…cookies are small, often encrypted text files, located in browser directories. They are used by web developers to help users navigate their websites efficiently and perform certain functions. Due to their core role of enhancing/enabling usability or site processes, disabling cookies may prevent users from using certain websites.
In 2009 an EU directive was introduced requiring website owners to obtain consent for use of cookies and similar technologies. Governments in Europe were given until 25 May 2011 to implement these changes into their own law. The UK introduced the amendments on 25 May 2011 through The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011.
One problem with this was that current technologies make it virtually impossible for anything more than very basic websites to comply. Like most sites, the University’s website sets cookies as soon as a page is loaded, so it’s impossible to obtain prior consent from users; if a user opts to disallow our cookies, they need to know how to do this in their browser settings. In recognition of these difficulties, the Information Commissioner’s Office (ICO) gave UK websites a 12 month grace period in which to comply; work is also being carried out with web browser providers to ensure that browsers include easier options for control of cookies.
Initial response
When the new law was introduced there was much debate among web teams in the HE sector about how it should be implemented. Based on advice from sources such as JISC Legal and the Information Commissioner, most, including Essex, opted for a cautious approach. Actions we took included:
- a quick review of our use of cookies (a complete review wasn’t warranted, given that we were planning to launch a completely new website on new server infrastructure during the 12 month grace period);
- a review of our privacy policy, which is where most websites include information about their use of cookies; other than a few minor tweaks our policy did not require change as it already gave clear information about our use of cookies;
- regular monitoring of best practice, official guidance and discussion with other web teams.
Preparing for implementation
The Information Commissioner issued new guidance on 13 December 2011, to mark the halfway point between legislation and implementation.
According to this guidance, and updated advice from JISC Legal, we should take the following steps:
- “Check what type of cookies and similar technologies you use and how you use them.”
WaLT will be carrying out an audit of cookies issued by our websites. This will document what cookies we set, their purpose and the impact if users opt to reject them. - “Assess how intrusive your use of cookies is.”
Part of the audit assessment will categorise each cookie according to how intrusive it is. This will allow us to target any future efforts on achieving compliance most effectively. - “Where you need consent – decide what solution to obtain consent will be best in your circumstances.”
Best practice at present appears to be to provide users with clear information about how to disable cookies. It’s possible that this practice will shift, depending on further advice from ICO and when we see how ICO starts to enforce the new law, and we need to be prepared to respond as necessary. - “Improve the clarity, completeness and prominence of information about cookies which is provided to users of your websites.”
Our privacy policy compares well with the others in the sector with regards to cookie legislation. One action we should take is to review its prominence: rewording links to our policy will help with this, changing ‘privacy policy’ to ‘privacy and cookies policy’, or simply ‘privacy and cookies’; this is a measure that many in the sector are taking. When our cookie audit is complete, it would also be prudent to add an appendix listing details of the cookies we set.
Implications for University web authors
This is the bit you’re waiting for, isn’t it? How much work do we need to do?
Hopefully not too much. All corporate pages link to the privacy policy. Sub-sites should also link to the policy; if your site doesn’t then make sure you add the link. And if your site sets any additional cookies, you may need to consider further steps: reviewing whether you really need to set those extra cookies, and if so, creating a privacy policy that covers these uses. This shouldn’t affect most authors: if you’re setting extra cookies you probably already know. If you’re uncertain, or need advice, just contact WaLT.
Conclusion
In summary, WaLT have been closely monitoring developments in implementation of cookie law and the University has maintained a position of good practice since the law was passed. It remains unclear how ICO will start to enforce the law when the 12-month grace period expires in May 2012, but the best advice appears to be that if we follow the steps outlined here we will (a) place ourselves in the best position to respond as practices change, and (b) have established a record of acting in the best faith – a strategy highlighted in advice from ICO, JISC Legal and others as one of the best forms of protection against action.










































