UK web sites 'must do better' on cookie laws

Information Commissioner Christopher Graham has warned business leaders that they only have a few months to get to grips with their web cookies policies before they face legal action.

New laws governing the use of cookies came into force in the UK on 26 May 2011. The Information Commissioner then gave firms a 12-month grace period to adjust to the new rules.

But it has recently studied compliance with the Privacy and Electronic Communications Regulations and confirmed many firms fall down badly.

“Our mid-term report can be summed up by the schoolteacher’s favourite clichés 'could do better' and 'must try harder',” said Graham.

Frequently, web sites were failing to seek consent for cookies to be stored on users' computers.

The Information Commissioner's Office (ICO) has recognised that many firms are struggling to understand how they can be compliant with the regulations, specifically in relation to third parties that may place cookies on users' machines.

The ICO has therefore updated its guidance for UK web site owners, setting out examples of what compliance looks like.

Graham also stated that formal enforcement action was unlikely to be taken against those that were not compliant when the grace period was over but had demonstrated they were trying to get there.

The cookie laws were greeted with widespread dismay among business leaders, given that virtually every web site uses some form of cookie.

The laws were introduced at the behest of European regulators, keen to clamp down on what they perceived to be unjustified tracking and analysis of surfers, many of whom would have been unaware of the number of cookies being installed on their computers.

However, business leaders have complained that the rules are onerous and overly complicated.

Nevertheless the new guidance was welcomed by the Internet Service Providers' Association for providing some clarity for an "important and complex" issue.

It wiill help "website owners to become compliant", a spokesman for the ISPA told Computing.