Last month, Richi Jennings wrote about the implementation of European Directive 2009/136/EC, also known as the “Cookie Law” in the UK.
Feel free to read the whole article, but here are some samples, as an introduction to the subject:
Websites must get "specific and informed...consent" from users, in order to legally use Web cookies.
...
It seems that the implications are monumentally onerous. ... There are some exception to the cookie consent requirement, but they're pretty limited.
Richi got me thinking: how are other EU member states implementing the Directive? What was the implementation process like?
As you can see, the member states aren’t too keen on implementing the Directive, even though it was supposed to go into full effect last year. According to Rui Simões, an intellectual property lawyer, these are the main reasons:
“This directive is particularly difficult to implement, considering that it calls for a substantial change in the way that the majority of the websites work. The directive demands that users give explicit permission to all cookies that are downloaded to their computers, something that is close to impossible given the quantity of cookies that are used nowadays and the relative “illiteracy” of many users.”
According to Simões, the local regulators have “been studying alternatives, like having the browsers themselves include the automatic acceptance or rejection of cookies by type, but these solutions have not been implemented by the browser makers.”
Even the countries that have already implemented the Directive have come up with inconsistent solutions. Enforcement also remains a problem.
France has implemented the directive but declared cookies used for analytics to be legal, as long as only anonymous information is stored.
In Spain, there’s a lack of “clarity and expectation”, according to Simões: it’s not known what measures will be taken to enforce the law.
The UK regulator has, at the 11th hour, appeared to change its mind about requiring the explicit permission that Simões referred to. It now says that “Implied consent is a valid form of consent.”
Consistency of regulation, at least to a minimum standard, was supposed to be one of the advantages of the Single Market. However, in this case, it seems that regulators’ interpretation of the law is anything but consistent.
