Why is this law coming into effect?
The law has been made to protect consumers’ online privacy by educating them about how their
information and behaviour is collected and used by websites. It aims to give consumers control over
their own online privacy. In our opinion, one of the biggest challenges to that is the lack of general
awareness of how the internet operates in the general public. Working in the industry we hav e a
blinkered view of the level of understanding of the average internet user. The vast majority will NOT
know what a cookie is or how these cookies enhance and impact their online experiences.
Types of Cookies
No more biscuit jokes... instead, some tech stuff. Cookies can be very generally classified as either
session or persistent cookies. This essentially means that they can either expire at the end of a
browser session (from when a user opens the browser window to when they exit the browser) or
they can be stored for longer with a variable period of time set by the site which ‘drops’ the cookie.
The new regulations do not really differentiate and the regulations apply to both types of cookies.
Are there any exceptions to the law?
The basis of the law exists around the ‘right to refuse’ a cookie... and there are exceptions
to the requirement to provide information about cookies and obtain consent where the use of the
cookie is one of the below:
For the sole purpose of carrying out the transmission of a communication over an electronic
communications network
Where such storage or access is ‘strictly necessary’ for the provision of an information society
service requested by the subscriber or user. For example, it is the same for intranet sites purely
targeted at your employees.
The term 'strictly necessary' means that such storage of or access to information should be
‘essential’, rather than ‘reasonably necessary’, for this exemption to apply. However, it will also be
restricted to what is essential to provide the service requested by the user, rather than what might
be essential for any other uses the service provider might wish to make of that data.
It should be noted, that where the use of a cookie type device is deemed 'important' rather than
'strictly necessary', those collecting the information are still obliged to provide information about
the device to the potential user and obtain consent.
4