Comments on: UK websites can assume implied consent over EU cookie legislation

By: Karl Craig-West

Karl Craig-West — Fri, 01 Jun 2012 18:54:00 +0000

I rest my case!!!
I knew that the ICO knew that this Euro legislation (which many believe is only a swipe at Google anyway) was going to be totally unenforceable.
Viva Common Sense!!!

By: chronicler_Isiah

chronicler_Isiah — Tue, 29 May 2012 14:06:00 +0000

I don’t think anyone was ‘confused’ by Chris’ post exactly – merely that it wasn’t properly followiing the letter of the directive. Whatever folks think the law is is a different proposition entirely from what the words actually tell us.

As it is the ICO seems to have changed its own mind on this, as implied consent was quite clearly (at that time) NOT a way to meet full compliance:

“At present evidence demonstrates that general awareness of the functions and uses of cookies is simply not high enough for websites to look to rely entirely in the first instance on implied consent.” [- from the ICO Version 2, 13 December 2011 guide.]

By: Paul Morriss

Paul Morriss — Mon, 28 May 2012 14:32:00 +0000

I don’t agree with the Guardian’s analysis. In the quote that jaz_design gives it says “…you need to be satisfied…”. So the onus is on the website owner to make a judgement about the technical level of the user, and the wording you’ve used. It means that if you use implied consent you can’t be sure that you’d be OK, because the ICO might disagree with your judgement. So you can do something and you’re probably OK, but if you really want to be sure you have to go for explicit consent, i.e. annoying popup.

By: jaz_design

jaz_design — Mon, 28 May 2012 13:14:00 +0000

The ICO actually posted on Friday to confirm the implied consent thing – http://www.ico.gov.uk/news/blog/2012/updated-ico-advice-guidance-e-privacy-directive-eu-cookie-law.aspx

“Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies. If you are relying on implied consent you need to be satisfied
that your users understand that their actions will result in cookies
being set. Without this understanding you do not have their informed
consent. You should not rely on the fact that users might have read a
privacy policy that is perhaps hard to find or difficult to understand.”

There’s a PDF on that link as well which outlines it somewhat better than it did before. :)