Cookies and the revised Privacy and Electronic Communication Regulations 2003

click here to return to the archive page

26 May 2012

Changes affecting use of “cookies”, brought about by the revised EU Privacy and Electronic Communications Directive , are to be implemented into UK law this week.

The requirements impact on the electronic storage or gaining access to electronic information stored in the device of a subscriber or user – basically, the use of cookies and similar technologies.

The previous regime required those using cookies to provide “clear and comprehensive information” about the use of cookies, and to provide a means to enable users to opt-out/refuse.

The amended Regulations (implementing Article 5(3) of the revised Directive) require the same provision of information but now the user must give their “informed” consent to the use of cookies. The form and nature of the “consent” which will be appropriate will depend on the nature of the “cookie” use and the extent to which it impacts on the privacy of the user, but DCMS has made clear that the change to the Regulations does NOT mean that “prior consent” is necessarily required.

DCMS has also made it clear that businesses will be given time to devise technical solutions to the new requirements before the legislation is enforced:

The Government has endorsed the industry-led self-regulatory proposals in respect of cookies used in online behavioural advertising and has confirmed its view that this will meet the requirements of the revised Directive so far as these types of cookies are concerned.