Feeds

99% of UK gov websites are breaking the law

Most have no idea how much they are violating

Secure remote control for conventional and virtual desktops

Most public sector organisations do not ask internet users' consent to cookie tracking, a survey has said.

The UK's Privacy and Electronic Communications (Amendment) Regulations implement changes to EU law and were brought into effect in May. The new law requires website operators to make sure they have "informed consent" from users for the use of cookies.

Cookies are small text files that websites store on users' computers. The files contain information about users' online activity.

Only six out of 603 public sector websites audited were found to be compliant with the regulations, the report by the Society for Local Authority IT Managers (Socitm) said. Socitm is an independent organisation funded through the membership of local government IT workers.

Martin Greenwood, Socitm Insight programme manager, said: "We audited about 600 local public sector websites including all local authorities and police, fire and housing websites and a few others and had a look to see how many cookies are on the sites," Greenwood said.

Socitm's research, which was conducted using special automated search technology operated by Cookie Reports Ltd, found that on average English county council websites had 186 cookies, while Scottish council sites had 86, Greenwood said. He said that organisations grossly underestimated the number of cookies that their websites use.

"We found that there are far more cookies on these sites than those organisations thought. We did not know what the size of the problem would be before hand so we asked organisations how many cookies they thought they had and the best guess was 19 per cent of the actual total," Greenwood said.

The UK's privacy watchdog, the Information Commissioner's Office (ICO), which is charged with ensuring organisations comply with the new cookie regulations, has previously said organisations were being given a year to find ways to obtain "informed consent" from users to cookie-use before it will properly enforce the regulations. It has the power to issue fines of up to £500,000 for serious breaches of the laws.

The ICO has previously issued guidance on how websites can comply with the new cookie laws. It said that websites can obtain consent through a number of methods, including asking users to consent through screen prompts. Less obstructive methods, such as obtaining consent from websites' terms and conditions or users' preference settings were also deemed appropriate by the ICO.

A spokesperson for the ICO told OUT-LAW that it was up to individual organisations to work out which technical method is best suitable for obtaining users' consent.

"By next May we expect businesses and organisations to have clear information about the way in which cookies are operating on their websites and to be obtaining consent to set those cookies," an ICO statement said.

"Exactly how far each organisation will need to go in getting consent will depend on exactly what the purpose of the cookie is. Certainly, having widely available and easily understood information that is relevant to users is fundamental. Our work on helping people to comply with the new rules is ongoing. We have published initial advice but we never intended that would be the end of it. We are very interested in how businesses and organisations are working towards solutions," the statement said.

Socitm's Greenwood said that organisations have quite a lot to do before they comply with the UK regulations but that it was "realistic" that they can be in a position of compliance by May next year. Socitm will send a report detailing its findings to all the public sector website operators it audited along with a guide on options for inform the public about cookies, Greenwood said. Website operators will have to pay Socitm for information on the exact location of the cookies Socitm found.

The government is working with Mozilla, Apple, Microsoft, Google, Yahoo, Adobe and the Internet Advertising Bureau to deliver an efficient technological solution to obtaining users' consent, the Department for Culture, Media and Sport (DCMS) told OUT-LAW in May.

In June, the European Commission set a deadline for European companies to create a uniform way for web users to opt out of being tracked by cookies within a year. The Commission has said it will take action if industry does not standardise opt-outs in that time.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Scrapping the Human Rights Act: What about privacy and freedom of expression?
Justice minister's attack to destroy ability to challenge state
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Hey Brit taxpayers. You just spent £4m on Central London ‘innovation playground’
Catapult me a Mojito, I feel an Digital Innovation coming on
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
EU probes Google’s Android omerta again: Talk now, or else
Spill those Android secrets, or we’ll fine you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.