“The legislation aims to ensure that consent is sought by web sites using cookies in certain specific circumstances,” says Martin Noble, associate and online legal expert at Shakespeares.
“The type of consent required depends on the nature of the cookie being used the more intrusive it is, the more attention that needs to be drawn to its use. No consent is needed where cookies are considered ‘strictly necessary” for the provision of a service requested by the user.
“For example, a cookie that enables the contents of a virtual shopping basket to be remembered at an online store. However, the use of behavioural advertising cookies (that track a user’s browsing habits) would need specific consent.
Website operators will not be allowed to rely upon users simply changing their web browser settings on May 26 to accept or reject certain types of cookies.
The legislation is unclear about who is responsible for third party cookies, adds Noble:
“The ICO has the power to fine up to £500,000 in the most serious cases and will take into account the adequacy of what has been done prior to 26 May 2012 in any investigation. Therefore, if not done already, website operators need to audit their sites to assess how intrusive their cookies are and decide on the best solution for providing the user with information about their use and obtaining consent as appropriate.