Website operators and ad networks waiting for cookie 'consent' developments could be forgiven for having found the experience like waiting for the number 9 bus: You wait for ages and then two come
Website operators and ad networks waiting for cookie 'consent' developments could be forgiven for having found the experience like waiting for the number 9 bus: You wait for ages and then two come along at once.
First off was the news yesterday that the IAB Europe had adopted a new self-regulatory framework for online behavioural advertising, promoting enhanced user notice and choice through the deployment of an 'advertising option icon' alongside targeted ads (see post here: http://privacylawblog.ffw.com/?p=86).
Now, just 24 hours later, and the Department of Culture, Media and Sport ("DCMS") has published its long-awaited proposals (http://goo.gl/Ywn5G) to implement the revised European Electronic Communications Framework in the UK - including the controversial requirement for website operators and ad networks to obtain users' 'consent' to cookies placed on users' computers or devices.
Browser settings are enough - or are they?
The final DCMS proposals were not unexpected, having largely been proposed already in an earlier consultation document, but this is not to say that they are not significant. Crucially, they lay out the Government's intention to implement the revised Article 5(3) of the e-Privacy Directive in the UK (that is, the provision calling for cookie 'consent') in a way that allows website operators and ad networks to obtain consent through appropriate browser settings. The sigh of relief from business is almost palpable.
But there's a catch. DCMS stresses that "the current use of browser setting as a form of consent is not consistent with the revised wording ... The European Commission is also of this view." In other words, browser settings as they exist today do not serve to obtain user consent appropriately (probably on the basis that existing settings are too hidden and not sufficiently granular to allow users real control). However, to offset concerns that a raft of businesses will suddenly face enforcement come 25th May, the deadline for implementation, DCMS proposes to set up a working group that will explore how more appropriate consent mechanisms can be built into browser settings, and that solutions will be "phased" in gradually. It goes on to say that "during this time we do not expect that ICO will take enforcement action against businesses and organisations that are working to address their use of cookies or are engaged in development work on browsers and/ or other solutions." The message here? Start showing some proactive effort to audit current cookie use to work out what cookies you use and how you use them, and then consider how you can enhance user notice and choice until appropriate browser solutions come along. Do this, and you're unlikely to face any enforcement risk in the short- to mid-term.
Government support for online ad industry self-regulation
The DCMS response also highlights a marked victory for the online targeted ad industry, with the Government choosing to stand firmly behind industry proposals to self-regulate. Specifically, the Government announced its support of industry proposals to adopt an 'online advertising option' icon as a means of delivering enhanced notice and choice to consumers, a tacit approval of the IAB self-regulatory OBA framework published yesterday. Or perhaps not even that tacit - the DCMS said: "The Government is also supporting the cross-industry work on third party cookies in behavioural advertising. This industry lead approach will marry the provision of more information on the use of cookies accessed through an easily recognisable internet icon, a privacy policy notice, a single consumer control page, with a self-regulatory compliance and enforcement mechanism. ... The Government is pleased to support the industry-lead work on the use of third party cookies in behavioural advertising and is satisfied that this meets the requirements of the revised Article 5(3). The European commission has also endorsed this work. The Government believes that this work fully addresses one of the uses of cookies of most concern to users and is, therefore, a major component in the Government’s plans for meeting the requirement of the revised provisions."
So, good news for online business in the UK and it's a relief to see common-sense prevail. The Government seems to have successfully steered a middle course by, on the one hand, acknowledging that current cookie notice and choice mechanisms need to improve while, on the other hand, proposing sensible solutions that will be welcomed by business.
The question now, of course, is what the rest of Europe will do - whether pan-European pragmatism will prevail or whether more restrictive interpretations by one or two member states could could cause this online house of cards to collapse. We'll be watching and will post further updates to this blog as and when they happen.
First off was the news yesterday that the IAB Europe had adopted a new self-regulatory framework for online behavioural advertising, promoting enhanced user notice and choice through the deployment of an 'advertising option icon' alongside targeted ads (see post here: http://privacylawblog.ffw.com/?p=86).
Now, just 24 hours later, and the Department of Culture, Media and Sport ("DCMS") has published its long-awaited proposals (http://goo.gl/Ywn5G) to implement the revised European Electronic Communications Framework in the UK - including the controversial requirement for website operators and ad networks to obtain users' 'consent' to cookies placed on users' computers or devices.
Browser settings are enough - or are they?
The final DCMS proposals were not unexpected, having largely been proposed already in an earlier consultation document, but this is not to say that they are not significant. Crucially, they lay out the Government's intention to implement the revised Article 5(3) of the e-Privacy Directive in the UK (that is, the provision calling for cookie 'consent') in a way that allows website operators and ad networks to obtain consent through appropriate browser settings. The sigh of relief from business is almost palpable.
But there's a catch. DCMS stresses that "the current use of browser setting as a form of consent is not consistent with the revised wording ... The European Commission is also of this view." In other words, browser settings as they exist today do not serve to obtain user consent appropriately (probably on the basis that existing settings are too hidden and not sufficiently granular to allow users real control). However, to offset concerns that a raft of businesses will suddenly face enforcement come 25th May, the deadline for implementation, DCMS proposes to set up a working group that will explore how more appropriate consent mechanisms can be built into browser settings, and that solutions will be "phased" in gradually. It goes on to say that "during this time we do not expect that ICO will take enforcement action against businesses and organisations that are working to address their use of cookies or are engaged in development work on browsers and/ or other solutions." The message here? Start showing some proactive effort to audit current cookie use to work out what cookies you use and how you use them, and then consider how you can enhance user notice and choice until appropriate browser solutions come along. Do this, and you're unlikely to face any enforcement risk in the short- to mid-term.
Government support for online ad industry self-regulation
The DCMS response also highlights a marked victory for the online targeted ad industry, with the Government choosing to stand firmly behind industry proposals to self-regulate. Specifically, the Government announced its support of industry proposals to adopt an 'online advertising option' icon as a means of delivering enhanced notice and choice to consumers, a tacit approval of the IAB self-regulatory OBA framework published yesterday. Or perhaps not even that tacit - the DCMS said: "The Government is also supporting the cross-industry work on third party cookies in behavioural advertising. This industry lead approach will marry the provision of more information on the use of cookies accessed through an easily recognisable internet icon, a privacy policy notice, a single consumer control page, with a self-regulatory compliance and enforcement mechanism. ... The Government is pleased to support the industry-lead work on the use of third party cookies in behavioural advertising and is satisfied that this meets the requirements of the revised Article 5(3). The European commission has also endorsed this work. The Government believes that this work fully addresses one of the uses of cookies of most concern to users and is, therefore, a major component in the Government’s plans for meeting the requirement of the revised provisions."
So, good news for online business in the UK and it's a relief to see common-sense prevail. The Government seems to have successfully steered a middle course by, on the one hand, acknowledging that current cookie notice and choice mechanisms need to improve while, on the other hand, proposing sensible solutions that will be welcomed by business.
The question now, of course, is what the rest of Europe will do - whether pan-European pragmatism will prevail or whether more restrictive interpretations by one or two member states could could cause this online house of cards to collapse. We'll be watching and will post further updates to this blog as and when they happen.