The amendments
On the face of it, the amendments require that users actively give their consent “having been provided with clear and comprehensive information” for any cookies which are not “strictly necessary” to provide a service “explicitly requested by the subscriber or user”. This is a significant change from the previous UK position of simply providing users with means to refuse the continued use of cookies after that information was supplied.
If active consent is required, businesses will likely turn to intrusive pop-ups or initial pages requiring users to “accept” the use of cookies before being able to access the full functionality of their website.
Potential significant affect on advertising and referrals
If member states require active consent before cookies are used by a website, the Internet advertising market is likely to be the worst affected, with referral arrangements and “click-through” commission arrangements likely to suffer too.
Commercial and IT & Communications briefing Laws governing use of "cookies" set to change 5 March 2010
Cookies are used frequently by both advertising companies and web analytics companies to identify repeat visitors. If visitors are faced with an option to prevent this tracking while retaining the rest of the website’s functionality, “unique visitors” measurements could become seriously distorted, and may force businesses to revisit other metrics as a basis for their commercial arrangements.
Active consent could reduce the value of behavioural targeted advertising and “unique visitors” as a metric for commercial payments
Potential international impact
Cookies are a tool used by websites and website advertising networks internationally, not just those based in the EU. The amended ePrivacy directive applies to the use of electronic communication networks in the EU, but does not just apply to businesses physically present or registered in EU member states.
This is in line with the EU’s approach to data protection, which imposes obligations on both those present in the EU together with those using equipment in the EU to process data.
From a practical perspective, lack of resource will mean that enforcement of the new rules against businesses based entirely outside the EU will be limited, and will be likely only to trouble businesses with a high profile, turnover or profits. This means that major international companies will be watching developments carefully.
Questions over implementation
The approaches of different EU member states will become clearer over the coming months, but we have already seen a flurry of speculation that the current pragmatic combination of browser privacy controls and privacy policies will not be enough going forward, and that the UK may take a less pragmatic approach to implementing the changes.
Companies based outside the EU providing services to EU customers may be affected and should monitor implementation.
For more information on legal issues that effect entrepreneurs, please contact Graham Stedman ( This e-mail address is being protected from spambots. You need JavaScript enabled to view it )
