Longer Reads

Don’t let your cookie compliance crumble

Once regarded as an afterthought by website operators, cookies are being pushed up the risk agenda of businesses across the world, including in the UK.

2 minute read

Published 15 August 2022

Authors

Share

Key information

The price of getting cookie compliance wrong can be costly: in early 2022, for instance, Google and Facebook were together fined over €200 million by the French data protection regulator for cookie-related infringements.

Collyer Bristow offers a free service to let you know whether or not your website’s existing cookie policies and banners are compliant with the latest requirements under UK laws. To find out more, please email comply@collyerbristow.com.

What are cookies?

Cookies are small text files made up of letters and numbers, and which are downloaded onto the devices of visitors to a website. They enable the website to remember information regarding those visitors’ activities on the site (such as remembering the contents of shopping baskets or identifying a visitor who has navigated to the site previously). They are also commonly used to target advertising at website visitors depending on browsing history or other preferences.

What are the essential cookie requirements to be aware of?

The law on cookies as it stands in the UK currently derives from 2011 amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Under PECR, a website may only automatically place onto users’ devices cookies that are ‘strictly necessary’ – this means those cookies that are essential for that website’s core functionality. Any other cookies can only be set if a website user gives consent, which must be freely given and easy to withdraw.

Many cookies commonly set by websites (such as analytics or tracking cookies, social media plug-ins, and advertising cookies) will therefore need a user’s consent before they can be set onto that user’s device. Once that consent has been obtained, the user must be able at any time to withdraw that consent as easily as it was given. This means that pre-ticked boxes or sliders defaulted to ‘on’ in respect of non-essential cookies, pop-up banners that imply consent is given if visitors continue to browse, or ‘cookie walls’ requiring visitors to agree certain cookie settings before they can access content will likely not be compliant.

The UK’s regulator on cookie practices, the Information Commissioner’s Office (ICO), additionally takes a dim view of ‘nudging’ techniques where, for example, an ‘accept all cookies’ button is much larger or brighter than one that allows visitors to reject certain cookies.

What are the consequences of not meeting these requirements?

If the ICO becomes aware of a breach of PECR, it can impose a fine of up to £500,000 against the organisation in breach or its directors. Breaches of PECR can also result in criminal prosecution, non-criminal enforcement, and audits.

On top of this, failure to meet applicable data protection requirements could contravene the EU General Data Protection Regulation (EU GDPR) and its UK equivalent, the UK GDPR. Many commonly-used tools that are reliant on cookies and other tracking technologies commonly are offered by US-based companies, which means personally identifiable data of website users in the UK and EU (such as their IP addresses) could be sent to the US. If the complex rules on transfers from the UK and the EU to the US (as mandated under the UK GDPR and EU GDPR) are not met, then this carries a risk of a fine of up to 4% of worldwide turnover or £17.5m/€20m (whichever is greater) by each relevant data protection regulator.

It is worth noting that cookie compliance has moved up the enforcement agenda for regulators in the UK and the EU. In late 2020 CNIL, for example, the French privacy watchdog fined the supermarket chain Carrefour and its banking division over €3 million for failing to obtain users’ consent before setting advertising cookies.

Private individuals are also becoming more savvy about developments in this area and taking action against website operators. For example, the European Centre for Digital Rights (headed by Max Schrems – famous in the data protection world as the name behind some of the most important recent court actions) is investigating cookie banner implementation. In March 2022, the Centre launched a second round of action against deceptive cookie banners, targeting 270 organisations.

While the UK government has recently announced proposals to reduce the burden of cookie compliance (for example, by moving to a one-time ‘opt out’ model whereby cookies may be stored without users having to provide consent each time they access a website), these are still under review, and several interest groups have raised concerns with this approach over fears that it may open the door to easier ‘digital spying’. Opposition politicians have also signalled that their preference is for the UK’s data protection regime to remain closely aligned with the EU’s in order to reduce the risk of the EU withdrawing its decision of ‘adequacy’ in respect of the UK’s data protection framework, which currently allows for the free flow of personal data between the UK and the EU.

How can I find out if my website’s cookie policy and banner are compliant?

Collyer Bristow offers a free service to let you know whether or not your website’s existing cookie policies and banners are compliant with the latest requirements under UK laws. To find out more, please get email us at comply@collyerbristow.com.

This article is for general awareness only and does not constitute legal or professional advice. The law may have changed since this page was first published.

Related latest updates
PREV NEXT

Related content

Arrow Back to Insights

Longer Reads

Don’t let your cookie compliance crumble

Once regarded as an afterthought by website operators, cookies are being pushed up the risk agenda of businesses across the world, including in the UK.

Published 15 August 2022

Associated sectors / services

  • Data Protection

Authors

The price of getting cookie compliance wrong can be costly: in early 2022, for instance, Google and Facebook were together fined over €200 million by the French data protection regulator for cookie-related infringements.

Collyer Bristow offers a free service to let you know whether or not your website’s existing cookie policies and banners are compliant with the latest requirements under UK laws. To find out more, please email comply@collyerbristow.com.

What are cookies?

Cookies are small text files made up of letters and numbers, and which are downloaded onto the devices of visitors to a website. They enable the website to remember information regarding those visitors’ activities on the site (such as remembering the contents of shopping baskets or identifying a visitor who has navigated to the site previously). They are also commonly used to target advertising at website visitors depending on browsing history or other preferences.

