I recently visited the Information Commissioner’s Office (ICO), Web site to read some relevant news and was interested to see how the Office has initiated handling the cookie directive. First upon visiting any webpage at www.ico.gov.uk you’ll see the below notice:

What’s interesting here is you can only opt to accept cookies from this site. There is no option to decline cookies. However, if you click on the privacy notice, you’ll get more details on how the ICO uses cookies.

Within the privacy notice, the ICO has also published a grid of cookies on the website and how each one is used. This is very clearly explained to the visitor.

Of particular interest, one cookie, the Content Management System Cookie has the following statement:

This is a problem many organisations are going to face. It is likely that many organisations know some of the cookies on their website, but it is also highly likely that many organisations are unaware of all the cookies on their website.

If this is how the ICO expects all organisations in the UK to handle the cookie directive then this clear grid will need to be easily produced, updated and maintained; perhaps a challenging feat for many. At a minimum, a cookie audit is the first step in meeting the directive requirements.

This week I’ve attended IAPP Europe Data Protection Congress in Paris. Many of the 300 attendees were from law firms seeking more information on how to handle privacy regulations and particularly the cookie directive. I’ve highlighted on this blog previously that it is very unclear what organisations need to do to adhere to the directive, but once again it’s important to reinforce that pleading ignorance is not an option. You’ll be on the hook for any cookies known or unknown on your website.

The ICO is expected to publish a report pre-Christmas to help UK organisations with compliance. However it is highly likely that following how www.ico.gov.uk is currently handling cookies, will be the way forward for UK organisations. So as a starting point, audit your website for cookies. For more info on how to do this, please get in touch via comments below or through our Twitter feed @HiSoftware_EU.

On the rumour mill I’ve also heard that the ICO has lost a lot of traffic to the website something that is of grave concern to many marketers. Sites like Google Analytics will need to find another way of monitoring traffic particularly if sites, similar to the ICO, include the below details:

This cookie directive means we face a sea change in how the web serves its users and consumers. Convincing people to opt-in is a major challenge along with all the back-end issues, but also the geographical rules. Where does the cookie directive start and end? If a US company has a website based in the States, that also serves the EMEA market, what jurisdiction will this fall under?

The questions are currently endless. At least we have a starting point – audit your cookies.