breaks down the different types of cookies is fine but I'm advising my clients to take a more proactive approach to informing website visitors.

What's Changed with the UK Cookie Law?

Originally the law implied that you had to have a pop-up window appear when somebody arrived your website. This would ask website visitors if they wanted to accept cookies or reject them. If people clicked the reject button then you couldn't use cookies. A few essential cookies were to be allowed by default but the big concern with website owners was that this pop-up window would break shopping carts and put customers off using the website.

The International Chamber of Commerce report tried to take a common sense approach to this problem. It advised that most cookies could be covered in your privacy policy by telling people what cookies you used and why. They advised there wasn't really a need to have a pop-up window.

The last-minute change by the government almost brought the law into line with this Chamber of Commerce report. They expanded the "implied consent" category to cover pretty much all cookies except for advertising and personal information types. This meant that most websites wouldn't have to force people to click an accept or reject button. But they did state that websites must be seen to be actively informing website users. The law specifically states that you can't assume people will seek out and read your privacy statement.

My Advice

I've been keeping an eye on this over the past couple of months to get a feel for what's being deemed as best practice. I generally like to err on the side of caution so here's the advice I'm giving out.

For all of our client websites, including our e-commerce websites, I'm advising a discreet pop-up on the first page someone sees when they get to the website. This pop-up will explain that the website uses cookies, give a link to more information, and state that continuing to use the website will be seen as an acceptance of cookies. When people then go to other pages on the website the message won't be shown. If the visitor clicks for more information they'll be taken to a page that describes how the website uses cookies and what they can do to prevent them.

You may have noticed is working when you came to this website. If you didn't simply clear your browser history and reload this page. You should then see the pop-up appearing at the top of the screen.

What Should You Do?

There is no real definitive guide on what to do for the UK cookie law. People's responses vary from doing nothing to having the full-blown pop-up window with the accept and reject buttons. Doing nothing will definitely put you on the wrong side of the law. Having the accept and reject buttons will scare people away from your website (a government department website tried this and lost 90% of its visitors).

I'm therefore happy that the advice I'm giving my clients keeps them legal and keeps their visitors on their sites.
This isn't really the sort of thing you're going to be able to do by yourself. You'll need to contact your website designer and have them program this for you.

If you get stuck or need any help working out what your website needs to do then just get in contact with me and I'll be happy to help.



blog comments powered by Disqus