Industry says ICO cookie advice is half baked

The Information Commissioner's Office's (ICO) guidlines on compliance with EU law governing the use of cookies has been poorly received by industry.

The advice has been labelled as both "onerous" and "too late" by leading spokepeople in the legal and web hosting industries.

The guidelines offer advice on how firms should deal with an amendment to the EU's Privacy and Electronic Communications Directive, which will come into force on 26 May this year.

This amendment will require any UK-based organisation running web sites in the UK to get visitors' permission before cookies can be stored on their computers.

A cookie stores information about the user, and could be used for authentication, or storing site preferences or shopping cart information.

Information Commissioner Christopher Graham said: "The advice we've issued today should help businesses and organisations to get on the road to compliance in a way that causes them - as well as UK consumers - minimal disruption."

But Andreas Edler, managing director at hosting provider Hostway UK, stated that the guidelines are too late to help firms.

"This has been in discussion among EU members, including the UK, since September last year, so why only now is the ICO starting to treat it as a matter of priority? Clearly, most businesses and organisations won't be able to make the changes by the 26 May deadline. In our opinion, the introduction of the law should be delayed until such a time as people can be reasonably expected to comply with it."

And Robert Bond, partner at law firm Speechly Bircham and chairman of the ICC UK EBITT Experts Group, said that the requirements will incur greater costs for UK organisations.

"The impact of the new obligations laid down in today's guidance from the ICO is far-reaching and incredibly onerous to web site owners. Web sites will now need a mechanism to ensure they gain express consent from users before cookies can be activated.

"As almost every web site uses cookies, this will affect all UK companies and could cost them substantial sums of money and time in order to comply. As the new law comes into effect on the 26 May there is an urgent need for businesses to take steps to have in place an immediate self-defence mechanism."