Governments 'not ready' for new European privacy law

Cookies are used by websites to save user preferences between visits.

European rules aimed at giving consumers more control over how their web browsing is tracked will not be enforced come May, experts have said.

No European government has yet drawn up the guidelines for how the ePrivacy directive will be enforced.

It states that websites must seek consent from users before using tracking technologies.

Privacy campaigners say the solutions being put forward are "not fit for purpose".

Detrimental

Alex Hanff, of Privacy International, is shocked by how unprepared European governments are for the directive which comes into force on 25 May.

"This has been on the cards for three years and the industry and governments are simply not ready for it. It is very frustrating for campaigners," he said.

Behavioural advertising is a burgeoning industry for advertisers and, potentially, a very lucrative one.

But it relies heavily on being able to track online behaviour via cookies - small text files placed on a user's computer.

The Internet Advertising Bureau (IAB) said that the new law "is potentially detrimental to consumers, business and the UK digital economy".

"It raises significant implementation challenges right across Europe," said Nick Stringer, the IAB's director of regulatory affairs.

Browser solution

The IAB and the European Advertising Standards Authority have both argued for self-regulation, and have drawn up guidelines for cookie use on websites.

"They are pretty poor in our opinion, they are not very transparent," said Rob Reid, senior policy adviser for consumer watchdog Which?

But the other extreme - of making consumers consent to every cookie presented to them - is not feasible either, he said.

"Privacy groups have argued to have an opt in for every cookie but that would make browsing a complete nightmare," he said.

"The big challenge is how to obtain permission without affecting the consumer's experience," he added.

Mr Hanff denied that such a solution was unworkable.

"There are very few big players in this industry and it is nonsense that users will be having to click on multiple consent forms," he said.

In the UK, the responsibility of drawing up guidelines falls to the Department for Culture, Media and Sport.

A spokesman for DCMS told the BBC that while its guidelines will be available at the end of this month, the details of how companies should roll them out will not be ready for the May 25 deadline.

"The technical solutions simply aren't ready yet. It is a highly complex area and needs a huge amount of work," he said.

But he said that the DCMS is "leading the way" in Europe.

One of the solutions it is considering is browser-based consent.

Microsoft's IE 9 browser already offers a setting to protect users from services which collect and harvest browser data and both Mozilla's Firefox browser and Google's Chrome are working at integrating so-called 'Do Not Track' technologies.

But such a solution is "simply not fit for purpose", according to Mr Hanff.

"That would water down the legislation hugely. It doesn't take account of other ways people go online, such as via mobile or tablet apps," he said.

"The advertising market is good at circumventing technology-specific laws," he added.

Valuable data

As governments around Europe grapple with the best way to implement the directive, consumers wanting more transparency on how advertisers are using their data are likely to be disappointed, thinks Mr Reid.

"Come May 25th, consumers are unlikely to notice any major changes to their browsing experience," he said.

Neither will the UK government be acting on complaints from members of public, at least in the short term.

"We don't think it is appropriate for enforcement action to be taken while solutions are being developed," said a spokesman for DCMS.

Once the government has published its guidelines, enforcement will be the responsibility of the Information Commissioner's Office.

It too plans a very light touch when the regulation comes into force.

"We are not saying that we won't take action. We expect firms to be working towards solutions," said a spokeswoman for the ICO.

According to studies conducted by Which? consumer awareness of behavioural advertising and online marketing is very low, but that does not mean people would not consent to being tracked.

Some advertising firms are taking the bull by the horns, making their use of peoples' data explicit and rewarding them for allowing them to use it.

"People are realising that their data is valuable and handing it over in return for preferential deals," said Mr Reid.