Life without cookies, is it worth it?
A look at the EU Privacy and Electronic Communications Directive
On the 26th May this year the EU Privacy and Electronic Communications Directive comes into play. If you're not sure how it will affect your website's interaction with visitors you can join the rest of the world, including those who put forward the directive.
What is this directive?
The aim of the directive is to help protect the privacy of online users by forcing websites to be transparent about how they store and use visitor information, as well as making any such storage opt-in as opposed to opt-out.
Cookies are a very common mechanism websites use to store visitor information. As the law stands (pre the 26th May) websites only need to inform users how they use cookies and how visitors can opt out, but moving forward they will be forced to ask a user to opt in before they can use cookies to store their information.
Does it apply to me?
If you run a website that targets visitors in EU member states then the directive potentially applies to you, even if your website is hosted elsewhere in the world.
If your website has web analytics, supports for members signing in, or has any form of e-commerce then it almost certainly does. In all likelihood your website uses cookies; if you're a Getme client it does.
What happens if I don't comply?
The maximum penalty for non-compliance is £500,000. However, monetary fines are aimed at websites that deliberately contravene the directive, causing substantial damage or distress. In the majority of cases it is likely website operators will receive an information/enforcement notice providing a list of actions to take in order to comply.
I'm using cookies, so I'd better comply?
You'd think so, but it turns out some cookies are exempt - so called 'essential' cookies. These are cookies used to support for functionality such as a shopping basket that wouldn't work without cookies.
Are web analytics 'essential'?
This is where things get murky. If you've used Google Analytics before you'll know that it allows you to track visitor behaviour on your website, which it does using cookies. Most websites use some form of web analytics to allow them to monitor visitor trends so that they can evolve and improve the user experience. It's not entirely clear from the EU directive whether or not you need to obtain permission from visitors to gather such demographic information. Furthermore, the UK Government Digital Service (GDS) department's position appears to be that web analytics are 'essential' and have stated that:
"Provided clear information is given about their activities we are unlikely to prioritise first-party cookies used only for analytical purposes in any consideration of regulatory action."
Do I need to do anything?
Unless the UK government changes their viewpoint it looks likely that using cookies for web analytics is safe for now, for websites targeting UK visitors. That doesn't mean you shouldn't do anything. The first step is to audit your website; determine if any of the cookies it stores for visitors are non-essential. If the only non-essential cookies you're using are for web analytics then at this point it would be a good idea to review your website's privacy policy and make sure it;
- clearly explains how you use visitor information stored in cookies,
- provides an easy opt-out facility.
For Getme clients, if you'd like some assistance in getting your privacy policy updated, or if you simply want to talk through the directive and its implications in more detail, please get in touch.