UK—ICO grace period for compliance with new cookie rules comes to an end

The new EU rules on cookies came into force in the UK on 26 May 2011, but the Information Commissioner’s Office (ICO) indicated that it would implement a grace period of one year to allow businesses to comply. The 12-month grace period will expire this month, and it seems likely that some businesses will still be caught out.

While fines are unlikely, businesses should not assume that noncompliant websites will not be subject to some kind of enforcement action. It is likely that the ICO will focus on ensuring that infringing sites take steps to comply within a limited time period and will make full use of its powers to issue undertakings and enforcement notices.

Businesses that are still wondering what to do should take action as soon as possible to avoid regulatory scrutiny. Steps to take include auditing your cookie use to find out what you have got; assessing the intrusiveness of your cookies; adopting a notice-and-consent strategy appropriate to the intrusiveness of your cookies, and implementing forward-facing cookie management mechanisms.

As the 12-month amnesty for compliance with new cookie rules comes to an end, the International Chamber of Commerce UK (ICC) has published a guide to help organizations to comply with the rules.

The guide categorizes cookies into four different types: strictly necessary cookies, performance cookies, functionality cookies and targeting or advertising cookies, although the guide makes clear that this categorization may be subject to change.

Part II of the guide provides information about each category of cookie, the aim of which is to assist website users in understanding how particular types of cookies are used. Part III of the guide consists of technical guidance for website operators to assist them in understanding what cookies are used on their websites and in categorizing such cookies. Part IV contains some suggestions for obtaining consent from website users in relation to each category of cookie. The guide makes clear that Part IV is based on current guidance issued by the ICO but is not intended to be prescriptive.

The ICO has said that the ICC's guide compliments the ICO's existing cookies guidance. The ICO has also indicated that it will be updating its own cookies guidance before the end of the 12-month grace period to ensure the sharing of best practice advice.