By Graham Stedman, Nabarro
• The 27 EU member states have to bring the changes into force by 25 May 2011, and it seems they are unlikely to have a single common approach on how to implement these changes in their national laws.
• As a result, some countries may be more restrictive or more permissive than others, and this may cause some confusion for companies trying to work out which rules they must comply with.
• The country-of-origin principle in the eCommerce directive means that operators whose websites fall within the definition of “information society services” will likely need to comply only with the regulations in the country from which they are providing the service.
Potential significant affect on advertising and referrals
If member states require active consent before cookies are used by a website, the Internet advertising market is likely to be the worst affected, with referral arrangements and “click-through” commission arrangements likely to suffer too.
Commercial and IT & Communications briefing Laws governing use of "cookies" set to change 5 March 2010
Cookies are used frequently by both advertising companies and web analytics companies to identify repeat visitors. If visitors are faced with an option to prevent this tracking while retaining the rest of the website’s functionality, “unique visitors” measurements could become seriously distorted, and may force businesses to revisit other metrics as a basis for their commercial arrangements.
Active consent could reduce the value of behavioural targeted advertising and “unique visitors” as a metric for commercial payments
Potential international impact
Cookies are a tool used by websites and website advertising networks internationally, not just those based in the EU. The amended ePrivacy directive applies to the use of electronic communication networks in the EU, but does not just apply to businesses physically present or registered in EU member states.
This is in line with the EU’s approach to data protection, which imposes obligations on both those present in the EU together with those using equipment in the EU to process data.
From a practical perspective, lack of resource will mean that enforcement of the new rules against businesses based entirely outside the EU will be limited, and will be likely only to trouble businesses with a high profile, turnover or profits. This means that major international companies will be watching developments carefully.
Questions over implementation
The approaches of different EU member states will become clearer over the coming months, but we have already seen a flurry of speculation that the current pragmatic combination of browser privacy controls and privacy policies will not be enough going forward, and that the UK may take a less pragmatic approach to implementing the changes.
Companies based outside the EU providing services to EU customers may be affected and should monitor implementation.
Graham Stedman is a Partner at Nabarro. For more information on legal issues that effect entrepreneurs, please contact Graham Stedman: email@example.com
Join us on