The UK “grace period” for implementation of the cookie consent rule expired last Friday. The long-promised update to the ICO guidance was finally published as well. The new guidance includes some interesting comments on how to go about collecting consent for cookies and, in particular, on the use of implied consent.
The ICO has long backed the concept of implied consent provided such consents are specific, freely given and informed. ICO guidance has also always said that there should be some “active communication” and that “silence is not consent”. The new cookie guidance underlines this when it says that implied consent has “always been a reasonable proposition in the context of data protection law”. Interestingly, the old version of the ICO guidance said that a “general awareness” of the functions and use of cookies would not be enough to generate a consent. That must be right. In other words, you cannot rely on the general context or an ability to change browser settings to generate a consent. Maybe this will change in the future as people become more aware of cookies. Nevertheless, the ICO’s acceptance that implied consent is a reasonable basis for collecting consent for cookies will help legitimise some of the various pop-ups and banners that we are now seeing appearing on websites.
Latest news this week also indicates that EU telecoms regulators are to take five Member States to court for not implementing the new telecoms rules (which include the cookie consent rule). This includes the Netherlands, Portugal, Belgium, Poland and Slovenia. So while we have a (fairly) clear answer to what compliance means in the UK, the position elsewhere in Europe, remains less certain.
