ICO tells firms they 'must try harder' to meet cookie obligations

The Information Commissioner's Office (ICO) has told companies that they "must try harder" to meet their obligations under the new cookie law, as the watchdog reaches the half-way stage in the one-year grace period before enforcing the law.

The amendment to the ePrivacy Directive came into force on 26 May and requires firms using cookies that gather data on visitors' behaviour and remember their preferences to achieve "prior consent" before installing and running the technology.

The ICO said that it will wait for 12 months while solutions are proposed and created for businesses to use before taking any action, but warned on Tuesday that they must double their efforts.

Information commissioner Christopher Graham said in a blog post on the ICO web site that the watchdog recognises that there is no "silver bullet" to achieving compliance.

"If we approach your organisation about this topic we expect you to be able to tell us what you have done so far, how you expect to be compliant and how long it will take," he said.

"Exactly what you tell us will depend on who you are, the sophistication and complexity of your web site and who your users are, but we will expect that you can tell us something."

Graham added that when enforcement starts in May there will not be a "knee-jerk enforcement action", but warned that firms offering excuses about why they are not compliant could expect to face action.

"If you have decided this is too difficult, that you don't want to give users choices about how your web pages might collect information or you will get around the law by wilfully misleading people about what you do [...] we will take the necessary steps to ensure you work towards compliance," he said.

The ICO used the report to issue updated guidance for businesses on how the organisation interprets the law, and to offer examples of how sites could request consent from users.

The change to the law affects most online companies and could have an adverse effect on the ability to measure visitor traffic if users don't give their consent.

Many firms have complained that it is unclear exactly what is expected, and even Google admitted that it is struggling to meet its duties under the amendment.

Andreas Edler, managing director of web hosting firm Hostway UK, argued that the legislation is well intentioned, but had opened up a "minefield of compliance issues".

"While businesses are likely to welcome further guidance from the ICO regarding cookie compliance, there still seems to be an air of too little too late," he added.

"Understandably, many businesses have been waiting for this guidance before making decisions regarding the privacy settings on their web site. However, as a result they now only have six months to comply."