Cookies must have opt-out

The government's information commissioner last week said that to comply with new privacy regulations, firms operating web sites must clearly state what information they gather about their users, and how they collect it.

Clarity is essential if firms deploy online tracking devices such as cookies, said the Office of the Information Commissioner. It added that although the government will not legislate against tracking technology, it would take action against firms that breach the law when using them.

The commissioner said that firms should identify the presence and purpose of cookies on web sites, and make it possible for users to refuse them.

The guidance comes as firms prepare to comply with Privacy and Electronic Communications Regulations, which come into force on 11 December. Although there has been some suggestion that cookies might be outlawed, the commissioner said, "cookies are important to the provision of many online services ... [but] users should be given the choice as to which of their online activities are monitored in this way".

Although the guidance is not prescriptive as to exactly what information about tracking devices should be provided, it is more explicit about how this information should be made available. For example, if information about cookies is presented in a web site's privacy policy it should be clearly sign-posted "at least [on] those pages where a user may enter a web site".

Sites that display adverts from other firms that use cookies will also have to inform users that this is the case. The information commissioner warned, "It will not be sufficient for that organisation to provide a statement to the effect that they cannot be held responsible for any use of such devices employed by other persons."

To help firms use cookies properly, the Interactive Advertising Bureau (IAB) web site offers best-practice advice, as well as sample privacy policies for sites using such tools. In a statement, IAB chief executive Danny Meadows-Klue said: "We are inviting all UK web sites to link to this resource to help consumers understand the issues better."

Firms can join the initiative by emailing the project team at the email address below.

See also:

Site cookies break the law

Online firms not meeting cookie regulations  15 Dec 2003

Anti-spam law critics predict failure

EU directive will be crippled by countries failing to comply, warn anti-spam experts  11 Dec 2003

Data Protection Act

How the Data Protection Act affects the way firms can process information and monitor their staff  25 Aug 2003

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!