Advertisers say new cookie law met by browser settings
Implied consent innit
Advertising trade bodies have claimed that a new law passed this week by the European Parliament will not require website publishers to ask permission to put cookies on a user's computer. They argue that browser settings will imply consent.
The now-adopted text says that cookies can be stored on a user's computer, or accessed from that computer, only if the user "has given his or her consent, having been provided with clear and comprehensive information". An exception exists where the cookie is "strictly necessary" for the provision of a service "explicitly requested" by the user.
"The ‘Telecom Package’ strengthens security and privacy for internet users. Crucially, the new law provides a solid legal basis for cookie management tools in browsers and other applications," said a statement from the bodies.
The privacy settings of most browsers can be adjusted by users to block or allow some or all cookies.
IAB Europe said that the 'preamble' to the law underlines its case. "The law now clarifies that websites can rely on browser controls and similar applications to define the acceptance of cookies," it said. "Publishers and online marketers support this approach because greater transparency, user-friendly information and easy cookies-management will increase consumer trust and confidence."
The preamble to the new law mentions browser settings. It states, in part: "Where it is technically possible and effective, in accordance with the relevant provisions of [the Data Protection Directive], the user's consent to processing may be expressed by using the appropriate settings of a browser or other application."
Technology lawyer Struan Robertson of Pinsent Masons, the law firm behind OUT-LAW.COM, said that IAB Europe’s interpretation is optimistic but attractive.
"It would be better for everyone if the IAB Europe's view is right," said Robertson. "It is a pragmatic way to interpret a very bad law that otherwise damages the user experience on websites."
To seek consent from users without relying on browser settings, websites might have to provide pop-up messages or landing pages that seek consent to the serving of cookies for purposes that were not “explicitly requested” by users, such as advertising or traffic analysis.
Robertson has previously called the new law "breathtakingly stupid" and said that companies may, in the end, interpret it in the same way as the IAB Europe in a bid to make commercial sense out of it.
"This law affects almost everybody who publishes a website. If everyone interprets the law in this way, the risk of action is low," he said. "Companies will be hoping that national governments and regulators share this interpretation."
IAB Europe's vice president Kimon Zorbas told OUT-LAW.COM that it believed that the European governing bodies had changed their mind about demanding explicit consent for cookie use before a website was used. He pointed out that a previous draft of the text had demanded "prior" consent, but that that had been changed.
A draft version of the law that was rejected in May proposed the following Article 5(3) :
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his/her prior consent, which may be given by way of using the appropriate settings of a browser or another application, after having been provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.
The text agreed by the Parliament today provides the following Article 5(3):
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
"The previous version said 'prior' and 'after having been provided' – so if they changed it, [they] clearly [meant] something else," said Zorbas. "We believe there is some consent required and that can be implicit consent. There's no reason to believe it's explicit consent."
Robertson said, though, that while the change in the text might imply that, IAB Europe's interpretation is vulnerable to challenge.
How many times does it need saying?
I have to say although I am not surprised the IAB are trying to spin these ammendments to 5(3) into something they are not; I am surprised that they have to be told by the Commission so many times that they are wrong.
I have heard Commissioner Reding state explicitly over and over again for the past month that these new rules require "prior informed consent". The Commission is quite clear on this and we have a guarantee from the Commission (via multiple public speeches made by Commissioner Reding) that they will not shy away from taking infringement action against Member States who fail to enforce EU Law (such as the current action against the UK for allowing BT and Phorm to intercept consumer's Internet communications).
Of course the advertising industry has been impotent for decades which is why they rely so heavily on Opt-Out models; so it is understandable that they might be a bit worried since they don't even have any confidence in their own business models to attract people to Opt-In.
What else is there to say other than don't trust the industry or the media to give unbiased coverage on this issue as they all share the same bed. The new rules are a victory for consumer privacy and this scares a lot of people with vast bank balances built from the collection and selling of our personal data.
And don't worry IAB, I am not going anywhere - see you in the ring.
IAB, who want to push advertising, interpret the new law meaning that nothing needs to change.
Well here's another interpretation. I think that, by visiting the Register, a cookie tracking my login details and, say, new preferences is essential the service being offered.
I do not feel that a third party tracking cookie is essential.
So, nothing needs to change in the provision between the 1st and 2nd party, but bolt ons that are not obvious or explicitly associated with the site I'm visiting (advertising and tracking cookies, for example) need my permission.
What's more, I'm pretty sure that my interpretation is closer to that intended than the IAB's.
Delete all cookies when the browser closes
... and run firefox with noscript.