{"id":1461,"date":"2012-04-03T08:55:06","date_gmt":"2012-04-03T08:55:06","guid":{"rendered":"http:\/\/www.cxfocus.com\/?p=1461"},"modified":"2014-10-16T17:35:37","modified_gmt":"2014-10-16T17:35:37","slug":"eu-cookie-law-ecommerce-sites-selling-uk","status":"publish","type":"post","link":"http:\/\/www.cxfocus.com\/index.php\/ecommerce-usability\/eu-cookie-law-ecommerce-sites-selling-uk\/","title":{"rendered":"EU Cookie Law – ecommerce sites selling to UK need to do something now"},"content":{"rendered":"

\"GoogleSite owners in the UK have had several years to get to grips with implementing the EU Tracking directive. The period of grace ended on May 26th 2012 and so UK ecommerce sites have no excuse for not complying with our version of the EU ‘Cookie Law’.<\/strong><\/p>\n

But what do you really need to do? There was a lot of fear, Uncertainty and Doubt back in 2012. The sneers of “they cannot be serious” were joined by complaints that “it will set back the economy”.<\/p>\n

By 2014 the situation was becoming clear, so I recommend you skip to the key updates in the resources section below. To skip straight to the updates, click here: [Updated: June 2014 with a link to a great summary of what’s actually been done in the way of enforcement<\/strong><\/a>].<\/p>\n

I had already sent out my own thoughts on the subject to my email list months before writing this original blog post in 2012. So I wasn’t going to add yet more to the public debate by writing a blog post. But… I’m a great believer in using Google Analytics Site Search Reports<\/a> as a way of finding out what people want. And those reports show that people were coming to this site looking for information about the EU cookie law.<\/p>\n

So here goes.<\/p>\n

What you need to do now<\/h2>\n

1. Do an audit of your site and document what you’re tracking, how and why
\n2. Update your privacy policy to include the information<\/p>\n

Taking these first steps towards obeying the law ought to be sufficient to reduce the chances of a fine.<\/p>\n

But you shouldn’t stop right there. That would be particularly irresponsible if you’re a prominent site which is more likely to attract the attention of someone who wants to complain to the ICO either out of malice or simply to provoke a test case.<\/p>\n

Because:<\/p>\n

Strictly speaking, the law requires you to have an opt-in consent system live on the site. Now.<\/p>\n

So:<\/p>\n

3. You should also be able to at least show that you’re working on your solution<\/strong> to the requirement to ask all visitors to your site to actively give consent for you to use cookies or any similar tracking systems. [Update: when Dan Barker’s 2014 post<\/a> you will see how this aspect of ‘doing something’ has a real impact on the attitude taken by the ICO]<\/p>\n

EU Cookie Law Opt-in Systems<\/h2>\n

The general opinion in most of the discussion on the subject I have seen is that sites will be able to get away with breaking the consent aspect of the law for a bit longer, provided that they can show they have started to comply by documenting the audit and updating their privacy policy.<\/p>\n

This opinion is based on a series of reasonable assumptions:<\/p>\n

    \n
  • That the law is intended to target sites which are using tracking in suspicious or devious ways, not sites which are using the standard analytics and marketing systems<\/li>\n
  • That the ICO does not have a huge team to police this and start actively checking every site<\/li>\n<\/ul>\n

    The opinion is supported by things like this guide to implementing the law on public sector websites issued by the UK Government Digital Service:<\/p>\n

    http:\/\/alphagov.files.wordpress.com\/2012\/03\/gds-cookies-implementer-guide.pdf<\/a> [Opens in new tab]<\/p>\n

    At the moment there are very few examples to look at out in the wild. You can bet that some more will appear on the day itself on big-name sites such as BBC, Amazon, Tesco, ASOS etc. If I remember correctly Argos went live with one when the law took effect last year, but removed it within hours as soon as the period of grace was announced.<\/p>\n

    The best example I have seen so far is the one on part of the BT site:<\/p>\n

    \"Screenshot<\/p>\n

    And here’s a video of it in action:<\/p>\n