These tiny chunks of data have not only raised privacy concerns, including data theft, but have also led to scams: there is widespread anecdotal evidence of websites using them to jack up prices of flights and hotels once they know you’re interested in a destination. The European Union’s amended Privacy and Electronic Communications directive, which came into force on 25 May, will have a profound impact on cookies. It essentially says that cookies can be used only if consumers have given explicit prior consent.

Across the EU, response to the directive has varied widely, due to differing national attitudes towards privacy as well as some ambiguous wording in the document. As European parliament member and e-Privacy Directive rapporteur Alexander Alvaro told Privacy and Security Law, the directive is ambiguous enough to allow a web browser to give the necessary consent if the user has chosen that option in the basic settings.

“The ambiguity of the text will probably lead to some countries implementing a stricter or more lax approach, depending on local attitudes,” said Pascal van Hecke, an adviser to the Dutch data protection authorities.

Germany, for example, has a very conservative attitude toward Internet privacy. The UK is likely to copy the directive’s wording, ambiguity and all, straight into law. In the Netherlands, an attempt to strengthen the permission requirement from “consent” to “unambiguous consent” failed to make it into the legislation.

Meanwhile, the European Advertising Standards Alliance is drafting best practice recommendations, so that members can be sure they are compliant with regulations across the EU. Will every website based in Europe have to show a pop-up as soon as a user logs on in order to register “prior consent” before installing cookies, even those that are necessary for basic web functions? Will consumers be willing to sacrifice convenience – not having to re-enter credit card information, for example – in exchange for greater privacy?

British MP Robert Halfon, who has campaigned for an Internet bill of rights, says that although these problems are for content providers rather than users to sort out, the issue will increasingly become one of educating consumers so that they know what settings mean in practice. “It’s important we don’t lose services,” he says, “but users must know what’s happening to their data.” As parliamentarians across Europe continue to grapple with this complex issue, browser developers are already under pressure to improve the ways in which they protect their users from malevolent websites, while also giving them more control over their personal data. Websites will feel the pressure too.

But Duncan Smith, at UK security consultancy iCompli, has advised its clients that consumers will have to choose not to have cookies installed: “a strict opt-in regime is unlikely to happen”. He adds that users must be made increasingly aware of the benefits of trading privacy for services. For many companies, this will be a new way of working. In practice, however, it could be as simple as putting an icon on a website linking to an explanation.

Alvaro seems to agree that educating users is preferable to limiting the Web. “Without cookies the Internet would become ‘forgetful’ and obvious benefits to users would be lost,” he said. “In preliminary discussions with Commissioner [Viviane] Reding I have been assured that the Commission will not be overly restrictive.” Squaring the circle between national preferences, enforceable law and the intentions of the legislation will be a tremendous challenge. European policies are set for a clash with commercial imperatives.

This article was originally published in the 8th edition of the Futures Magazine.

Related content:

• Who’s in charge here? Consumers driving corporate technology purchases
• Tracking protection, a new way to protect consumer’s information online
• A new age in education, choice and control for digital consumers
• Privacy and Innovation

Comments (0)

There are currently no comments, be the first to post one.

Name (required)

Email (required)

Website

Enter the code shown above in the box below

Notify me of followup comments via e-mail