UK information regulator turns cookie heat up a notch
The Information Commissioner’s Office (ICO), the UK data regulator, has updated its views on use of cookies – and it is much stricter around consent and what can and cannot be assumed (Digiday).
Key points
- The ICO warned last month that behavioural advertising is breaking the law
- New update published alongside ‘mythbuster’ to clarify what publishers and advertisers can and cannot do around ‘non-essential’ cookies
- Implied consent is out
- Pre-ticked boxes are out
- Users must have control over any non-essential cookies
- Analytics cookies require consent
- Cookie walls are out, i.e. ‘by continuing to use this website you are agreeing to cookies’ no longer holds
- Legitimate interest cannot be relied upon for marketing and advertising cookies
“Cookie compliance will be an increasing regulatory priority for the ICO in the future,” wrote Ali Shah, the watchdog’s head of technology policy. Marketers and publishers have been warned, at least those with audiences in the UK.
The ICO says its enforcement will be “proportionate” and it is unlikely to take anyone to the cleaners just yet – because virtually the entire industry is non-compliant according to its latest definitions. But the update, and the advice from the regulator is clear and the threat implicit: “Start working towards compliance now - undertake a cookie audit, document your decisions, and you will have nothing to fear.”
