David Fiske Affiliate Marketing & Web Development

The EU Cookie directive came into force on 26th May 2011, with the ICO offering a grace period of one year before starting to enforce it. Plenty of people are sceptical over the content of the directive, it's motives and enforcement. As such, I've come across no other examples of websites seeking permission to drop cookies, other than the ICO website - though according to eConsultancy even that doesn't meet the regulations, and they are the people due to be enforcing this.

So with so much scepticism, where does it leave smaller affiliates?
 
Before we go any further...

I'm not a legal expert and the opinions here are merely ideas and thoughts. Enough said.

Fantastic and Concise Summary To begin With

First up, take a look at this excellent and frank video explaining the EU Cookie Directive from a UK perspective. Naturally, it's embedded using Youtube's enhanced privacy (cookie free!)



What Are the Options?

To be honest I believe the video explains them succinctly: ignore the law, drop the use of cookies or comply.

Option 1) Ignoring the Law

My money would be on most affiliates doing this. For smaller affiliates where time and resources are scarce, it's easiest to opt for this method. In fact I reckon there's a few large affiliates considering doing the same. If it's not going to be enforced that well for smaller sites then there's no incentive to make extra work for yourself. But that's a big "if".

Quite frankly there needs to be a test case before the courts to determine what the likely punishment would be for not complying, and to determine the size of website owner that will be charged with failure to comply. For example, will a part-time hobby blogger be charged if they unlawfully drop an analytics cookie? Similarly, will a voucher code site be charged for doing the same? Is size even a factor?

The only way I see this being implemented successfully is if everyone is treated the same and assessing millions of websites and prosecuting website owners for failure to comply is not going to be an easy task for the ICO.

Option 2) Dropping the Use of Cookies

This seams the easiest and most hassle-free. The cookies I knowingly have coded into various sites are nothing more than timesavers for visitors. For example, storing the user name and email address on a comments form in a cookie is not a major privacy concern for me. More-so, it offers a time saving feature to the website for repeat visitors. It's a pain leaving comments and having to type your name and email address each and every time.

The truth of the matter though is that in instances like these it may well be easier and more effective stripping the cookie dropping code than coding in a compliance script.

Option 3) Making The Changes

So if your love of Google Analytics is so great that you desperately want to keep running the service or if you're using cookies for something else that's important to keep (polls, forums, quizes, forms, etc) then there's always the option of covering your back and making sure you're compliant with the law. Obviously this is the best option and perhaps the most safest.

First you need to work out what your cookies are doing, where they are being set, and whether they are essential. The IAB Affiliate Marketing Council recently released its Consumer Transparency Framework which looks at ePrivacy guidance across the performance channel. It features a nice and neat section on cookie auditing that is seemingly aimed at larger affiliates and merchants but is easily adaptable for smaller publishers.

So now you know where your cookies are being set. Now you need to alter that code so that they are only set if permission is gained.

How you go about implementing a method to seek permission will no doubt have an impact on your visitors and could be crucial to your bottom line.

There's a blog post over at eConsultancy which provides three mock-up solutions to seeking permission to drop cookies. There's also a real life example of an intrusive modal pop-up on All About Cookies, a website documenting the humble cookie. Ironically, to persistently reject permission for the Google tracking cookie, the website sets another cookie. It could be argued that this preferences cookie is an essential one (and thus does not need to actively seek permission to be set) but as the website would still function without it, I wonder whether it can be classed as such. As such, a second pop-up would probably be required to seek permission for that particular cookie, or the description needs to expressly state that this new cookie is being set.

And this is where the problem lies. So much of the talk about the EU Cookie Directive is vague and much of the debate is full of conflicting information and guidance. It's a very vague law that doesn't seem to be that well prescribed and one which leaves room for interpretation, which can subsequently lead to confusion.

Rather than having official guidance that says you must do this, that and the other, the guidance on offer is non-committal and indemnifies itself. If the guidance can't be relied upon there's little hop for a acknowledge universal solution - other than moving the responsibility for seeking permission to set cookies back to the web browsers (apparently this isn't good enough though the option for cookie control has been contained within browser settings for years).

Whatever route you choose, it's certainly not going to be an easy piece of legislation to integrate or work with. Come the 26th May 2012 and we'll finally see how the ICO intend to police this law and how many websites will be affected as a result.

Expect all this cookie chatter to continue long past that date.

Hang on, What about Affiliate Cookies?

Personally, I'd interpret these to be third party cookies that are outside the scope of responsibility of affiliates. When a banner is displayed a cookie may or may not be dropped. Whilst it's my choice to display the banner I do not control nor have access to the cookies dropped thus I'd call them third party cookies. This would suggest the onus is with the relevant affiliate networks and independent affiliate programs in making sure they comply with the law on behalf of affiliates.

However, I'm sure this is a very grey area and it would be very interesting to see whether anything has to change in terms of how banners are delivered and served. Perhaps an AdSense style "(?)" needs to be introduced over all banners to enable visitors to opt out of cookie dropping? Perhaps they simply cannot drop any more cookies as banners cannot gain express consent before being displayed?

It would be very useful from an affiliate perspective to see some clarification and guidance being issued by affiliate networks on how they are dealing with the legislation and how they would prefer affiliates to tackle it (in terms of affiliate cookies).