Skip to navigation
Latest News

95% of firms not ready for cookie laws

web

By Nicole Kobie

Posted on 10 Apr 2012 at 10:35

The vast majority of new websites don't comply with new cookie consent laws, according to a study from KPMG.

The new law requires sites to ask for consent before dropping cookies onto users' computers. While the EU Directive technically came into force last year, it isn't being enforced in the UK until 26 May - but it appears few sites are ready for the change.

KPMG audited 55 "major" websites, finding only one that specifically asks for user consent and two that said they were being updated to meet the rules by the deadline.

Where to start

Experts recommend three steps to compliance:

1) Find out what cookies your site uses, and remove ones that aren't key to your business

2) Alert users to cookies via a prominent link or pop-up

3) Start asking for consent, first in easy places such as logins, before expanding across your site

"Whilst the majority of websites we analysed made a reference to the use of cookies under either the terms and conditions or specific privacy policies, and some also state how the cookies are being used, this is not enough to ensure compliance with the directive," said Stephen Bonner, a partner in the information protection and business resilience team at KPMG.

"Organisations now need to focus their efforts on establishing an inventory of their websites and the cookies currently in use, before evaluating their purpose, and establish a pragmatic plan to ensure compliance," he added.

With more than a month to go before the rules come into force, it's no surprise many sites don't yet offer full compliance - especially as the Information Commissioner's Office (ICO) has no plans for immediate fines.

While those organisations that don't meet the deadline can technically face a £500,000 fine, Comissioner Christopher Graham has said the ICO won't take action against those that are working towards meeting the law.

"When our 12-month grace period ends, there won't be a wave of formal enforcement actions taken against those who aren't yet compliant, but are trying to get there," Graham said last year.

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here
User comments

Ironically the ICO website uses a cookie to track whether a user has given permission for cookies to be used.

By 0thello on 10 Apr 2012

@0thello

On the other hand, without that cookie, they would have to ask on every visit, if the user wants to save the cookie or not...

For a single visit to a site, they could use the session to hold the answer (and all other information they want, as that isn't a cookie)...

Pretty pointless.

By big_D on 10 Apr 2012

Not ironic

0thello's wording seems a bit misleading - "whether" implies that they set a cookie to show if a user has REFUSED permission (which of course would be ironic), as well as if they accepted.

But the cookie is set ONLY IF they tick the box and give permission, so it doesn't have to be ticked again (which is perfectly reasonable). If they don't tick the box, it reappears next time because no cookie has been set (there is no way of actively refusing permission).

By halsteadk on 10 Apr 2012

Why are cookies bad but our government knowing where we've been and who we've been emailing good?

By Mark_Thompson on 10 Apr 2012

When does 'enforced' not really mean 'enforced'?

Whether you agree with it or not, the EU Directive came into force last year. There's been a 'grace period' of 12 months (not unusual) before the legislation is 'enforced' in UK law.

Except it seems that
'enforced' doesn't really mean 'enforced' in the ICO's dictionary, because website owners for whom the change is apparently far too complex to have been achieved in 12 months will be immune from any action as long as they are 'trying to get there'.

How about, instead, slapping the maximum £500,000 fine on any website owner not compliant by the deadline they've known about for a whole year. I wonder how many website owners would still be 'trying for compliance' by the deadline if they'd had any fear of being fined?

Is there any point at all to the ICO?

By PRcons on 12 Apr 2012

EU Department of Inept Legislation

Here we go again.

It is not too long ago that a Windows Update deleted my installed Internet Explorer and forced me to answer a browser ballot so that I could get it back again. At the time, I had 5 browsers installed on my computer. I considered this to be reckless interference, worse than the supposed problem the browser ballot was supposed to solve.

But who do I email in the EU to register a complaint? Anyone got an email address for Neelie Kroes?

Now we find the same ineptness applied to cookies. Browsers can be configured to refuse cookies, accept them, or ask the user to accept or refuse them. Why is that not enough?

The Eurocrats who insist on getting up our noses with this nonsense should be hauled before the European courts for bringing the EU into disrepute (which I gather is an offence).

It's a pity they don't do something useful, such as make it illegal for laptops and mobile phones to be adulterated with unremovable or hard-to-remove crapware prior to purchase, or making it illegal to bundle phones into phone contracts or lock phones to a network, or making it illegal for obnoxious vendors to fight each other over the patenting of different radii of corners for their rectangular boxes with glass fronts, so that users have freedom of choice rather than having to put up with smothering tyranny.

Perhaps I am asking too much to imagine that EU bureaucrats would do something to free people from smothering tyranny.

By fogtax on 12 Apr 2012

Fine 'em back to the Stone Age

PRcons wants to slap a half million fine on every web site owner - well that's me stuffed as everything I own gets nowhere near that. And every every other Mom&Pop website that happens to use Google Analytics has to invent their own wheel to stay out of the workhouse. Crazy! Is crazy!

By andy_g on 12 Apr 2012

Do any European sites comply with the law?

I often use non-UK European websites, and I have yet to be asked for permission for them to set a cookie. Does this mean that all other EU Member States have also delayed implementation by 12 months, or could it just be that the equivalent bodies to the ICO elsewhere are implementing the directive with more of a light touch?

By ianbyrne on 13 Apr 2012

Leave a comment

You need to Login or Register to comment.

(optional)

advertisement

Latest Blog Posts Subscribe to our RSS Feeds
Latest ReviewsSubscribe to our RSS Feeds
Latest Real World Computing

advertisement

Sponsored Links
 
SEARCH
Loading
WEB ID
SIGN UP

Your email:

Your password:

remember me

advertisement


Hitwise Top 10 Website 2010
 
 

PCPro-Computing in the Real World Printed from www.pcpro.co.uk

Register to receive our regular email newsletter at http://www.pcpro.co.uk/registration.

The newsletter contains links to our latest PC news, product reviews, features and how-to guides, plus special offers and competitions.