New rules governing the use of internet cookies and other similar technologies have come into force following the Irish transposition of an EU Directive.1 The new Irish Regulations take effect from 1 July 2011 and require that website operators obtain "opt-in" consent before placing cookies on a user's computer or mobile phone. A key issue now facing businesses operating websites in Ireland is how they can obtain opt-in user consent while causing minimum impact to the user experience and without having to drastically reform their websites.
Cookies are small files which are downloaded from a website and stored on a user's computer or mobile phone allowing the website to recognise the user's device and hence enabling the website to provide a more customised and a smoother user interface. As well as facilitating user experience cookies are increasingly being used as a means to collect information on users for the purposes of targeted advertising.
Prior to the introduction of the Regulations, Irish website operators were permitted to use cookies once they provided users with the right to "opt-out" of the use of cookies. In practice this could be achieved by advising users by means of the website's privacy policy that the website used cookies and providing them with information on how they could opt-out of the use of cookies using their internet browser options.
Under the new rules, website operators must obtain "opt-in" user consent before placing a cookie on a user's computer. In addition, the new rules require that users consent to the use of cookies upfront having been given clear and comprehensive information about the purpose for which the cookies will be used. There is a limited exception to this, cookies that are strictly necessary to operate a transaction or service requested by the user are exempt from the rules, for example, where a user is storing items in an online shopping cart.
One of the key issues arising from the new rules is how this consent requirement may be achieved in a pragmatic way. The Office of the Data Protection Commissioner (ODPC) has published a guidance note on the Regulations which suggests that advance consent may be achieved by the appropriate use of browser settings. It is clear however that the fact that a user has allowed the use of cookies as a result of default settings in its internet browser will no longer be sufficient under the new rules. Indeed the ODPC has acknowledged that, in their present form, most browser settings are not sophisticated enough to allow website operators to assume that a user has given the required consent. This may present an opportunity for browser manufacturers to solve the problem. Further suggestions for compliance include the use of pop-up boxes and/or setting-led consents, whereby the user can have its preferences for the website adopted.
In light of the above website operators will need to assess their use of cookies and to consider whether and how they will need to amend their practices in order to avoid falling foul of the Regulations. The practical steps required to ensure compliance will depend on the manner in which the website is operated, the nature of the services being provided and the use for which the cookies are employed.
Footnotes
1. Directive 2009/136/EC.
Disclaimer
This information is for guidance purposes only. It does not constitute legal or professional advice. Professional or legal advice should be obtained before taking or refraining from any action as a result of the contents of this publication. No liability is accepted by Eversheds O'Donnell Sweeney for any action taken in reliance on the information contained herein. Any and all information is subject to change. Eversheds O'Donnell Sweeney is not responsible for the contents of any other website or third party material which can be accessed through this website.
Eversheds O'Donnell Sweeney is an Irish partnership and a member firm of the Eversheds International network of firms affiliated with Eversheds International Limited, an English company limited by guarantee. Member firms of Eversheds International are independent firms and members of Eversheds International Limited, but have no authority to obligate or bind Eversheds International Limited or one another vis-à-vis third parties. Neither Eversheds International Limited nor any of its member firms have any liability for each other's acts or omissions.
