By Chris Lee

The Privacy and Electronic Communications (EC Directive) Regulations 2003 came into force in the UK on 26 May 2011, part of which concerns itself with the protection of ‘cookies’. Cookies are used for authentication, identification of a user session or preferences, for example.

American and European lawmakers have been keen to sure up legislation regarding cookies as they can potentially be used to track user’s browsing activities or can be used by hackers to gain access to a user’s online accounts. They can also be used in Web analytics.

The Information Commissioner's Office (ICO) guidance made it clear that visitors must positively consent to any cookie used in association with website analytics. That means that websites must have an opt-in banner for users to consent for their data to be used in analytics.

This is a problem with any cookie-based website analytics system, not just Google Analytics, according to Web analytics firm Maxsi. The company has conducted a study and found that in the
main, websites do not comply with these new directives, which effectively means that they are breaking the law.

A fine mess

Websites choosing to ignore the new directives could face fines, Maxsi’s CEO John Harrison warned.

“Use of cookies for website analytics is now illegal in the UK. Although the Information Commissioner's Office has offered a one year amnesty for those breaking the law, it does have some very punitive penalties which it can impose - up to £0.5 million,” Harrison told NMK. “The ICO doesn't mess about - it has already issued a number of six-figure penalties for data protection breaches in the last year.”

Once more unto the breach

Breaches are very easy to detect, Harrison warned, and anybody with an axe to grind about an
organisation whose website is non-compliant can complain to the ICO. The ICO is duty bound to investigate.

However, Harrison added, there is a way around this. In order to comply and still have reasonably accurate website analytics, website owners should refrain from using an opt-in banner in combination with their cookie based website analytics system. Instead they should use an IP and user agent-based website analytics system, Harrison said.
“Effective website management requires website analytics, so removing website analytics altogether is not a viable answer,” he concluded. “Offering a visitor an opt-in for website analytics related cookie is pointless as the website analytics will end up only measuring visitors who opt in.”