If you operate a website, the chances are that your website will use “cookies”. Cookies are small files that are downloaded onto a user’s computer when the user accesses a website. They allow the originating website to recognise the user’s device and can collect information about the user.
There are different types of cookies: For example, “session” cookies, which expire at the end of a user’s browsing session (such as cookies that enable a website to remember that a user has placed items in an online shopping basket) and “persistent” cookies, which survive between browsing sessions (such as cookies that recognise a user’s log-in details when he returns to a previously-visited website).
As a result of concerns around privacy on the internet (and in particular the profiling of users’ habits without their knowledge) the EU has established new rules relating to cookies. The use of cookies is now only allowed if the user (i) has been provided with clear and comprehensive information about the purposes for which the cookie is stored and accessed, and (ii) has given his consent. The requirement to obtain consent – which in practice generally means consent prior to the cookie being placed – is likely to present website operators with the most difficulty. There is an exception to these requirements where the cookie is strictly necessary for the provision of a service requested by the user, however this exception is likely to be given a very narrow interpretation.
Although the new laws came into effect in May 2011, the Information Commissioner’s Office (“ICO”) will not start to enforce the new law until May 2012. The ICO does, however, expect companies to be takings steps now to ensure compliance by May 2012. The ICO’s powers of enforcement include the ability to levy fines of up to £500,000.
Prior to May 2012, businesses who operate websites should therefore (i) identify which cookies operate on their website, and remove cookies that serve no useful purpose (ii) confirm the type and purpose of each cookie, assessing in particular how “intrusive” each cookie is (iii) amend their online privacy policies to provide clear and comprehensive information about those cookies and (iv) ensure that they obtain users’ consent to the use of cookies – this may be done by, for example, the use of static information banners on the home page of websites or (on websites requiring registration by users) by providing the relevant information in website terms and conditions which must be accepted by users before they proceed to access the site.
Last Cawthra Feather LLP (LCF) is a leading and award winning law firm. The firm has offices throughout Yorkshire. It has 12 partners and 115 employees. Visit www.lcf.co.uk for more information.
James Sarjantson is a Commercial & IP partner, based in LCF’s Leeds office. James has 11 years experience in specialising commercial contracts, including IT and web contracts, franchise agreements and high value supply contracts.
For further information and assistance in complying with the new law, please contact James Sarjantson on jsarjantson@lcf.co.uk

