12/08/10

By Graham Stedman, Nabarro

Recent amendments to the European directive on privacy and electronic communications (ePrivacy directive) could force website operators to reconsider their use of cookies. This means that the UK’s current pragmatic approach to the use of cookies could change. Companies should monitor how the amendments are made to see whether they need to change their websites. Noting that:

• The 27 EU member states have to bring the changes into force by 25 May 2011, and it seems they are unlikely to have a single common approach on how to implement these changes in their national laws.

• As a result, some countries may be more restrictive or more permissive than others, and this may cause some confusion for companies trying to work out which rules they must comply with.

• The country-of-origin principle in the eCommerce directive means that operators whose websites fall within the definition of “information society services” will likely need to comply only with the regulations in the country from which they are providing the service.

The amendments

On the face of it, the amendments require that users actively give their consent “having been provided with clear and comprehensive information” for any cookies which are not “strictly necessary” to provide a service “explicitly requested by the subscriber or user”. This is a significant change from the previous UK position of simply providing users with means to refuse the continued use of cookies after that information was supplied.

If active consent is required, businesses will likely turn to intrusive pop-ups or initial pages requiring users to “accept” the use of cookies before being able to access the full functionality of their website.

Potential significant affect on advertising and referrals

If member states require active consent before cookies are used by a website, the Internet advertising market is likely to be the worst affected, with referral arrangements and “click-through” commission arrangements likely to suffer too.

Commercial and IT & Communications briefing Laws governing use of "cookies" set to change 5 March 2010

Cookies are used frequently by both advertising companies and web analytics companies to identify repeat visitors. If visitors are faced with an option to prevent this tracking while retaining the rest of the website’s functionality, “unique visitors” measurements could become seriously distorted, and may force businesses to revisit other metrics as a basis for their commercial arrangements.

Active consent could reduce the value of behavioural targeted advertising and “unique visitors” as a metric for commercial payments

Potential international impact

Cookies are a tool used by websites and website advertising networks internationally, not just those based in the EU. The amended ePrivacy directive applies to the use of electronic communication networks in the EU, but does not just apply to businesses physically present or registered in EU member states.

This is in line with the EU’s approach to data protection, which imposes obligations on both those present in the EU together with those using equipment in the EU to process data.

From a practical perspective, lack of resource will mean that enforcement of the new rules against businesses based entirely outside the EU will be limited, and will be likely only to trouble businesses with a high profile, turnover or profits. This means that major international companies will be watching developments carefully.

Questions over implementation

The approaches of different EU member states will become clearer over the coming months, but we have already seen a flurry of speculation that the current pragmatic combination of browser privacy controls and privacy policies will not be enough going forward, and that the UK may take a less pragmatic approach to implementing the changes.

Companies based outside the EU providing services to EU customers may be affected and should monitor implementation.

Graham Stedman is a Partner at Nabarro. For more information on legal issues that effect entrepreneurs, please contact Graham Stedman: g.stedman@nabarro.com


Join us on