17

So Google uses cookies when performing its usual duties of tracking users on a website. That is just it though; Google are setting the cookies and not your website as such. This is by virtue of the fact that the JS is all hosted by Google and merely included into your web page.

Wolf Software who have released a jQuery plugin to ask for a users consent before allowing GA seem to imply that it would be the developers problem on their associated web page.

Is this then possibly Google's problem when the ICO comes knocking or should the developer not have implemented GA if they are aware of the potential cookie problem?

5 Answers 5

10

The short answer is that no-one knows yet.

The long answer is that 3rd party cookies are a hazy area; it's not clear from the directive (PDF) who would be prosecuted for failing to obtain consent when storing 3rd party cookies.

The ICO's current interpretation and advice, published in "Changes to the rules on using cookies...", admits that they don't know how the directive applies to 3rd party cookies:

"The process of getting consent for these [3rd party] cookies is more complex and our view is that everyone has a part to play in making sure that the user is aware of what is being collected and by whom."

Emphasis mine. They don't say who's responsible, only that someone is. Furthermore, they say that they're attempting to clarify these rules:

"[3rd party cookies] may be the most challenging area in which to achieve compliance with the new rules and we are working with industry and other European data protection authorities to assist in addressing complexities and finding the right answers."

They are expecting that these third party services

...will no doubt adapt to achieve compliance with the new rule...

One possible hint of the ICO's stance is that they list Google Analytics cookies as non-essential in their own privacy policy, and only use Google Analytics if you consent to storing cookies. I think that this sets the tone for any clarification they might offer. They may well say, 'you need to ask permission for 3rd party cookies too, because it's your choice whether you use those services or not'. But we don't know for sure yet.

This uncertainty is one reason for the compliancy deadline being extended to 25th May 2012. The best thing British webmasters concerned about the impact can do is to keep an eye on the ICO's website and wait for clarification from them. In the meantime, the rest of their advice outlined in their guidelines is worth following for cookies that you issue yourself.

6
  • I've deleted my answer because I hadn't spotted that bit on 3rd party cookies. What's your source for the deadline being extended? May 27, 2011 at 11:17
  • 2
    It's buried in the ICO's updated enforcement PDF: "[The Commissioner] will... allow a lead in period of 12 months for organisations to develop ways of meeting the cookie related requirements [that will] end in May 2012". In short, it became UK law on 25th May 2011, but they won't be enforcing it until 25th May 2012.
    – Nick
    May 27, 2011 at 11:42
  • 1
    This is a good answer, but its critical to note that this answer is UK specific, whereas the directive itself is EU-wide. That is, every country is going about enforcement in its own way. The fact that the UK is delaying enforcement by a year doesn't mean that other countries are doing the same thing.
    – Yahel
    May 27, 2011 at 21:27
  • 1
    Good point. To my knowledge, the ICO is the first EU data protection body to issue guidelines on the directive, but if people want to provide links to advice from other member states in regards to deadlines and third-party cookies, I'll update the answer accordingly.
    – Nick
    May 27, 2011 at 21:41
  • Update for the UK situation: ico.gov.uk/news/blog/2011/… Dec 15, 2011 at 12:10
4

I have now had a response from the ICO although it is not entirely relevant any more given that the introduction has been pushed back and the law and guidance maybe refined in the mean time.

Thank you for your correspondence regarding the new Privacy and Electronics Communications Regulations.

I would begin by pointing out that I will not be posting my response on the website you suggest; however feel free to disseminate the information contained here. I would also state that the rhetorical first of your two questions is not one I am in a position to answer.

Moving on, you ask:

‘Google Analytics and the EU cookie directive. Who will fall foul of the law? Google or the developer?’

As an introduction, the new rule relating to cookies is the UK implementation of amendments to existing EU legislation. Prior to the EU level legislation being passed, a consultation took place across Europe. Following the passing of the EU Cookie Directive (Directive 2009/136/EC), all EU member states are legally obliged to pass domestic legislation echoing the rules set out in that Directive. In the UK, the amendments have been prepared by the Department of Culture, Media and Sport (DCMS) and the ICO is the body tasked with overseeing the new rules – which have been passed as amendments to the existing Privacy and Electronic Communications Regulations 2003 (PECR).

If you have not already read it, you may find Ed Vaisey’s letter on behalf of DCMS as Minister for Culture, Communications and Creative Industries is helpful in explaining the approach adopted by the DCMS in implementing this EU Directive. The open letter is available at: http://www.culture.gov.uk/images/publications/cookies_open_letter.pdf.

