European Union Article 29 Working Party Says Consent for Cookies Cannot be Implied by Computer Settings but Has to be Express

Last year, the European Union published a Citizens' Rights Directive amending the 2002 Privacy and Electronic Communications Directive. The upshot of the change – which must be brought into each country's laws by May 2011 – was that storing and accessing information on users' computers was only lawful where the user has given their prior consent and has been provided with clear and comprehensive information about the purposes for the processing. This provision was effectively an opt-in requirement for cookies, rather than the current opt-out regime. Cookies are small files that sit on a user's computer to help the website recognise them. They can be used to help a user save time while on web sites, or to enable advertising networks to send them targeted advertising.

There was an exception for cookies that were strictly necessary for a service requested by a user, and this would cover a cookie helping the user to navigate around a site to do what they want quickly. Advertisers thought that consent could be implied by browsers being set so as to not block cookies. However, the Article 29 Working Party has now published an opinion saying that the advertisers' view is not correct...