ICO cookie laws cause confusion and indifference in the channel

Changes to cookie law regulations have led to confusion among SMBs, with channel players unconcerned by the Information Commissioner’s Office demands.

Following on from an EU directive last year concerning cookies used to track website visitors, the ICO has been pushing regulations which would ensure that individuals can opt out of tracking.

However, with many businesses and indeed the majority of government departments still not complying to the guidelines, there have been claims of a lack of clarity over website requirements.

According to a KPMG report this week, 45 out of 55 businesses looked at in the UK have not bothered with user consent for cookie despite the threat of a potential £500,000 fine.

This has not been helped by the ICO’s decision to ‘water-down’ the proposed regulations hours before they came into effect, further adding to confusion over the need to comply at all, with ‘implied consent’ now deemed adequate.   Furthermore, concerns over fines also evaporated as the ICO soon relaxed its stance with masses of firms unable to comply in time.

For those companies which invested in meeting the regulations before realising most of the country would not similarly meet requirements, it has meant that many feel money has been wasted.  Large organisations might easily be able to afford the changes to their sites to meet the guidelines, but for SMBs this can be more problematic.

One SMB, server hosting firm UKFast, highlighted in a statement the troubles that some have had with updating systems.

“It takes a significant amount of effort to put a system of full consent into place and it is far beyond the realms of most SMEs,”  said Neil Lathwood, technical director at UK Fast. “Those who have invested the time and money to set up pop-ups or banners have now been told that ‘implied consent’ is compliant with the law, making their well-meaning efforts pointless and probably costly.”

Most, however, have paid little heed to the ICO, which handed only small amounts of real guidance.

ChannelBiz UK spoke to other firms within the IT channel, with various resellers saying that they had still done little to meet the ICO’s demands.

One firm, speaking to ChannelBiz UK on condition of anonymity, was dismissive of the ICO’s attempts to ensure compliance, saying that a lack of communication did not help firms meet the regulations.

“Every now and again they flex their muscles, but the majority of the time they don’t actually impose what  they say they are going to do,” the director of one firm said. “There are so many things that you need to be aware of, where do you start and where do you finish?”

Could you say the guidance been confusing or misleading?  “Yes, of course you can,” ChannelBiz UK heard. “Is there step by step guidance to what you should do? Does it come down to personal interpretation or the ICO over what is right and wrong?

“At the moment it is not on our list to do.”

Having worked on digital campaigns with various SME channel companies Philip Ewen, digital director at marketing agency Goode Communications, says that the companies have had to contend with various changes to the cookie rules.

“Implementing the new EU cookie law is a moving feast as there have been significant changes made since it was first announced,” Ewen told ChannelBiz UK.

“Of most concern for many websites is the directive around analytics cookies – if a user refuses the use of all cookies, visibility on how they navigate a website will be lost, rendering tracking of visitor actions impossible,” he said.

The rules have been left open to various interpretations, but businesses should be aware of their own site’s cookie procedures, he said.

“A number of large organisations implemented their own interpretation of ‘implied consent’ by telling users that by continuing to use the website, they were agreeing to their cookie policy,” Ewen said. “Due to varying interpretations of the directive, our approach is to produce audits of cookie usage and publish on site. Cookies deemed as level 3 intrusive – for example, behavioural targeting – would have to be opt–in for compliance.

“We would advise channel organisations to do an audit of cookie usage so they can see if they are using ones that are considered intrusive.

“In May, the ICO announced that ‘implied consent’ will be valid for compliance,” Ewen said. “This approach will allow channel organisations to retain the visibility of website traffic without hampering marketing and should have little effect on visitors’ experiences and traffic traceability.