Feeds

99% of UK gov websites are breaking the law

Most have no idea how much they are violating

The essential guide to IT transformation

Most public sector organisations do not ask internet users' consent to cookie tracking, a survey has said.

The UK's Privacy and Electronic Communications (Amendment) Regulations implement changes to EU law and were brought into effect in May. The new law requires website operators to make sure they have "informed consent" from users for the use of cookies.

Cookies are small text files that websites store on users' computers. The files contain information about users' online activity.

Only six out of 603 public sector websites audited were found to be compliant with the regulations, the report by the Society for Local Authority IT Managers (Socitm) said. Socitm is an independent organisation funded through the membership of local government IT workers.

Martin Greenwood, Socitm Insight programme manager, said: "We audited about 600 local public sector websites including all local authorities and police, fire and housing websites and a few others and had a look to see how many cookies are on the sites," Greenwood said.

Socitm's research, which was conducted using special automated search technology operated by Cookie Reports Ltd, found that on average English county council websites had 186 cookies, while Scottish council sites had 86, Greenwood said. He said that organisations grossly underestimated the number of cookies that their websites use.

"We found that there are far more cookies on these sites than those organisations thought. We did not know what the size of the problem would be before hand so we asked organisations how many cookies they thought they had and the best guess was 19 per cent of the actual total," Greenwood said.

The UK's privacy watchdog, the Information Commissioner's Office (ICO), which is charged with ensuring organisations comply with the new cookie regulations, has previously said organisations were being given a year to find ways to obtain "informed consent" from users to cookie-use before it will properly enforce the regulations. It has the power to issue fines of up to £500,000 for serious breaches of the laws.

The ICO has previously issued guidance on how websites can comply with the new cookie laws. It said that websites can obtain consent through a number of methods, including asking users to consent through screen prompts. Less obstructive methods, such as obtaining consent from websites' terms and conditions or users' preference settings were also deemed appropriate by the ICO.

A spokesperson for the ICO told OUT-LAW that it was up to individual organisations to work out which technical method is best suitable for obtaining users' consent.

"By next May we expect businesses and organisations to have clear information about the way in which cookies are operating on their websites and to be obtaining consent to set those cookies," an ICO statement said.

"Exactly how far each organisation will need to go in getting consent will depend on exactly what the purpose of the cookie is. Certainly, having widely available and easily understood information that is relevant to users is fundamental. Our work on helping people to comply with the new rules is ongoing. We have published initial advice but we never intended that would be the end of it. We are very interested in how businesses and organisations are working towards solutions," the statement said.

Socitm's Greenwood said that organisations have quite a lot to do before they comply with the UK regulations but that it was "realistic" that they can be in a position of compliance by May next year. Socitm will send a report detailing its findings to all the public sector website operators it audited along with a guide on options for inform the public about cookies, Greenwood said. Website operators will have to pay Socitm for information on the exact location of the cookies Socitm found.

The government is working with Mozilla, Apple, Microsoft, Google, Yahoo, Adobe and the Internet Advertising Bureau to deliver an efficient technological solution to obtaining users' consent, the Department for Culture, Media and Sport (DCMS) told OUT-LAW in May.

In June, the European Commission set a deadline for European companies to create a uniform way for web users to opt out of being tracked by cookies within a year. The Commission has said it will take action if industry does not standardise opt-outs in that time.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Build a business case: developing custom apps

More from The Register

next story
Super Cali signs a kill-switch, campaigners say it's atrocious
Remote-death button bad news for crooks, protesters – and great news for hackers?
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.