New EU Directive – this time it’s serious

It’s hard to know whether or not the entire UK digital marketing industry is screwed. It all depends on how online publishers are required to adhere to a new version of the EU’s Privacy Directive that passed into law in November.

To put it as simply as possible, the rewording of the law – which must be implemented by individual member states by the middle of next year – means that users have to give their express permission to have their online behaviour tracked, based on the provision of “clear and comprehensive information”.

Your correspondent must have been living in a Twitter-fed parallel universe to have missed this rather critical news, especially since the last View Through column dealt with exactly this privacy point. Or perhaps everyone knows there’s a quick shortcut around the new Directive so the fuss has been minimal. But, it’s not actually clear that that’s the case.

First, let’s be definitive about the potential implications of this new law. It is just a rewording but one that makes much stronger the point that users must understand why their behaviour is being tracked, before giving their permission.

Delete all your cookies (sacrifices like this are required sometimes) and take one visit to the homepage of The Times. I returned to my cookies to find 38 new ones. Owners of these tags included The Times itself, its web analytics provider Sophus3, ad server Doubleclick, and ad network Advertising.com.

If each one of these businesses is required to explain the purpose of every one of those cookies and gain permission to drop it, the user experience would be so poor as to resemble the most horrendously bad run of red traffic lights imaginable.

Secondly, the detail and accuracy of the information that those cookies deliver is what defines the web’s success as an ad channel and without it, well, we’re worse off than telly – and this is not a pleasant thought. What’s worse is that it also means that all the internet-enabled free content and services that has been changing our daily lives for the past 15 years or so, will disappear or must be paid for directly.

Talk about this issue tends to propose that clearer and more comprehensive versions of the all-encompassing opt-in through users’ web browsers might be enough. But, that’s the answer we use already and the Directive, according to Clickz.com seems pretty forthright about tightening itself up:

"National governments must ‘ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his/her consent, having been provided with clear and comprehensive information.

Cookies without user consent would only be allowed when they are ‘strictly necessary’ to provide a service ‘explicitly requested’ by the user such as storing shopping cart information on e-commerce sites, for example."

A broad opt-in option during the start-up process of any new browser will surely struggle to convince regulators that express permission has been gained for all the reasons that cookies are stored on their computers, based on the provision of “clear and comprehensive information.” At the very least, privacy statements need to get much longer and more explicit.

It is also worth pointing out that exactly the same kind of problem is facing the US where the FTC wants to institute a national opt-in policy for behaviour tracking on the web.

Globally, we all ought to be a little more determined to explain to the general public the precise truth and importance behind cookies and the tracking they enable.