OBTAINING COOKIE CONSENT

Introduction

New regulations called the Privacy and Electronic Communications (EC Directive)(Amendment) Regulations 2011 were put in to force on 26 May 2011.  These regulations have not so far been enforced by the Information Commissioner (ICO) as they gave all businesses one year’s grace period in which to implement the required changes.  The ICO will begin enforcement on 26 May 2012. 

Non-compliance with the regulations can result in fines and criminal and non-criminal sanctions.

Under the revised regulations, the use of cookies is only allowed if the user concerned has been provided with clear and comprehensive information about the purposes for which the cookie is stored and accessed and has given his or her consent.

How to Provide the Information

The cookie policy information and the users consent must be obtained before the cookie is set.  Consent can only be given by an affirmative step by the user.  In this regard, the ICO have advised that wherever possible websites should delay setting cookies until users have had the opportunity to understand what cookies are being used and to consent to their use.

The ICO has provided in its guidance a number of ways in which existing methods of flagging up important information could be adapted:

1.      Prominent Links

A prominent link in the header on the home page and/ or every page of the website to the privacy policy page which contains the cookies explanation.

i.e.  NEW: Information about cookies

And / or possibly making the link larger, different font “mouse-over” highlights.

2.      Using an Icon

A clickable icon to link to the privacy page.  However, this may be difficult due to the low level of user awareness.

3.      News Items and Blog Spots

A news item could explain our cookie policy simply with a link to the cookie info page (the privacy policy).

How to Obtain Consent

1.      Static Information Banners (with a tick box) (in header or footer)

Possibly, with a link to the privacy policy on it.

If the user does not tick the box and ignores the banner, it has been suggested in ICO guidance that where a user does not accept or refuse the cookies, consent could then be assumed.  In this case, you must include a prominent link to the policy on the website with an easy method for withdrawing consent i.e. by sending an email to Toshiba:

i.e.  NEW: Information about cookies

This banner could make reference to the fact that some cookies have already been placed but can be deleted, but will affect the users experience of the website if they are removed.

The ICO guidance suggests that the homepage could include a prominent footer which alerts the user to the cookies with a link to the cookie policy and which asks them to indicate whether or not they consent to that use.  Provided the notice is prominent, the website may then set cookies when the user moves on to another page of the same site even if the user fails to indicate his preference by ticking the relevant box.  However, the other pages MUST include a notice that allows the user to easily opt-out of the use of cookies.

2.      Pop Up Windows / Splash Pages (not necessary every time a user enters a website, so long as consent has been obtained once)

Would not work where there are pop-up blockers.