ICO cookie dithering "cost SMBs thousands"

 

Gallery

By Nicole Kobie

Posted on 8 Jun 2012 at 14:37

Confusion over the cookie consent law may have cost small businesses thousands of pounds, according to a leading web host.

The Information Commissioner's Office began enforcing the so-called cookie consent law on 26 May, after giving UK companies a one-year grace period to meet the EU directive.

A day before enforcement began, the ICO said implied consent would be suitable for some websites, meaning warning users about the use of cookies and telling them to stay away if they don't want them dropped on their computers was enough.

However, some sites had already put the work into creating a full "informed consent" model, with pop-ups or similar devices asking permission before dropping any cookies.

It takes a significant amount of effort to put a system of full consent into place and it is far beyond the realms of most SMEs

"It takes a significant amount of effort to put a system of full consent into place and it is far beyond the realms of most SMEs," said Neil Lathwood, technical director for hosting firm UKFast. "Those who have invested the time and money to set up pop-ups or banners have now been told that 'implied consent' is compliant with the law, making their well-meaning efforts pointless and probably costly."

Cost questions

Exactly what the cost difference could be depends on the scale of the site and extent of cookie use, but UKFast suggested that implied consent could be done in half a day for a small website, compared to as much as six days' work for a full consent model.

"At an industry average of £200-500 hourly rate - for SMEs I’ve been recommended to use a £400 rate - a full explicit consent solution would be around £2,400," a UKFast spokeswoman told PC Pro. "An implied consent solution could be installed within a couple of hours so a half-day rate of £200."

Of course, the difference in time and cost varies depending on the size and complexity of the site, as well as the number of cookies being used. Plus, smaller sites may have been able to use one of the free options available and done the work themselves. If using a ready-made solution, compliance could be delivered in a day or two for a small site, said Civic's Mark Steven.

Either way, his own agency had to change what it was recommending to clients. "There had been so little guidance beforehand that we were working towards the only safe option of full, explicit consent whereas now we are recommending that users implement an implied consent model on their site, unless they depend heavily on particularly invasive cookies," Steven said at a UKFast roundtable.

No change?

The ICO denied that it had changed its stance on implied consent, but merely qualified how the model could be used. “Anyone who has read our guidance will know that our position on implied consent has not changed," the ICO said in a statement to PC Pro.
"The law does not require explicit consent and we have always been clear that implied consent can be valid. It is quite wrong to suggest there has been any ‘last minute change’ from the ICO."

While the ICO says in its current guidance that implied consent was always acceptable, it made it clear in the second edition of that document, released in December, that the model was unlikely to be enough for most sites. "At present evidence demonstrates that general awareness of the functions and uses of cookies is simply not high enough for websites to look to rely entirely in the first instance on implied consent," it wrote.

The ICO said it has received 180 complaints about cookies on websites via its online reporting tool.