In particular this letter best addresses your comments regarding the use of a web browser to indicate a user’s preferences. Using a browser in this way is something which the amended PECR allow, however, it is our opinion that currently technology is not advanced enough for this to be practicable (please see both the letter referred to above, and our guidance: Read the ICO’s advice to organisations about how to prepare for the new rules on cookies).

There is no specific exemption for analytics tools such as Google Analytics. The only exception to the basic cookie rule is that which relates to cookies which are ‘strictly necessary’ for a service requested by the user. This exception is a narrow one due to the second part (‘for a service requested by the user’) – and you will see from our guidance that the exception would not apply to cookies which collect statistical information about website users, or which have the aim of improving the overall website look.

In respect of ‘other marketing network cookies’ – the same rules regarding consent, and strict necessity, apply as set out above.

The PECR themselves do not set the definition of ‘consent’ for the purposes of the cookie rule. The definition of ‘consent’ which we therefore rely on is that given in Directive 95/46/EC – the Data Protection Directive (which you can access online at: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML). The Directive defines consent at article 2(h)). At this point, we have not issued additional guidance regarding what constitutes consent in the context of the new rule on cookies – on the basis that this is no different to the existing guidance on consent. You can find out more about consent on our website at: http://www.ico.gov.uk/for_organisations/data_protection/the_guide/conditions_for_processing.aspx (scroll down to the heading ‘consent’).

As you have no doubt already seen, our cookie guidance considers various different ways of obtaining consent. As further advances are made in respect of this new rule on cookies, we may add further guidance to our existing guidance.

It doesn't really answer the question from what I can see. There is no distinction between cookies explicitly set by the developer and those set by other services on behalf of the developer in the response.

1
  • +1 for a response from the ICO themselves... but sadly one that clarifies very little. Apr 16, 2012 at 11:42
4

Before writing the plug-in for Wolf Software we actually contacted the ICO to check the position, and from that consultation we are of the understanding that GA should be considered to be non-essential and as such consent is required.

The issue about it being 1st or 3rd is moot as it is only the 'non-essential' part that makes it covered by the law.

We are not implying that the problem is the webmasters either as stated at the top, what we have done is give webmasters a simple solution to this problem should they want to use it. We are led to believe that it is the website 'owner' who is ultimately responsible.

We have also verified with the ICO that the plug-in we released was fir for purpose and met the new legislation requirements with regards to GA.

It is very much a case of, if you want it, it is there to use, we do not imply anything about the law, we just offer a simple free solution to one aspect of it.

ADDED:

With regards to the ICO, we sent them a link to demo and simply asked if they felt it was fit for purpose, we were told that in the eyes of the ICO, the plugin was "fit for purpose and compliant with the new law"

2
  • 3
    +1 Are you able to share your actual question to them and their written response? A record of both would be a great contribution to your answer.
    – Nick
    Jun 2, 2011 at 8:55
  • thanks for your contribution to this question and for putting something out there freely available to help webmasters and stimulate debate. Like @Nick I reckon it would be great if you could share some of the actual communication you have had with the ICO. I have emailed ICO with a URL to this question and asked for their input as well BTW.
    – Treffynnon
    Jun 4, 2011 at 14:00
2

The above answer talks in detail about third party cookies and is right that the ICO has yet to give guidance on them. This is a moot point though as Google Analytics, contrary to the original post, uses first party cookies.

2
  • What makes them first party cookies? GA is a third party service so therefore surely any cookie set by it is a third party cookie.
    – Treffynnon
    Jun 1, 2011 at 14:11
  • 1
    You're right that Google Analytics uses first-party cookies in the technical sense that they're set against your own domain, but my interpretation of the ICO's guidance under 'third party cookies' is that they mean that a third party makes the decision to set them, and that they're not set by code hosted on your domain: "Some websites allow third parties to set cookies on a user’s device."
    – Nick
    Jun 1, 2011 at 14:39
0

Interesting discussion - it does look like a simple Analytic tracking cookies falls under the law.

This is a really badly thought out bit of legislation. While a very small percentage of visitors are bothered, it is generally these people that know how to use browser cokkies settings. Everyone else just wants a web site to work.

I wonder how long it will be before there is a browser plug in that automatically clicks the 'accept' button on all the cookies warning pop-ups?

Not the answer you're looking for? Browse other questions tagged or ask your own question.