Websites are obliged to get consent from users for most non-essential "cookies". (See explanation of "cookies" below). This issue is somewhat technical, but it is designed to enhance privacy and supplement data protection laws.

What are "cookies"?

When you visit many websites, a small file (a "cookie") is automatically stored on your computer, via your browser. It can have a variety of functions, some being needed to provide functionality of the website, particularly for an e-commerce site with a shopping basket. However, many cookies are either used to collect statistics on the behaviour of visitors (known as analytics), and others are used to facilitate targeted advertising. 

What is the cookie law?

The Privacy and Electronic Communications (EC Directive) Regulations 2003 require website owners to gain consent from users before using non-essential cookies (such as those used for advertising). There are limited exceptions: cookies used only to collect statistics about how the website is used so that it can be improved, or only to adapt or enhance the website’s appearance or functions (for example, to remember a user’s preferences), can be used without consent, provided that users are given clear and comprehensive information about them and a simple, free way to object, and do not object. The statistics exception does not apply if the information collected is shared with anyone except to help make the improvements. You cannot rely on “implied consent”: warning users that cookies exist on your website and treating their continued use of it as consent does not give valid consent. Where consent is needed, users must give it by a clear positive action, such as clicking “accept”, before the cookies are set. The Information Commissioner’s Office (ICO) which enforces the cookie law in the UK, can impose fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher, on companies which fail to comply with the rules.

So how do I implement the cookie law on my website?

There is no set way of gaining consent for using cookies. A common approach is a cookie banner or pop-up that lets users accept or reject the cookies that need consent before those cookies are set; a banner stating that continuing to use the website means the user consents is not enough.

However, you should also provide instructions (via a relevant cookies policy which may also detail how the cookies are being used) on how the user can turn off cookies within their computer browser if they wish to browse your site without use of cookies. We have a range of up-to-date website cookies policies which can be used by your business and adapted to your needs. These can be downloaded from our Business Documents Folder. Click on the link below for further information.