Our take on the EC Cookie Directive

Lots of fear, uncertainty and doubt about the EC Cookie Directive... and lots of wrong information out there, too. Here’s the only information you ought to read, direct from the ICO (it's a PDF).

Basically, in a nutshell, you can’t drop any cookie onto someone’s machine without asking first. No – letting the user opt-out isn’t acceptable. They must consent first.

Open “private browsing” or “incognito mode” on your browser, and visit bt.com to see apparently a “good way of doing it”. A pop-up DIV at the bottom-right of the screen, basically saying “if you go any further, we’ll drop cookies on your system, or you can control them all here if you want”.

A lot’s been written about the pointlessness of this EU law – not least “how can we remember if a user doesn’t want a cookie dropped on their machine without using, er, a cookie”. It will do nothing other than damage EU online businesses, and make websites really ugly.

So, here's what we do here on Media UK - five things:

1. We make it really clear when you log in that you are consenting to a cookie being put on your machine "that personally identifies you to us".

2. Make it really clear what other cookies we use on our website.

3. However, we do not ask for consent for those that do not contain personal information. Which includes Google Analytics, any advertising beacons, and even Google/Twitter/Facebook buttons. None of these contain personal information – merely anonymous information about all internet users who use your machine. (Unless, of course, you log into Twitter, Facebook etc). And we make this clear too in our cookie information.

4. Make it really clear in our cookie information how you can opt out of everything – by repeating the simplest advice of using “incognito” mode, or “private” mode, on your web browser: which removes cookies every time you invoke it, and automatically signs you out of everything when you close your browser.

5. Add a little note that we use cookies the first time you visit us.

The ICO is primarily concerned with personal information and personal data. The company that runs Media UK – Not At All bad Ltd - is registered under the Data Protection Act and take personal data very seriously. However, Google Analytics and AdSense cookies, etc, are anonymous, and will only ever contain personal information if you deliberately log in to Google services (and even then Google claims not to link Analytics or AdSense with your Google account anyway). The same goes for Twitter and Facebook too. And the ICO go out of their way to say, in their advice: Although the Information Commissioner cannot completely exclude the possibility of formal action in any area, it is highly unlikely that priority for any formal action would be given to focusing on uses of cookies where there is a low level of intrusiveness and risk of harm to individuals. Provided clear information is given about their activities we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action.

We believe this is the right way of doing it. But do get in touch if you think we can do it better.