Teal blue graphic

ICO softens approach to implied consent for use of cookies

The Information Commissioner's Office (ICO) has issued an updated guidance document on how to comply with the new consent rules on the use of 'cookies'. The law relating to the use of cookies by website operators was changed over a year ago, though the ICO notified website operators that it would give them until 26 May 2012 to comply with the new regime. The new guidance note has been released to coincide with the expiry of that deadline.

Most notably, the content of the guidance suggests that the ICO's position on the need for website operators to obtain consent from users has softened. Based on the ICO's previous statements, it was thought that (with a few exceptions) it would be necessary to obtain explicit consent from users to use cookies on a website. The new guidance states that it may also be possible to rely on the 'implied consent' of a website user. Implied consent is described by the ICO as follows:

"For implied consent to work, there has to be some action taken by the consenting individual from which consent can be inferred. This might for example be visiting a website, moving from one page to another or clicking on a particular button. The key point, however, is that when taking this action the individual has to have a reasonable understanding that by doing so they are agreeing to cookies being set."

The ICO has stressed that though it has opened the door for website operators to obtain 'implied consent' from individuals, this shouldn't be seen as an excuse for website operators to take no action in relation to getting consent. Website operators must ensure that clear information about the use of cookies on a site is easily accessible by users; the nature of the information to be provided will depend on the type of site in question. For example, a website designed for use by people who work within the IT industry will need to provide more complex and detailed information than one which is aimed at children. If website operators wish to rely on implied consent, notices about cookies will need to be prominently displayed.

The ICO's change of heart in relation to consent is likely to be positive news for businesses; a recent KPMG survey found that 95% of companies in the UK had not yet changed their practices to be compliant with the change in the law. The introduction of the concept of 'implied consent' will make it easier for organisations to bring themselves in line with the new legislation.

For more information about cookie consent requirements and the mechanisms that you need to put in place to ensure compliance, please contact Alison Deighton.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at May 2012. Specific advice should be sought for specific cases; we cannot be held responsible for any action (or decision not to take action) made in reliance upon the content of this publication.

TLT LLP is a limited liability partnership registered in England & Wales number OC 308658 whose registered office is at One Redcliff Street, Bristol BS1 6TP England. A list of members (all of whom are solicitors or lawyers) can be inspected by visiting the People section of this website. TLT LLP is authorised and regulated by the Solicitors Regulation Authority under number 406297.

Insights & events View all