Time to think again, whoever you are: these new regulations affect anyone with a website, whether it’s a personal website or the web property of a FTSE 100 company. Essentially, the new rules state that before a web server can send a cookie to a web browser, it must gain the consent of the user – the ICO has a page available which tries to go through this (the “PECR rules”) in more detail. But let’s try to break this down for you:

1. if you use any third-party system on your website, such as Google Analytics to track visitors or any kind of advertising platform, it is very likely to fall foul of the new rules. The ICO themselves have a new “opt in” system explained here for their website for which every user has to tick a checkbox before they turn on such systems (they use Google Analytics specifically, but there is nothing specific about that system which is problematic, this is due to the new rules which cover every such system).
2. if your website sends cookies by default then you are breaking the new rules unless that cookie is somehow “essential”. At the moment, it is difficult to see any good technical test that defines the difference between an essential and non-essential cookie.

Is your website using cookies? For most people, this is really hard to tell.

However, this tool is not perfect – far from it. These new rules are poorly worded, and if you use our tool you’ll see even the ICO’s own website fails! (We have written to them to let them know about this problem). Technically, there is no automatic tool which can give you a 100% answer; this is actually impossible. It’s also quite difficult to check through an entire web property and ensure the whole property is compliant with the rules, and the rules themselves are ambiguous. Additionally, even if you have a friendly web developer who manages your site, it’s quite likely that they wouldn’t even realise/know the site was using cookies, let alone know how to get it to conform to the new rules!

If you have an internal IT resource, or have someone who manages your websites for them, ask them these key questions:

1. Are you aware of the new rules (the “PECR rules”) which require end-user opt-in before sending browsers cookies?
2. Does our website currently rely on cookies, or server-side sessions, in order to implement functionality?
3. Does our website make any use of Flash cookies, HTML 5 local storage, or other end-user stored data?
4. If so, what assessment has been made of which functionality might be considered “essential”?

If you’d like any further advice on this topic, please feel free to get in touch with us. This is a really tough topic, and although the subject is quite technical it’s already clear that all business owners operating on the internet need to be aware of these new rules.