Apologies for the nerdy post.

Over the next couple of days, you might notice a change to some of your favourite websites - it’s already starting to happen at bbc.co.uk, and guardian.co.uk. Both organisations have implemented functionality that provides users information about the use of cookies on their sites.  

In 2009, the EU amended their Directive on Privacy and Electronic Communications, stating that all websites in the EU must allow users to opt-in if the sites wanted to make use of cookie functionality. This was made law in the UK in May 2011, although the Information Commissioners Office (ICO) referred enforcement until May 2012, i.e. this weekend.

The ICO have had an example of how to implement this opt-in functionality on their sites for a while. When you visit ico.gov.uk, you’re presented with a banner that - unless you allow their use via a checkbox and submit button - informs you that they will not store cookies on your machine. Sidenote: they break their own rule here, by using a cookie to record whether or not you’ve seen this information before.

Clearly this was going to have a profound effect, not least of all on the recorded visits to their site. Google Analytics, for instance, makes use of cookies to track your journey and to allow website owners (when did we stop calling them webmasters?) to make improvements. It would also ostensibly break Google’s advertising model throughout the EU.

As part of my job, I need to know about this, so I contacted the ICO and spoke to someone there. I was told, “do not implement functionality in the same way that we have”. It sounded to me as if they’d screwed up, and I was informed that, “our analytics show a major drop off in visitors to our site”. No shit.

Instead of ensuring users can opt-in, we were told that, as long as we provided information, visibly and up-front, and told users explicitly how to use their browser settings, we didn’t need to do much.

So, essentially, write about cookies in your Privacy Policy.

An entire cottage industry has built up around this directive and subsequent legislation in the UK, with the result that a lot of companies and organisations are spending time and money implementing something that (a) doesn’t seem to be as hardline as it was suggested it was going to be; or (b) will probably not be causing anyone any grief a year from now, as everyone will have moved onto the next nonsense hot topic.