Cookie regulations

New regulations on the use of cookies (small computer files set by websites to record information about visitors) came into operation in May, and we were all told that they weren't as draconian as was feared. In particular, the government had concluded that there was no need to get prior consent to setting a cookie: consent obtained at any time would suffice. That was certainly a useful way of interpreting the legislation, removing much of the compliance burden from businesses.

It does, however, seem to fly in the face of logic. If I were to tell my children not to do something without permission, I would not expect them to do it and then later seek ratification. Consent by (usual) definition must be in place before the act consented to is performed - otherwise, logically, the act is performed without consent and nothing that happens thereafter will change that. But logic and interpreting EU directives have little in common.

The government's convenient approach to the matter is now in trouble. The excitingly-named Article 29 Working Party (comprising the data protection commissioners of the EU Member States, convened under the eponymous Article of the Data Protection Directive) has produced an opinion, floating a proposed definition of "consent" - a 38-page document, dealing with something that might usefully have been included in the data protection Directive in 1995 (from which the cookies directive adopts the idea of consent) - and they favour the logical approach. The opinion is only a suggestion to the Commission, though, and will not give rise to enforcement proceedings. Indeed, the Commission went so far recently as to announce that only five Member States had properly implemented the cookies Directive - the UK among them. maybe it will have to reassess that now.

Meanwhile, to comply strictly with the law, the right course is to follow the directive, not the UK guidelines. If the Commission thinks that the concept of "consent" implies "prior", as the Working Party says it should, that is the sensible way to look at it. Logical, too.

(See the story on Out-Law.)