Online privacy has long been a tricky issue, with companies seeming to gather more and more information about consumers all the time. But with an amendment to the law on cookies coming into force in the UK, are the days of cookie tracking about to end? The Drum takes a look at what the law means for the analytics industry, and why businesses and online marketers will have to stay on top of the game to avoid falling foul of the new rules.
One of the biggest challenges for web analytics this year is the EU’s Privacy and Electronic Communications Directive, or cookie law. The Information Commissioner’s Office recently warned that businesses must wake up to new European legislation which comes into effect in the UK as of May 2012, concerning the use of cookies.The ICO was put in charge of regulating the new rules last year but gave site owners a 12-month period of grace before they were enforced because most sites were not ready for the new law.Key points set out in the ICO interpretation of the new law, issued in December 2011, cover the following:
- More detail on what is meant by consent. The advice says ‘consent must involve some form of communication where an individual knowingly indicates their acceptance.
- The guidance explains that cookies used for online shopping baskets and ones that help keep user data safe are likely to be exempt from complying with the rules.
- However, cookies used for most other purposes including analytical, first and third party advertising, and ones that recognise when a user has returned to a website, will need to comply with the new rules.
- Achieving compliance in relation to third party cookies is one of the most challenging areas. The ICO is working with other European data protection authorities and the industry to assist in addressing the complexities and finding the right answers.
- The ICO will focus its regulatory efforts on the most intrusive cookies or where there is a clear privacy impact on individuals.
Privacy is one of the key challenges facing the analytics industry in 2012. As well as the amended cookie law, the European commission has put forward proposals that would see a single set of rules on data protection apply across the EU.But what does the cookie law mean for web analytics? Reaction to the amendment of the law varies from confusion as to how to comply with it, to the belief that it is, at present, unenforceable and therefore nothing to worry about. However, what is clear is that the law will certainly present changes for the way analytics systems and online marketing teams work.Conrad Bennett, VP of Technical Services, EMEA at Webtrends said businesses must think ahead in order to ensure they are in compliance with the law.“Short of a company removing all cookies from their site, which is not really an option, brands need to take action and plan how they are going to comply with the legislation. Our advice is to, firstly, conduct a cookie audit of your website(s). Remove any cookies that are no longer required (remember to check with stakeholders to make sure they really are redundant).Secondly, update your Privacy Policy and include a Cookie Policy (ideally with a link in a prominent position, clearly visible on all pages). This new policy should detail all cookies that you place on the user’s PC/mobile and include who owns the cookie and what it does. Finally, plan what approach you are going to take to comply with the EU Directive in getting users to opt-in to accepting cookies.”He also cited the importance of clarifying the use of cookies on a brand’s website as a positive thing for consumers; “The key is to make the message clear for customers that cookies are used for measurement and to enhance their experience; try not to mention words like ‘tracking’ which have a negative connotation. Cookies ultimately benefit the repeat site visitor, remembering preferences, language choices, wish-lists etc. If websites are clear about the benefits, there should be little impact on the quality of the analytics, and thus the customer experience.”Bennett also observed the new law will mean that fewer visitors will opt in, but that insights to improve performance will still be gleaned from those who do. Duncan Parry, COO at STEAK agrees that even if the development of on-screen prompts increases in the long term, data will still provide insight even after the new legislation: “If in the longer term the development of "Do Not Track" buttons in browsers and on sites does significantly rise, then analytics providers will have to innovate - or website owners find ways to reward consumers for accepting cookies, perhaps with discounts or loyalty points. Data will still have value.”Meanwhile, questions are being raised about the different interpretations of the law across Europe. Foviance lead consultant John D’Arcy stated:“The particular issue for analytics is that there are different interpretations across Europe. The UK government has always indicated that it will be less focused on analytics technologies while countries like Germany flag Analytics as a major risk.” D’Arcy went on to explain that if sites ask for opt-in agreement from visitors, a change in thinking will be required from both analytics and marketing teams:“If sites ask for active opt-in we can expect only 10% of visitors will agree and therefore be tracked. So we’ll only be able to understand the behaviours of 1 in 10 of our customers. If that’s the case then analytics tools are going to need to be treated like survey or panel data which only take small samples of customer data. That’s going to be a major shift in thinking for marketing and analytics teams. Not to say that data won’t be valuable but it will need to be reported on, analysed and utilised in completely different ways.”Perhaps summarising the feelings of many in the industry, D’Arcy also questioned the ability to design a solution to a challenge that “even the law makers don’t understand”, saying: “It may even be fun watching the chaos unfold over the next year but I do have a hunch that we are a way off the ICO taking an active interest in fining people.”Head of ad operations at MPG Media Contacts, Chris Swarbrick highlighted a decrease in recorded traffic as one of the most obvious – and serious – threats to analytics, citing an example of the ICO enforcing this on its own site: “Officially the Information Commissioner's Office (ICO) has confirmed that site analytics cookies require consent just as any other "non-essential" cookies do. Famously once the ICO enforced this on their own site, and made it conditional on a user ticking a box before GA cookies were set, they saw a 90% decrease in recorded traffic.So at face value it would appear that the new 'cookie laws' may pose a major threat to current analytics systems.”Swarbrick went on to explain that ICO guidelines imply that not to fall foul of the new rules in practice, site owners must simply explain analytics somewhere on their website.“However, right at the end of their guidelines the ICO state 'Provided clear information is given about their activities we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action.' In practice then it appears that site owners can continue as they are - so long as they take that all important step of explaining somewhere on the site what analytics is. The topic therefore shouldn't be ignored but doesn't need to be considered a threat.”
The Drum's analytics supplement is available for subscribers to download here