What are the essential cookie requirements to be aware of?

The law on cookies as it stands in the UK currently derives from 2011 amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Under PECR, a website may only automatically place onto users’ devices cookies that are ‘strictly necessary’ – this means those cookies that are essential for that website’s core functionality. Any other cookies can only be set if a website user gives consent, which must be freely given and easy to withdraw.

Many cookies commonly set by websites (such as analytics or tracking cookies, social media plug-ins, and advertising cookies) will therefore need a user’s consent before they can be set onto that user’s device. Once that consent has been obtained, the user must be able at any time to withdraw that consent as easily as it was given. This means that pre-ticked boxes or sliders defaulted to ‘on’ in respect of non-essential cookies, pop-up banners that imply consent is given if visitors continue to browse, or ‘cookie walls’ requiring visitors to agree certain cookie settings before they can access content will likely not be compliant.

The UK’s regulator on cookie practices, the Information Commissioner’s Office (ICO), additionally takes a dim view of ‘nudging’ techniques where, for example, an ‘accept all cookies’ button is much larger or brighter than one that allows visitors to reject certain cookies.

What are the consequences of not meeting these requirements?

If the ICO becomes aware of a breach of PECR, it can impose a fine of up to £500,000 against the organisation in breach or its directors. Breaches of PECR can also result in criminal prosecution, non-criminal enforcement, and audits.

On top of this, failure to meet applicable data protection requirements could contravene the EU General Data Protection Regulation (EU GDPR) and its UK equivalent, the UK GDPR. Many commonly-used tools that are reliant on cookies and other tracking technologies commonly are offered by US-based companies, which means personally identifiable data of website users in the UK and EU (such as their IP addresses) could be sent to the US. If the complex rules on transfers from the UK and the EU to the US (as mandated under the UK GDPR and EU GDPR) are not met, then this carries a risk of a fine of up to 4% of worldwide turnover or £17.5m/€20m (whichever is greater) by each relevant data protection regulator.

It is worth noting that cookie compliance has moved up the enforcement agenda for regulators in the UK and the EU. In late 2020 CNIL, for example, the French privacy watchdog fined the supermarket chain Carrefour and its banking division over €3 million for failing to obtain users’ consent before setting advertising cookies.

Private individuals are also becoming more savvy about developments in this area and taking action against website operators. For example, the European Centre for Digital Rights (headed by Max Schrems – famous in the data protection world as the name behind some of the most important recent court actions) is investigating cookie banner implementation. In March 2022, the Centre launched a second round of action against deceptive cookie banners, targeting 270 organisations.

While the UK government has recently announced proposals to reduce the burden of cookie compliance (for example, by moving to a one-time ‘opt out’ model whereby cookies may be stored without users having to provide consent each time they access a website), these are still under review, and several interest groups have raised concerns with this approach over fears that it may open the door to easier ‘digital spying’. Opposition politicians have also signalled that their preference is for the UK’s data protection regime to remain closely aligned with the EU’s in order to reduce the risk of the EU withdrawing its decision of ‘adequacy’ in respect of the UK’s data protection framework, which currently allows for the free flow of personal data between the UK and the EU.

How can I find out if my website’s cookie policy and banner are compliant?

Collyer Bristow offers a free service to let you know whether or not your website’s existing cookie policies and banners are compliant with the latest requirements under UK laws. To find out more, please get email us at comply@collyerbristow.com.

This article is for general awareness only and does not constitute legal or professional advice. The law may have changed since this page was first published.

Associated sectors / services

  • Data Protection

Authors

Need some more information? Make an enquiry below.

    Subscribe

    Please add your details and your areas of interest below

    Specialist sectors:

    Legal services:

    Other information:

    Jurisdictions of interest to you (other than UK):



    Article contributors

    Enjoy reading our articles? why not subscribe to notifications so you’ll never miss one?

    Subscribe to our articles

    Message us on WhatsApp (calling not available)

    Please note that Collyer Bristow provides this service during office hours for general information and enquiries only and that no legal or other professional advice will be provided over the WhatsApp platform. Please also note that if you choose to use this platform your personal data is likely to be processed outside the UK and EEA, including in the US. Appropriate legal or other professional opinion should be taken before taking or omitting to take any action in respect of any specific problem. Collyer Bristow LLP accepts no liability for any loss or damage which may arise from reliance on information provided. All information will be deleted immediately upon completion of a conversation.

    I accept Close

    Close
    Scroll up

    Find out about Business

    Find out about Dispute Resolution

    Find out about Individuals & Families

    Find out about Real Estate

    We are Collyer Bristow - The law firm for those that
    value individuality, creativity and collaboration.

    Legal & Pricing info Regulatory InformationAccessibilitySitemapPricing and service information

    Listen to our latest podcast: BHS Judgment #2 – Trading Misfeasance

    Listen to our latest podcast: BHS Judgment #1 – Wrongful trading

    Read our latest article: Sexual Harassment & the risk of relying on workplace ‘banter’ to defend a claim

    Listen to our latest podcast: No notice, no claim? (Drax v Scottish Power)

    Read our latest article: Election 2024: Domicile, Inheritance Tax, and change promised by the new Labour government

    ExpandNeed some help?Toggle

    < Back to menu

    I have an issue and need your help

    Scroll to see our A-Z list of expertise

    Get in touch

    Get in touch using our form below.



      Business Close
      Private Wealth Close
      Hot Topics Close