UK websites have been given an extra year to comply with the new cookie law.
The reason, according to ICO’s Christopher Graham, is to enable businesses “to get their house in order.“
Also, according to the UK government, they want to avoid “overnight changes“.
What the authorities don’t say is that they also need this extra period to figure out how to put the new law into practice. Especially how to deal with its flaws, the main one being that if cookies are not used to keep track of the user’s preference of not wanting cookies, websites will have to ask the same question on every page visit by that user. So a tracking ID in the URL would have to be used to stop the question from appearing, which is less secure than using cookies in the first place.
But the idea behind the law is to give consumers more choice about what companies know about them, it is not about ruining users’ browsing experience. So, does a common sense approach suffice the new government requirements? What are the challenges and opportunities for e-commerce businesses? These questions are the scope for this article.
QUICK CATCH UP
About Cookies
Cookies first appeared in 1994 providing a solution to the problem of implementing a virtual shopping cart. From then, they became central for session management, personalisation and measurement. They also started to be used by third parties to track users across multiple sites. In particular, an advertising company can track a user across all pages where it has advertising images.
Today, an ordinary website has several web servers interacting with the browser, and each of these may be setting cookies.
Also, there is a malicious practice currently in use. By setting “zombie” flash cookies, some websites never allow a user to truly delete a cookie and the user’s privacy is never protected.
About the new law
The new requirements to “store or gain access to information stored, in the terminal equipment of a subscriber or user” are that “the subscriber or user of that terminal equipment:
(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) has given his or her consent.”
According to the actual Directive, “…where it is technically possible and effective… the user’s consent… may be expressed by using the appropriate settings of a browser or other application.”
Also, there is no need to get consent if the cookie is “strictly necessary” for a service requested by the user. This exception applies for “add to basket”, “proceed to checkout” and similar cookies.
BROWSER-BASED SOLUTION?
The ICO seems to believe that universal browser settings will be an important contributor to the solution. According to BBC, “… the government has formed a working group with browser manufacturers to see if a browser-based solution to the issue can be found.”
Although it does sound appealing for someone else to resolve the issue of complying with the new law, a browser solution would leave out users that go online using mobile or tablet apps. Also, e-commerce sites would miss the opportunity for influencing the law enforcement guidance to better fit their needs.
HOW DOES IT IMPACT E-COMMERCE?
1. Effort to gather users’ consent
The fraction of users that don’t give consent will increase. Hence being able to provide a better experience for those users will become more important. And so will doing an extra effort to get permission from new users. For websites that currently have little or no consent at all from users, this represents a great risk.
Thus, websites should calculate what fraction of their current total number of users didn’t give consent and plan how they will improve this ratio during the year.
2. Value of data
The new law actually works in a way of making data less abundant, thus increasing the value of data. Users might restrict giving away data without seeing a clear benefit in doing so. For e-commerce sites, this might result in additional efforts being necessary to capture the users’ consent.
3. Geography
It is not yet clear to what degree the new European directive is a matter of geography. Businesses in Europe would be in disadvantage if their competition from elsewhere doesn’t face the same restrictions.
If that is the case, e-commerce sites must consider moving away from hosting their websites in Europe.
WHAT ACTIONS SHOULD BUSINESSES TAKE?
The ICO and DCMS have stated that no enforcement action will be taken while solutions are being developed.
So should businesses take any action at all?
Yes, so they can gradually comply with the common-sense aspect of the new law while developing best practices. It is also vital to keep an eye on what the big Internet players are doing and to progressively educate the users on the benefits of cookies.
It’s not about developing a whole new pricey solution, but to identify how intrusive your use of cookies currently is and progressively develop the best solution to obtain consent from users during the extended period that was granted to comply.
Bottom-line, businesses should aim at staying aligned with global industry trends while developing the insights on how to perform better given the new rules.
REFERENCES:
BBC News: Cookie madness or consumer protection? http://www.bbc.co.uk/blogs/thereporters/rorycellanjones/2011/03/cookie_madness_or_consumer_pro.html
BBC News Technology: Cookie law deferred for one year http://www.bbc.co.uk/news/technology-13541250
BBC News Technology: Governments ‘not ready’ for new European privacy law http://www.bbc.co.uk/news/technology-12677534
BBC News Technology: New net rules set to make cookies crumble http://www.bbc.co.uk/news/technology-12668552
Econsultancy: ICO take an extra year to chew on new cookie law http://econsultancy.com/uk/blog/7572-ico-take-an-extra-year-to-chew-on-new-cookie-law
ICO: Advices on the new cookies regulations http://www.ico.gov.uk/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf
Internet Retailing: Retailers granted extra time to comply with cookies law http://www.internetretailing.net/2011/05/retailers-granted-extra-time-to-comply-with-cookies-law/
Practical Ecommerce: Abandoned-Cart Remarketing Effective http://www.practicalecommerce.com/articles/2399-Abandoned-Cart-Remarketing-Effective-Says-Ecommerce-Exec
Wikipedia: HTTP cookie http://en.wikipedia.org/wiki/HTTP_cookie