ICO gives firms a year to comply with new rules over use of cookie

The new EU law on the use of internet cookies came into force today, but websites targeting UK consumers have been given a grace period.

Organisations and businesses now have 12 months to, as the Information Commissioner's Office (ICO) puts it, "get their house in order" before it will enforce the new law. However, the ICO said this didn't mean companies could take it easy.

Information Commissioner Christopher Graham warned: "This does not let everyone off the hook. Those who choose to do nothing will have their lack of action taken into account when we begin formal enforcement of the rules."

The changes to the Privacy and Electronics Communications Directive (PECD) will, when the 12-month grace period is over, force websites to ask for "explicit consent" from consumers before storing tracking cookies.

Cookies are small files that are created whenever a person visits a website. They are usually benign and help to deliver services better to visitors to a website.

However, they can also be used to track people's purchases, the ads they read and even other websites, which concerns privacy experts. The only exception is if a cookie is "strictly necessary" for the provision of a service "explicitly requested" by the user.

Companies will also have to give information on how the data collected will be used.

The main issue is how companies will be able to comply. Browser settings are seen as one of the main ways companies and organisations can comply; but the technology is still not considered satisfactory by the ICO.

"Browser settings giving individuals more control over cookies will be an important contributor to a solution. But the necessary changes to the technology aren't there yet.

"In the meantime, although there isn't a formal transitional period in the Regulations, the Government has said they don't expect the ICO to enforce this new rule straight away. So we're giving businesses and organisations up to one year to get their house in order," said Graham.

He also announced that the ICO website will have a header bar on giving users information about the cookies the organisation uses and how to manage them.

The ICO has already issued guidance on how to comply with the new rules in the Privacy and Electronics Communications Directive but Graham said: "I am not saying that other websites should necessarily do the same.

"Every website is different and prescriptive and universal ‘to do' lists would only hinder rather than help businesses to find a solution that works best for them and their customers. The initial advice that we issued earlier this month will continue to be supplemented with real-life examples as they come in."

It has also issued guidance for consumers on what the new rules about cookies will mean for them and how the ICO will enforce the PECD law.

He continued: "I have said all along that the new EU rules on cookies are challenging. It would obviously ruin some users' browsing experience if they needed to negotiate endless pop-ups - and I am not saying that businesses have to go down that road.

"Equally, I have to remember that this law has been brought in to give consumers more choice about what companies know about them. That's why I'm taking a common-sense approach that takes both views into account."