We’ve been talking to Tom Gell, data protection expert at Trust Keith and ISO Serious, about cookies. You might think that you have this covered, but it’s a fast-moving area and many organisations don’t realise they are out-of-date and failing to comply with the law.
Remind me, what are cookies?
In a nutshell, cookies are small data files used by websites to track and remember users. They enable businesses to analyse user data, personalise online ads and monitor web browsing. This can be problematic from a privacy perspective as highly sensitive, personal information may be discoverable from tracking someone’s web browsing history.
Why should I care?
The Information Commissioner’s Office (ICO) is clamping down on poor cookie practice. While it is currently larger organisations that are being scrutinised, there will be a trickle-down effect, as there was with privacy notices, so smaller players will need to ensure compliance to avoid complaints and likely also in order to get through privacy audits, win contracts ,etc..
The ICO has also said it is developing an AI tool to assist with automatic enforcement, so it’s more important than ever to understand the requirements.
Top 7 things Tom says you need to know…
Tom Gell shares his list of the top things you need to know below to help ensure you measure up.
1. There are two types of cookies
- Essential cookies which are needed to make a website work. There is no need to get consent for this type of cookie.
- Non-essential cookies, as the name suggests, are cookies which are not strictly needed to make a site function. Consent from users is needed to process non-essential cookies. This includes advertising cookies used by third parties on your website to track use and personalise ads.
2. Analytical cookies
Many businesses regard analytical information about use of their website as essential to their operations, but this is regarded as non-essential by law, so restrictions apply.
3. Other tracking technology
The law relating to cookies has been in existence since 2003 and applies not just to cookies but to the full range of tracking technology that might be used on a website.
4. Changing law
The law in this area has been updated numerous times and is likely to change again in the future so you need to make sure you are keeping up with developments. For example, the introduction of the GDPR in 2018 changed the definition of ‘consent”; which must now be “active” rather “passive”.
5. 3rd party providers
Don’t delegate/abdicate responsibility for compliance to your cookie provider. Make it your business to check that they are getting it right – even big, established outfits can get it wrong.
6. “Reject all”
The ICO is concerned about giving users fair choice about their cookie use. When it comes to cookie banners, designs that encourage a particular choice or type of behaviour is a no-no. For example, an oversized or bold coloured “yes” button against a smaller or light coloured “no” button. The ICO has said that it must be as easy for users to “reject all” advertising cookies as it is to “accept all”.
7. Countries
If you operate in more than one jurisdiction you will find there are different rules; don’t assume that what works for the UK works in EU or other countries.
How can we help?
If you want to discuss any of the above or if would like us to check your cookie policy for compliance please get in touch on info@legaledge.co.uk. You may also want to check out our previous blog on why do I need a cookie notice.
