As web managers all over the UK will have been well aware, the EU Privacy and Electronic Communications Directive passed into law over the weekend – and with it came a big surprise.
Just hours before the law came into effect, the Information Commissioner’s Office (ICO) updated its advice on cookies compliance to state that “implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies.” The wording of the law has also been changed to refer to implied consent rather than explicit consent.
This is a significant shift from the ICO’s previous position, which suggested that implied consent was insufficient. While many website owners will be breathing a sigh of relief, some commentators are now describing the new law as a “watered down” version and speculating that UK law is no longer in line with the EU Directive, which may lead to challenges in the European courts, and could put the UK out of step with other EU states. At the same time, others are describing it as the only practical and reasonable course of action.
It will be interesting to see how the situation materialises in coming weeks, especially as the ICO has already “written to a sample of more than 50 organisations behind popular websites”, and it remains to be seen what action will result from the ICO’s involvement.
