How The Cookie Crumbles: ICO Issues Last-Minute Amended Cookie Law Guidance

The grace period that the Information Commissioner's Office (the data protection regulator – the 'ICO') offered for compliance with the revised cookie law came to an end on Saturday, meaning that it's now 'business as usual' for the ICO when it comes to enforcement against organisations which do not obtain consent for cookie use. To assist organisations to comply with this law, the ICO published updated guidance the day before - on Friday 25 May. The key message of this new guidance is that implied consent through non-explicit means can be valid consent. The ICO has recognised that obtaining active consent is not always the most appropriate method for organisations: "While explicit consent might allow for regulatory certainty [...] this does not mean that implied consent cannot be compliant." This is in contrast to the previous ICO guidance which stated: "At present evidence demonstrates that general awareness of the functions and uses of cookies is simply not high enough for websites to look to rely entirely in the first instance on implied consent". The new ICO guidance also seems to be at odds with the Article 29 Working Party's review of the e-Privacy Directive. The Article 29 Working Party, a body comprised of representatives from each EU member state's data protection authority, stated in its Opinion 2/2010 that "only in very specific, individual cases, could implied consent be argued." The ICO's amended guidance goes on to state that where organisations are collecting sensitive personal data (such as health information) however, explicit consent may be more appropriate. It also emphasises organisations' responsibilities regarding third-party cookies on their websites. The ICO provides a warning to organisations that implied consent does not mean they can sit back and do nothing, assuming that users' use of a website is enough to indicate consent. The ICO defines implied consent as: "some action taken by the consenting individual from which their consent can be inferred [e.g.] visiting a website, moving from one page to another or clicking on a particular button". Dave Evans, group manager at the ICO, wrote in the ICO blog that in order to rely on implied consent, organisations need to be satisfied that their users "understand that their actions will result in cookies being set" and that...