May 26, 2012

Implied consent is a valid form of consent

At the very last minute, the ICO has published new guidance on the highly controversial EU cookie law. Companies like BT must be slightly annoyed at this changing of the goalposts, considering the amount of work they clearly put into managing their cookie use across parts of their highly cookie reliant website.

Here’s one of the most important new clarifications: Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies. Read the extra points in the new guidelines for even more specificity on this. However, the general theme here it seems is: Use cookies for reasons beneficial to the users and you don’t need permission, just make your users aware of how you’re using cookies.

Use analytics for improving your user experience? Fine. Use external services that use cookies? Fine. Just make it clear to the user what you’re doing

“It’s about telling users that actually here are the things that we do to make your experience of our site much better than it could be and we hope you agree to that. And actually selling the benefits, whether it’s personalisation of the services we provide to people, which can range from remembering their name, or remembering who they are so the next time they don’t have to fill out the form every time.”
David Evans
ICO

Although it’s disappointing that it’s taken until the last minute for this clarification—images of panicking companies rushing around to comply with stringent laws come to mind—I think this is a truly positive move from the ICO. The original guidance, at least to me and I think to many others, showed a gross misunderstanding of the state of cookie use, from a technical perspective. Without even starting on Google Analytics, often used embedded services such as YouTube, AddThis and ShareThis use cookies liberally, and to ask companies to control them is just impossible. I don’t know whether the regulations reflected this all the time, the regulation document was way too long and full of legal speak for anyone other an a lawyer to fully comprehend. Regardless, we can all relieve ourselves of the worry that we might have to get lose most of our Analytics data to no-one clicking that “Accept Cookies” button.

Please do read the new guidance for the best guidance, I’m no lawyer, just taking guidance as provided by the ICO.