On Wednesday May 25 a new European Union privacy directive went into effect mandating that all websites targeting EU audiences gain consent before using cookies to track users for marketing purposes. Organizations that don’t comply could receive fines of up to $806,000.
We have already contacted our clients if we believe the directive could impact the work we currently do on their behalf. However, we wanted to send out this note to make sure that all of our clients are aware of the new regulation, share some insights into its interpretation and enforcement, and explain our plans for handling the changes.
Caveat: We are not lawyers. We recommend that everyone evaluate their own organization’s liability. That said, we plan to watch what happens with this directive and any similar legislation that gets passed in the U.S. in the coming months. As details are clarified and member nations determine how they will enforce the regulation, we will work with our clients to implement cost-effective, user-friendly solutions. In most cases we do not see a need to make urgent changes or stop web-based communications targeting EU audiences. Here’s why:
1) While the EU directive mandated that member countries put enforcement legislation in place by last Wednesday, only Estonia, Denmark and the U.K. have made any moves—and those moves have just been preliminary steps toward implementation. The U.K. governing body has stated that it will give marketers a year to comply.
2) Foot-dragging by member states over implementation is due in part to the fact that the regulation needs further interpretation. For example, there are different opinions about what constitutes consent. A strict interpretation might require advertisers to create a pop-up requesting that the user check a box before placing a cookie. This provides the most protection to users concerned with privacy, but it is also cumbersome to both consumers and marketers. A looser interpretation makes it acceptable to have a clear and prominent cookie policy on the home page, putting the onus on the user to disable cookies—a functionality already available through all browsers.
How has the industry reacted? Based on our research and inquiries, it barely has. The European online media publishers we contacted ranged from unaware to unconcerned. Google let us know that while it is their Analytics cookie that tracks behavior, it is the advertiser’s responsibility to gain the appropriate consent. As always, there are a few exceptions—automation companies suggest that the directive applies to everyone and necessitates immediate action. Of course, it is also important to note that the leading automation companies hold a stake in the outcome of the directive since they have developed solutions to proactively gain consent (read about Eloqua’s “strict mode” in their linked article below).
For our part, we are keeping a close eye on the emarketing news coming out of Europe. We are advising clients and working with them to roll out appropriate updates guided by common sense. An online experience driven by the user’s privacy and informational needs builds trust, and trust builds successful relationships.
Below are links to opinions, the UK position and—for the real masochists—the actual statute. We will continue to provide updates on our blog, as well as via our Facebook and Twitter platforms. Meanwhile, feel free to contact us if you would like more of our thoughts.
U.K. Information Commissioners Office (I.C.O.) on deferring the cookie law one year: http://www.bbc.co.uk/news/technology-13541250
The legislation— this includes the entire set of 2003 regulations because the cookie directive was an amendment written into the regulations late last year: http://www.legislation.gov.uk/uksi/2003/2426/contents/made
Further information and industry perspectives:
ClickZ: http://www.clickz.com/clickz/news/2073597/cookie-law-creates-confusion-eu
Eloqua: http://blog.eloqua.com/7-misconception-eu/
Marketo: http://viewer.zmags.com/publication/8d7a8bfd#/8d7a8bfd/1
