This post is second in a two-part series.

Yesterday my post discussed the upcoming EU regulations and advice on what websites must do to comply with the new EU regulations concerning the use of cookies.

The guidance from the ICO offers different approaches to obtaining the needed consent. But again, the advice falls short of detailing what needs to be done. “You are best placed to work out how to get information to your users, what they will understand and how they would like to show that they consent to what you intend to do.”

Some suggestions include:

· Using Pop ups and similar techniques

· Using “Terms and conditions”

· Settings-led consent

· Feature-led consent

· Functional uses

No advice however is provided to mitigate the degradation in user experience. Those who reject cookies would suffer most. As there will be no mechanism to track them, they would be prompted to opt in/out each time they return to a site. This on its own is likely to lead most customers to (eventually) opt in for the sake of their sanity, or never come back to the site.

The catch-22 is also not addressed: if you need a user’s consent before using cookies, you need to remember this choice when they make it. And the only way for a website to do this is by using cookies.

The ICO says, “We will be keeping the situation under review and will consider issuing more detailed advice if appropriate in future. However, we do not intend to issue prescriptive lists on how to comply.”

Third party cookies

The most controversial area of the guidelines cover so-called “3rd party cookies” – cookies placed on a user’s computer typically by advertisers on a site. Almost all ad-supported sites use third party cookies.

Again, the guidance is vague: “…we would advise anyone whose website allows or uses third party cookies to make sure that they are doing everything they can to get the right information to users and that they are allowing users to make informed choices.”

But while they are unable to say how site owners should implement this, nor what “right information” they are required to pass on to users in order to be in compliance with the ICO’s advice, the industry’s trade association has some advice of their own.

Nick Stringer, Director of Regulatory Affairs for the Internet Advertising Bureau, said that the industry’s self-regulatory framework, which had been signed by 50 companies across Europe, had been accepted by the U.K. government to be in compliance with the new EU legislation.

Mr. Stringer said that the system allows for an icon to appear on advertisements. Clicking that icon on the ad would give the user the information required by the legislation.

What should you do?

Modifying your websites to adopt one or more of the ICO’s suggestions can be a daunting task, especially for websites with voluminous pages, multi-country and multi-language deployments. A sophisticated Web Content Management system would help in this process, ensuring that regardless of site structure or dynamic content refreshes, pages served up to the visitor would be in compliance. But implementing these changes will take time – and most sites will probably not be in compliance by the May 26^th deadline.

Not that you have to worry about it just yet. “The ICO will be issuing separate guidance on how we intend to enforce these Regulations.” The ICO has restated its intention not to take action against companies that fail to comply. Instead, it plans to investigate sites only after a complaint has been received, and even then it will only ask them to show that they have a “realistic plan to achieve compliance”.

So the practical advice is this: evaluate your site(s), pick the best approach to bring it into compliance with the new directive without overly affecting the customer experience, and then establish a plan to implement those changes. You may not be ready by the 26^th, but if you have a plan, you should be ok.

This post is first in a two-part series.

Do you worry about your privacy when you do things online? Are you concerned information about your online activities can be obtained by third parties other than the website with whom you are interacting? You are not alone. Your online privacy has of late also been the concern of legislators around the globe.

In the U.S., a new bill aims to increase privacy protection from police and other law enforcement agencies. Congress took the first major step this week toward updating a 1986 law, crafted in the pre-Internet era, to protect the privacy of Americans who use mobile phones; web email; and services like Google Docs, Flickr, and Picasa. Sen. Patrick Leahy’s (D-Vt.) proposal, called the Electronic Communications Privacy Act Amendments Act of 2011, introduced sweeping legislation that would control how police and other government agencies can access online data, such as your private communications or the location of your mobile devices.

And in Europe, they are approaching online privacy from another angle: protecting your privacy from the website you visit itself, or from other interested third parties. Dubbed the “Cookie Directive,” this amendment to the European Privacy and Electronic Communications Directive dictates that from May 26, 2011, “explicit consent” must be gathered from web users who are being tracked via text files called “cookies”.

Enacted in the fall of last year, the EU-wide directive however, left it to the individual countries to draw up the guidelines for how this directive will be enforced – understandably creating confusion leading up to next week’s deadline.

What is a cookie?

• A cookie is a little text file composed of alphanumeric characters, which is created on your computer when your browser accesses a website that uses cookies. The files are used to help your browser navigate the website and fully use all its features like logins, preferences, language settings and themes, among other common features. The cookie is used solely to help your browser process a website; it doesn’t collect any information from your computer or snoop on your files.
• Majority of websites and web applications today need cookies to function. As such, these websites will need to figure out a way to comply with this new directive without negatively affecting the user experience.
• More information about cookies can be found at www.allaboutcookies.org.

Finally, some guidelines! Or…

In the UK, the responsibility of drawing up guidelines falls to Information Commissioner’s Office (ICO) of the Department for Culture, Media and Sport. Last Monday, with just over two weeks to go, the ICO has finally given its advice on what websites must do to comply with the new EU regulations concerning the use of cookies. But the ICO advice is, as the Commissioner’s office admits “a work in progress.”

Unfortunately for website owners, work in progress leaves them uncertain as to how to move forward and what they need to do.

Can you rely on the browser to be in compliance?

Prior to last week’s advice, the ICO had talked about setting cookie approvals through browser settings, which would have saved businesses from having to make alterations to websites. However, the ICO has now said that browser settings are not sophisticated enough to make this work.

The guidance issued this week directly contradicts suggestions made by the government that anonymous browsing settings could be enough to satisfy the changed rules. It had said then that it will work with browser manufacturers to see if browser setting can be enhanced to meet the requirements of the revised directive.

However, as of now, consent through the browser does not constitute compliance with the new directive. From the ICO advice:

“In future many websites may well be able to rely on the user’s browser settings to demonstrate that they had the user’s agreement to set all sorts of cookies. We are aware that the government is working with the major browser manufacturers to establish which browser level solutions will be available and when. For now, though, you will need to consider other methods of getting user consent.”

So what now?

Tomorrow I will cover the impact of this decision and how it impacts your websites.