Online Behavioural Advertising - EU call for cookie consent may be a privacy ‘own goal’
Background
Directive 2002/58 on Privacy and Electronic Communications (the E-Privacy Directive), is a 2002 EU directive on data protection and privacy. The E-Privacy Directive was applied in the UK through the Privacy and Electronic Communications (EC Directive) Regulations 2003 (the PEC Regs). Last year the European Union and the European Parliament reached an agreement relating to various telecom reforms (the European Telecom Package) and published a revised ePrivacy Directive, which must be implemented throughout member states by May 2011. In the UK this will probably mean the PEC Regs are replaced.
One of the amendments to the E-Privacy Directive that has triggered much debate relates to cookies, and the extent to which consent is required from users of websites for cookies to be placed on their machines and then read to deliver tailored advertising or other content. In particular, it now appears unlikely that the online ad industry, and brand owners, can continue to rely on users’ browser settings as inferring consent (on the basis that a browser’s settings provide an effective means of opt-out from cookies), but that in contrast to current market practice, positive consent – i.e. an opt-in - will be required. Clearly, such a requirement could cause a major change in the way most websites and ad serving models work, and would seem to push against the tide of technological and market development.
The overarching directive that relates to data protection (Directive 95/46/EC, or the Data Protection Directive) created a working party to advise on the development of data protection laws at EU level (the so-called Article 29 Working Party). The Article 29 Working Party is composed of representatives of the different EU data protection regulators and its opinions are thus instructive in the likely interpretation of data protection related directives, including the revised E-Privacy Directive. The Working Party stated last week (in a 22 June 2010 Opinion on online behavioural advertising) that "opt-out" is not sufficient to comply with the revised E-Privacy Directive. Where does this leave advertisers, publishers and advertising network providers?
Lawyers Sally Annereau, Graham Hann
