Background: new eu data privacy directive requires consent to use cookies

On May 25th 2011, new European Union (EU) privacy regulations went into effect in the United Kingdom. They are an amendment to the 2009 EU Privacy and Electronic Communications “E-Privacy” Directive and require marketers and website owners to get specific consent from European users before using cookies or other technologies to capture the kind of visitor information that allows such common practices as customizing online experiences, using web analytics, recommending products, allowing auto-log in, and even simply tracking people around the Web. (“Cookies” are small lines of text stored by a user’s web browser to help individuals navigate quickly around sites they visit regularly.)

The directive applies to companies operated in any EU country, but each country must issue their own laws in order to regulate and enforce it. Under the old laws, marketers simply had to have notice in their privacy policy about how cookies were used. Now, there is much stronger language around the use of cookies, along with a new requirement that consumers explicitly “opt-in” when faced with a web experience that involves the collection of the type of personal information stored in cookies.

A time of transition—and confusion—for marketer

Unfortunately, not a lot of clear direction has been given to marketers attempting to comply with the regulations. In fact, many EU countries have yet to create laws based on the directive and, as a result, it is not apparent how aggressively various governments will enforce opt-in cookies. According to Jay Cline, president of Minnesota Privacy Associates, “It’s noteworthy that continental Europe tends to view the UK as falling on the permissive end of the spectrum for privacy regulation. If you think the UK approach is strict, just wait for France, Germany, Spain, and Italy to lay down the law on cookies.”

Technology to the rescue?

A simple solution would be to allow for each user to adjust his or her browser settings to allow for cookies. At this time, however, it is not clear whether regulators in the UK will accept this tactic as equivalent to “consent.” If they do— and if other EU nations follow suit—you can expect this issue to be quickly resolved at the browser level.

However, the UK law has a grace period of one year, and since the clock is ticking on marketer compliance, simply waiting for an easy outcome is extremely risky. There is also an excellent chance that permission requirements could vary from country to country. Which means now is the time to begin to proactively adjust your marketing practices to accommodate these new and evolving realities.

Best practices for permission-based digital marketing

How important are cookies to your digital marketing efforts? Many marketers are not aware how prevalent cookies may be in their Interactive Marketing to customers. Although opening an email does not place a cookie on a user’s machine, following a link in an email might. Visiting a Web site or filling out a form are other common ways consumers can be tracked via cookies.

To be sure your web marketing is compliant to customers throughout the EU, here are some tactics to add to your best practices toolkit:

1. Know what types of cookies and other tracking mechanisms you are using. “First-person session cookies are seen as more privacy friendly and necessary, for example, than third-party persistent cookies,” advises Jay Cline. Talk to your IT and your web analytics teams to fully understand.
2. Give clear and complete notice. Make sure your privacy policy is explicit and up to date.
3. . Start to consider an opt-in mechanism for your website. At the end of the day, all marketers who are in European Union nations—or who market to their citizens—should plan to start collecting explicit opt-in via some mechanism other than the browser. This could be via a mobile application, a registration form or check box, or even an in-store or telephone consent. Although there is an exception for “service” related cookies, the directive is clear that the use of cookies without express consent needs to be “strictly necessary” as well as “explicitly requested” from the consumer.
4. Review how your website is architected. What would happen to the user experience if most visitors did not check your cookie opt-in box? This is similar to how marketers needed to adapt to the advent of mobile-device browsers that could not take full advantage of many site features.
5. Collect and manage the data on your landing pages. Here is where technology is your friend. Use your marketing automation or eCRM software to help you collect, store, manage and utilize this information so that future email or other messaging can reflect custom landing pages for those who have provided an express opt-in.

Conclusion

Newly enacted EU data protection policies mean marketers can no longer adopt a business-as-usual approach to collecting internet site visitor information using “cookies.” Since consent via opt-in mechanisms will now be needed to gather the data needed to build a digital profile of customers, marketers will need to adapt in a way that continues to create rewarding web experiences for site visitors. Marketers should also be prepared for additional challenges as additional EU members adapt these data protection directives to their own countries’ regulatory policies.