On the 26^th of May, the UK’s new “cookie law”, the Privacy and Electronic Communication Regulations (PECR) Act 2011 was brought into force. The Act, among other things, imposes a duty on website owners to make users of their site aware of the use of cookies and obtain their “informed consent”.

A cookie is a small packet of data stored on a computer by a website, to record activity such as log in information or what pages have been visited. Cookies are benign and do no harm to the user’s computer, but can be used to track behaviour. As such, the EU’s “E-privacy directive” of 2002 was amended in 2009 to increase the protection of web user’s privacy.

The PECR Act, in the context of cookies, imposes three obligations. Website owners must provide “clear and comprehensive” guidelines which must:

• Inform users that the site uses cookies
• Explain the purpose of the cookies
• Obtain the users consent to store cookies on their system

What this will mean in practice is that you will be accosted by a pop-up when visiting sites which contains the relevant information.

The Act will be enforced by the information commissioner’s office (ICO). The ICO has the power to levy a fine of up to £500,000 for breaches of the cookie provisions. Helpfully, the ICO has adopted a policy of “implied consent” – meaning consent will be deemed to have been obtained if the user continues to use the site past the point at which the cookies have been brought to their attention. The ICO has suggested that it would help educate site owners rather than punish them in the medium term.

The act applies not only to “cookies” but to other forms of web analytics – software which tracks user’s behaviour, for instance, to tailor advertising or garner data on how and why visitors use your site. This is unlikely to have a substantial effect on the use of packages like Google analytics which are commonly used and fairly unobtrusive to users.

So, what can you do? First, if your firm or company has a site, no matter how small, the relevant provisions will apply. Many smaller firms have basic sites as placeholders, many of which may have fallen into disuse. You should speak to the administrator of the site whether they are in the firm or not and have them check the site over.

Most importantly, you should draw up a “privacy policy” which is readily accessible on your site. This should inform users what cookies will be used, what they will be used for, whether or not any analytics software/programmes will be used and what will be done with the collected data. It is also worthwhile including some provisions relating to data protection in this part of the site. If you would like more information regarding the Act, or you would like some assistance in making your site compliant, contact Moore Legal Technology by clicking here.