Last year, the European Union published a Citizens' Rights Directive amending the 2002 Privacy and Electronic Communications Directive. The upshot of the change – which must be brought into each country's laws by May 2011 – was that storing and accessing information on users' computers was only lawful where the user has given their prior consent and has been provided with clear and comprehensive information about the purposes for the processing. This provision was effectively an opt-in requirement for cookies, rather than the current opt-out regime. Cookies are small files that sit on a user's computer to help the website recognise them. They can be used to help a user save time while on web sites, or to enable advertising networks to send them targeted advertising.
There was an exception for cookies that were strictly necessary for a service requested by a user, and this would cover a cookie helping the user to navigate around a site to do what they want quickly. Advertisers thought that consent could be implied by browsers being set so as to not block cookies. However, the Article 29 Working Party has now published an opinion saying that the advertisers' view is not correct. Consent must be express rather than implied. However, consent would not be necessary for every cookie – it would be enough for users to provide their consent once a year to an advertising network covering that network's supply of adverts for all sites covered by their network.
For the Working Party's opinion in full, please click here: http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2010/wp171_en.pdf.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.