The UK Privacy and Electronic Communications Regulations 2003 provide that a person may not store information, or gain access to information stored, on a user’s or subscriber’s device unless they have provided clear and comprehensive information on the purposes of the storage or access, and they have given the user or subscriber the chance to refuse the storage or access. The Information Commissioner’s Office’s (“ICO”) position is that actual consent is required to comply with the law and that UK GDPR standards for consent apply. This means that consent must be freely given, specific and informed and, whilst it does not need to be explicit, it must involve an unambiguous positive action. There is an exception for cookies that are essential to provide an online service at someone’s request (e.g. to remember what’s in their online basket, or to ensure security in online banking). As cookies can store information about user’s preferences or past actions online, they can be used to deliver personalised advertising.

On 21 November 2023, the ICO announced that, having reviewed the UK’s top 100 websites, it had warned a number that they were facing enforcement action by not giving users fair choices over whether to be tracked for personalised ads (previously reported by Wiggin). On 31 January 2024, the ICO announced that many of the companies contacted had or were in the process of making their cookie banners compliant and others were developing alternative solutions such as contextual advertising and subscription models.

The ICO confirms that it will now be reviewing the next 100 websites offering services to UK users. To accelerate its efforts, the ICO is developing an AI solution to help identify websites using non-compliant cookie banners.

The UK Data Protection and Digital Information Bill, currently passing through the legislative process, proposes to relax the rules for cookie consents (previously reported by Wiggin), although it remains to be seen whether this will make it into the final version of the law.

For more information, click here.