Privacy watchdog to issue massive fines for cookie law breaches

The Information Commissioner's Office (ICO) has warned website operators to knuckle down and comply with regulations that govern how cookies are used or face massive fines.

Dave Evans, the ICO's group manager for business and industry, said he realised that the privacy watchdog had been criticised for not being "strict enough" and said some of the as yet unnamed operators have now been set a deadline.

Read more: Privacy news | Cookie news and advice

"Broadly speaking, there are two ways we go about this: an education programme to inform the industry, and enforcement work to ensure compliance. Some sites have failed to engage with us at all, and they're now being set a deadline to take steps towards compliance, with formal enforcement action likely if they fail to meet this deadline.

"Failure to act on an enforcement notice is a criminal offence," he added.

Cookies are small text files that record internet users' online activity on specific sites, and are required to provide popular features like remembering a customers preferences and sign-in details.

In May this year the law changed; it became compulsory under the EU's Privacy and Electronic Communications (PECR) Directive for website operators to ensure people gave consent before cookies were downloaded to their PC.

Websites also have to make it clear what data is  being stored and what it was used for. The only exemption to this rule is when a cookie is "strictly necessary" to provide a service for example, with online shopping baskets.

Although the ICO can fine companies that fail to comply with this law up to £500,000 when it came into force in May it took a 'softly softly' approach to compliance.

A the time the privacy watchdog said it was not going to actively search out companies that are not complying but will rely on feedback from the public.

It added that the only action it would take unless it had proof that a website's cookies were causing serious harm and were deeply intrusive, would be to write to a company.

Now it appears that it has run out of patience with many companies. Evans said on an ICO blog that it had provided education and companies should now "know they have to respond to the law."

He added that it "might be a law they wish didn't exist, but the simple fact is that it is here to stay," and it was now the ICO's job to regulate the organisations repeatedly refuse to comply with the law.