The Cookie Law - What you need to know

Slide deck created in early 2012 for a presentation on Cookies. We shared our investigation with other digital agencies, around how the new EU directive will affect their clients.

Transcript

1. The Cookie Law What you need to know Slides by Chris Myhill
2. What’s this about? - What the cookie law (basically) means for your clients. - What we need to be advising them. - The information your client sites need to provide. - How to best design the on-site cookie notification, if required.
3. What is the cookie law?
4. The European ‘E-privacy Directive’ -In 2009, the law was updated with requirement ‘2009/136/EC’. “All websites require consent for the storage or access of information on the visitor’s terminal”. - Originally introduced in 2002. Mostly about data retention laws. - This states that:
5. In English… - Cookies (and other files) can’t be stored on a user’s device without their knowledge and agreement.
6. Why the change? + =
7. The Rules… - The ICO gave European website owners until the 25th May 2011. - In the UK, this deadline was extended a year, to the 25th May 2012.
8. And if you break them… - The may fine the website owner up to £500,000.
9. Does the law make sense?
10. My Rant… - The directive puts EU business at a disadvantage. - “Do you want cookies?” notifications are annoying and confusing. - No cookies = no reporting tools. - The digital giants (Facebook) probably won’t do anything.
11. Anyway, what do we need to do?
12. The ICO’s Guidelines - The ICO published a set of guidelines to help website owners comply.
13. They place cookies into four categories - Strictly Necessary (shopping baskets, sign-ins) - Performance (google analytics, clicktale) - Functionality (‘remember me’, suggested products) - Targeted (Ads supplied by twitter / facebook)
14. What the rules say - Users must be notified about the use of cookies, and provide their consent. - Users must be notified about the use of cookies, and provide their consent. -A cookies policy must be available on the site. It must outline: - what cookies are. - which cookies that are used (and why). - how to disable them.
15. Unless… - The exception is for ‘strictly necessary’ cookies. We don’t need the user’s permission to use them. “This exception is a narrow one but might apply, for example, to a cookie you use to ensure that when a user of your site has chosen the goods they wish to buy and clicks the “add to basket” or “proceed to checkout” button, your site remembers what they chose on a previous page. You would not need to get consent for this type of activity.”
16. Getting the user’s consent
17. Method #1 – The ‘lazy’ link -Pros - Not at all distracting to the user. - Most users won’t think to click it – very few will opt out. -Cons - Strictly speaking it doesn’t really comply; it gives the information, but doesn’t gain consent. On saying that nobody using this method has been contested (yet). - Was fine in the grace period; probably not anymore. e.g. Amazon.co.uk
18. Method #2 – The implied consent popup -Pros - ‘implied consent’ means that the majority of people will just click ‘ok’. - Assuming people can see it, it complies with the law. -Cons - Needs to be designed well; don’t confuse the user. - Is a bit annoying. e.g. ATGtickets.co.uk
19. Method #3 – The opt-in popup -Pros - Absolute, most certain route to comply with the law. -Cons - Users may just click ‘no thanks’ without reading the notification. - Disabling performance and functionality cookies can cause problems. - In most instances this isn’t needed. e.g. BT.co.uk
20. And the winner is… Method #2 – The implied consent popup
21. Why implied consent? - Your clients might question whether implied consent is within the law… - If they do, cite that: “Implied consent has always been a reasonable proposition in the context of data protection law and privacy regulation and it remains so in the context of cookies and similar devices… Implied consent is certainly a valid form of consent but those who seek to rely on it should not see it as an easy way out or use the term as a euphemism for “doing nothing”. If the user is not informed so in the context of the Regulations, this is not valid consent.”
22. Why not opt-in? - Some clients may still want to go down the opt in route… Don’t let them! - Research from E-consultancy found that… - Implied consent = 0.1% of users disable cookies. - Opt-in = 43% of users disable cookies. - Your UX and digital strategy teams need performance cookies to do their thing, and provide a meaningful service to your clients; 43% disabled would be bad news.
23. What if all of your clients used opt-in? Digital strategy
24. Presenting the notification
25. - Display as an accordion (not a pop-up window), at the bottom of the browser window. The notification should… - We should use human-readable, on-brand copy. - Use implied consent (not ‘agree or disagree’) - Be positioned as a positive, privacy update because we care. Not legal jargon. - Link to the cookies policy. - Display clearly, but only once. The notification displaying illustrates implied consent.
26. Here’s an example… Agree close
27. What to tell your clients… - Conduct a cookies audit, and update the site’s cookies policy. - Ensure that the information in the cookies policy complies to ICO guidelines. - Design and implement an appropriate cookies notification.
28. Further reading… 1) Official guidelines from the ICO: http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications /the_guide/cookies.aspx 2) Compliance e-book by data agency ‘silk tide’ http://silktide.com/templatefiles/EU%20Cookie%20Law%20eBook.pdf 3) Econsultancy research http://econsultancy.com/uk/blog/10116-43-of-users-refuse-cookies-if-asked-to- opt-in 4) Presentation by Martin Hoskins (Chairman of the data protection forum) http://data.marketingweek.co.uk/Assets/UserData/mwl2012/presentations/Data% 20Strategy_DMS7_Martin%20Hoskins.pdf
29. Thanks for listening