Out-Law / Your Daily Need-To-Know

Cookie consent can come after tracking has taken place, says minister

Out-Law News | 25 May 2011 | 1:20 pm | 1 min. read

Companies could obtain users' consent for tracking their behaviour with cookies after the fact, a Government minister has said. Culture minister Ed Vaizey said that new rules do not specify that 'prior' consent is necessary.

Vaizey said in an open letter (6-page / 86KB PDF) to website owners that new laws due to come into force tomorrow should not force them to gain users' consent before they make use of cookies.

"It is possible that consent may be given after or during processing," Vaizey said in the letter.

From tomorrow, UK laws based on the EU's Privacy and Electronic Communications Directive will force websites to obtain users' consent in order to store cookies. Cookies are small text files that record user activity on websites.

Vaizey said that there was no requirement for prior permission stipulated in the EU Directive and that therefore it had not been an included requirement within the new Privacy and Electronic Communications Regulations in the UK, which come into force tomorrow.

Vaizey, who is Minister for Culture, Communications and Creative Industries, said that though this was an unusual interpretation of the EU law, it was a legitimate one.

"It is important that stakeholders are aware that in its natural usage ‘consent’ rarely refers to a permission given after the action for which consent is being sought has been taken. This absolutely does not preclude a regulatory approach that recognises that in certain circumstances it is impracticable to obtain consent prior to processing," Vaizey said.

"It also supports any approach underpinned by industry’s attempts to inform users about the specific choices available and as a result allow users to make choices (ie give consent) based on that information," Vaizey said.

Vaizey said it was the "firm view" of the Government that the new regulations "enable" the new online behavioural advertising framework established by the Internet Advertising Bureau (IAB) Europe. The framework is a self-regulatory system for websites that will require websites to place an icon on adverts on their site that track user activity through cookies. 

Data Protection regulator the ICO today published guidance which said that it would give website operators a year in which to implement the law before it took enforcement action.