Government Digital Services give their take on EU Cookie Law
Posted by: Jay Rock
The Government Digital Services team recently hosted a meeting of government website managers, developers, policy advisers and communications experts to discuss a range of issues including the EU Cookie legislations. The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 actually came into effect last year and deals with the issue of privacy and cookie use on UK websites. The law will impact nearly all of UK websites and a years grace period was given to allow website owners to make and required amendments. That years grace is nearly ended and many have been looking to the government for guidance on this issue.
In a blog post titled "it's not about cookies, it's about privacy", the GDS explained that while they did not get hung up on cookies, they did talk about the experiences auditing their website cookies and how to correctly classify them in terms of privacy intrusiveness (i.e. "moderately intrusive", "minimally intrusive" or "exempt from changes to privacy legislation")
"Inevitably, analytics and the vital role analytics-related cookies play in allowing public sector websites to be held to account on the cost-effectiveness of the way we deliver government information and services came up. Even more importantly, analytics are essential to our "continual improvement" approach to developing digital public services, which is critical to delivering the government's digital by default agenda."
"The consensus was, especially in the case of first-party analytics cookies, these types of cookies are “minimally intrusive” (in line with the ICO guidance) and that the bulk of our efforts to rationalise our use of cookies should be focused on cookies classified as moderately intrusive."
Quoted from Government Digital Service blog post - it's not about cookies, it's about privacy
Interestingly the discussion also covered alternatives to cookie based analytics including device fingerprinting and javascript tagging. It was felt that the alternatives were potentially more privacy intrusive and harder for users to block.
The GDS have also released an Implementer Guide which includes recommendations for website owners. The guide does highlight part of the ICO guidance which states that "it is highly unlikely that priority for any formal action would be given to focusing on uses of cookies where there is a low level of intrusiveness and risk of harm to individuals. Provided clear information is given about their activities we are unlikely to prioritise first-party cookies used only for analytical purposes in any consideration of regulatory action."
With this in mind we recommend that as a minimum website owners should add a cookie policy page to their websites. Good examples can be found below:
https://www.gov.uk/help/cookies
http://www.consumerfocus.org.uk/cookies
About: Jay Rock
A key part of the highly-skilled programming team at J&L, Web Developer Jay brings real value to client digital projects through his in-depth knowledge of technologies such as PHP and JavaScript.
