Partner Article

Avoid EU cookie law leaving a sour taste

Cookies should be on the plate of most businesses across the North East as a new EU law comes into force this weekend and falling foul of it could cost organisations dearly.

The ‘EU Directive on Privacy and Electronic Communications’ covers confidentiality of information, governing website cookies and the treatment of spam across both private and public sector organizations.

It takes effect on Saturday 26th May and from then websites need to obtain users’ opt-in consent first if they install cookies that pass on information about browsing activities to third parties.

Time is running out for the region’s businesses and public sector bodies that have not yet made changes to their online communications regarding cookie use. It’s critical that they check they are compliant, or take urgent steps to become so, as those that fail to comply will risk fines of up to £500,000.

We recent analysed 55 major UK organisations across the private and public sectors and found a surprising lack of compliance. In fact, 95% did not adhere to the legislation, with only one asking specifically for opt-in which is the key requirement of the directive.

Whilst the majority of the websites we analysed make reference to cookies in their T&Cs or privacy policies, and some also state how the cookies are being used, this is not enough to ensure compliance.

Organisations need to focus on establishing an inventory of their web sites and the cookies currently in use, before evaluating their purpose, and establish a pragmatic plan to ensure adherence.

I’ll end with five steps for ensuring website compliance:

1. Perform a review of the use of cookies on your website

2. Evaluate the information obtained from any cookies currently in use, and whether this information is paramount for your organisation

3. Start adding consent requests to cookies related to logon, registration and other similar processes

4. Create a plan to expand this activity to the remainder of your website

5. Don’t waste any more time: Make sure you know which cookies your sites use, understand the applicability of the law, seek legal counsel if required and have a concise schedule to make your website compliant

Martin Tyley, Risk Consulting Director at KPMG

This was posted in Bdaily's Members' News section by KPMG .