Websites told to ensure cookies comply with UK law

Cookies are used by websites to save user preferences between visits.

Websites are being asked to review how they track users ahead of imminent changes to privacy laws.

On 26 May European privacy laws come in to force in the UK which give people more control over what data websites gather about them.

This means changes to what websites can do with cookies - small text files used to log data about repeat visitors.

The Information Commissioner's Office (ICO) said sites need to be sure their cookies comply with the law.

Making complaints

The ICO issued guidance to firms ahead of the 26 May deadline but said that the document was a "work in progress".

"It is not offering all the answers," said an ICO spokesperson.

The Department for Culture, Media and Sport (DCMS) has drawn up the regulations firms must take to comply with the law. It is now working on the "technical solutions" firms can follow to meet the requirements it set down.

As the technical solutions are being worked on, firms are being encouraged to prepare by examining their cookies to see what purpose they fulfil and reach a decision about whether they require "informed consent" from visitors to keep using them.

This review process was important to undertake, said the spokesperson, because from 26 May the ICO is obliged to investigate any complaints it gets about the use of non-compliant cookies.

"We will look into those complaints and see what that company is doing to work towards compliance," said the ICO. Only by showing the results of this work will web firms be able to convince the ICO they are intent on complying.

The DCMS said while complaints may be investigated, it does not expect the ICO to take enforcement action until information about technical solutions has been drawn up.

Websites are being asked to review cookie policies because technical solutions involving users tweaking settings on browsing software are not going to be available by 26 May.

As a result, web firms will have to decide for themselves if consent can be obtained

• when people sign up to use a site

• can be put in the terms and conditions

• or should be gained via a pop-up window

Third-party cookies, used by advertisers to track users across sites, are likely to be particularly problematic to review and police.

One solution, brokered by the Internet Advertising Bureau, might be the use of an icon on adverts that, when clicked, reveals information about data being gathered.