Wrapped in red tape: cookies law for charities
A cookie is the name given to the information tags that are stored on computers and mobile devices by third parties. They act like digital bread crumbs, Hansel and Gretel-style, to gather and store information about how people use their devices. There are four different types of cookies:
Strictly necessary cookies
Some cookies are essential in order to allow people to make use of features, for example logging in and staying logged in as they move through the various different pages of a website They are necessary for the website to work properly.
Functionality cookies
Others cookies are desirable because they enhance the experience people get, for example cookies that remember previous choices when filling an online form – these are not strictly necessary, but helpful .
Performance cookies
They monitor the performance of a website, for example number of views each page gets, how long people stay on a particular page, etc .
Targeting and advertising cookies
Finally, there are 'Big Brother' type cookies used to collect people's detailed information in order to carry out targeted advertising.
The new cookies law is actually an update to the Privacy and Electronic Communications Regulations 2003. Since the law passed there was an obligation to tell people if you use cookies , but from 26 May 2011 the new cookies law required anyone using them to inform web users upfront.
The Information Commissioner's Office (ICO), responsible for enforcing data protection rules in the UK, set a year long compliance deadline which has just expired. Predictably, many left it to the last minute, giving rise to that late May frenzy.
If you put any cookies onto people's devices, there are two key elements to compliance: you must provide clear and comprehensive information about the purposes of the storage of, or access to, the information that will be stored by the cookie and the user must have given you his or her consent. Consent is not defined in the regulations and the ICO have stressed that different organisations will come up with different solutions. Consent is not required for strictly necessary cookies; for the other cookies the method of obtaining consent is decided according to how intrusive the cookie is.
As a first step, you should conduct a cookie audit and identify the cookies that you've got. They will be a mix of yours and third parties (eg, Google Analytics). Next look at your privacy policy to make sure your cookies wording is clear, easy to understand wording. Include a table of cookies, identifying the cookie type from the four categories above. Then decide on how to deal with consent.
Pop-up windows to get consent are a safe bet for compliance, but evidence suggests website use drops dramatically (including at the ICO!). Getting consent through terms and conditions and privacy policy also works, but only if people are agree to them. A more subtle approach is specific notices placed on the website indicating that cookies are used – which is what most have decided to do. This is the least offensive option to people visiting your website – and gives a better chance of that person having a positive interaction and thus staying and donating.
The ICO recently indicated that implied consent will be valid as long as the organisation is satisfied that people will understand that their actions will result in cookies being set, although some situations, such as the collection of personal health information, may lead website owners to feel that explicit consent is required. Charities encourage online donations, and rely heavily on well-designed websites to raise their profiles and collect donations. Charities need to assess how effective their online campaigns have been. The inability to place cookies without obtaining consent will affect their ability to do this.
Formal undertakings and enforcement notices are the ICO's preferred method of enforcement and monetary penalties will only be issued in the most serious cases of non-compliance where people have suffered damage. The ICO is not (generally) heavy handed and seeks to obtain compliance by consent. The approach should essentially be this: look at what you are doing, have a plan, be transparent about that and don't get sidetracked by what others are doing – every site is unique!
Vanessa Barnett is a Partner at Charles Russell LLP
This content is brought to you by Guardian Professional. To join the voluntary sector network, click here.