Internet cookies: How to obtain consent

How can you obtain consent for internet cookies?

Browser settings – browser level solutions for internet cookies are being worked on at the moment, but the Information Commissioner believes that browser settings are not currently sufficient for users to give consent.

Pop-ups

This would be acceptable to obtain consent for internet cookies, but even the Information Commissioner thinks this might become annoying for users!

Terms and conditions

There is no reason why consent for internet cookies cannot be included within terms and conditions. However you would need to make users aware of the changes to the terms and conditions and make it explicitly clear that these changes refer to your use of internet cookies. 

You would also need the user to positively indicate that they understand and agree to the internet cookie changes by use of a tick box or something similar. This process must be completely transparent and easily understandable by a user. 

If you gain consent for internet cookies through users’ ignorance, then you will not be compliant with the new internet cookie rules.

Settings-led consent

For certain internet cookies it might be convenient to obtain consent when a user changes the settings for a site. 

For example, if a user chooses to always access a site in the English language version, consent for internet cookies could be obtained at the point where the user makes this choice.

Feature-led consent

Similarly, if internet cookies are stored when a user wants to use a particular feature of a site and the user has to take some action in order to activate that feature, consent for internet cookies can be obtained at that point. 

If the feature is provided by a third party, you will need to tell users and provide information as to how the third party may use internet cookies, in order that they can give meaningful consent.

Functional uses

Analytical internet cookies which collect information about how people access and use your site need user consent, even if they are not so obvious and appear not to be so intrusive. Careful thought will need to be given to the information to be provided and the method for obtaining consent for internet cookies. 

The Information Commissioner’s guidance suggests the use of highlighted text in the footer or header or a web page, or a scrolling piece of text when you want to set an internet cookie. This could link to the privacy policy on the site which should set out the choices available to the user.  

Where information about website use is given to third parties, this needs to be made absolutely clear and you should know how the third party uses this information. The Information Commissioner strongly encourages organisations to review their contractual arrangements with third parties concerning the use of such data.

Third-party cookies

This is a difficult area. The Information Commissioner acknowledges that this is the most challenging area for compliance and is working with other bodies, including industry, to try and find the right solutions. However, in the meantime, you will need to work with third parties to ensure that the users are absolutely clear about internet cookies being set, and that they are able to give meaningful consent.  

What next?

More guidance will be issued by the Information Commissioner over time. In particular, guidance on enforcement is expected to be published. Keep an eye on the Information Commissioner’s website for this guidance.

The Information Commissioner will also provide guidance giving examples of methods for obtaining consent and is keen to receive examples from industry. 

Given the difficulties in obtaining internet cookie consent, he has stated that he is unlikely to take enforcement action in the first 12 months provided that organisations have taken the steps set out in the guidance.  

Therefore the current guidance should be followed in order to demonstrate, if any complaint is made, that you have done all you can to comply with the new rules.

Where can I find more information?

Gillian Cordall is an IT, intellectual property and commercial lawyer at Keystone Law.

Picture source

Share this story

Close
Menu
Send this to a friend