Google’s cookie ban was pushed back to late 2023
While this guide isn’t endorsed by the ICO and is not legal advice, we have frequently contacted Information Commissioner’s Office to ensure our conclusions are correct. Big thanks to their incredibly helpful team.
Please note that many reputable companies are not compliant. Please refrain from copying cookie prompts from other websites, including using the same consent mechanism software.
Letting visitors know that you’re using cookies is not enough. They have to actively agree to the storage of cookies that aren’t strictly necessary.
You can’t hide the “consent” message in Terms & Conditions or rely on browser settings.
Positive opt-in is required for all optional cookies in the UK cookie law.
Only cookies necessary for communication or delivering crucial website features can be classed as “necessary”. This would include:
Other analytics, advertising and tracking cookies can not be classified as strictly necessary.
The solutions that are currently available on the market often are just “dummy” consent prompts. Many of them have the ability to only block the cookies after the consent settings are saved. Since this scenario includes pre-loading all cookies on your website on page load, these solutions aren’t compliant in light of UK law.
Linking to the policy in the footer is a common practice. We definitely agree with that, but most of the time it’s not sufficient. Your visitors might expect to find it there, but it often requires a lot of effort to reach it – especially on lengthy pages.
Many cookies, such as “_ga”, “_gid”, use naming schemes that aren’t intuitive for the average user. A Cookies Policy allows you to be transparent and describe their purpose. It’s also where you can link to the third-party privacy and/or cookies policies, and include any additional information, such as the contact details for data protection enquiries or information on how visitors can delete cookies from their devices.
Assuming you allow visitors to access your website without accepting the cookie consent, the prompt needs to remain unintrusive to their experience. You still have to ensure visitors intuitively spot and understand your pop-up, but if it covers half of the web page before they interact with it, the pop-up wouldn’t be fully compliant.
Another common occurrence on websites that break the law is the usage of suggestive colours or design choices to influence the user. Regardless of your brand guidelines, the options within the prompt should use the same styling.
It’s important to note here that after changing the settings, previously set cookies might remain on the user’s device. Only the user can delete them but it’s your responsibility to guide them towards a solution. Including a simple note referring to the browser/device settings to delete existing cookies is sufficient in this case.
If the information you get from the usage of cookies can identify a person, you must also comply with GDPR rules. This applies even if you can only identify the person indirectly.
Even a seemingly random anonymous user identifier is “personal data” under GDPR. That’s because anonymous identifiers often refer to other data that can be used to identify a person – directly or indirectly.
As an example, if you assign “XMk3X8gPMf” as the ID of your visitor and share it with us, we have no way of identifying the person. However, if the user browsers other websites that have access to the identifier, and these websites save information about the person as well, connecting the ID with other data sets might identify the user. Many third-party cookies work like that, especially the ones set by advertising and re-marketing networks.
As mentioned when talking about your Cookies Policy, it’s a good practice to include links to applicable third-party policies on your website. This allows your visitors to find detailed information on how third parties process their data.
The above requirements apply to all platforms and devices where you store cookies. This means that a mobile app requires a compliant prompt as well. On some devices, like smart TVs or other home appliances, getting consent might be challenging. You could do it in several ways, from communicating it in manuals or creating a standalone app where users need to register and give their consent.
We’ve prepared a quick guide that will help you spot potential non-compliance of your solution. At the end of this section, you’ll find a link to download this checklist in a PDF file.
Please note that we can’t guarantee that passing all the checks means your usage of cookies is fully compliant. These are simply the most common, high-level mistakes that can be easily spotted by anyone and we are not responsible for misuse or incorrect conclusions drawn from the use of this checklist.
To ensure full compliance, please consider carrying out an audit or consulting the extensive guide from the Information Commissioner’s Office.
Our cookie consent policy template follows the guidelines of ICO:
If you’re unsure about your website’s compliance, let us know and we’ll send you a manual compliance report.DISCLAIMER
We’ll check your compliance against the Information Commissioner’s Office guidelines to the best of our ability but we’re not lawyers, and the report is not legal advice. We accept no legal liability for any information on this page, or in the compliance report.
No. They are not strictly necessary for the visitor, and as such, they require positive opt-in. This applies to both third-party cookies (Google Analytics) and even first-party tracking solutions.
No. Necessary cookies are strictly defined as ones that provide crucial website features – shopping cart, saving user preferences, etc. While analytics might be important for your company, they’re not necessary for the visitor.
No. There’s a lot of misinformation online about this. Implied consent is not compliant at this moment and you should look for active, positive opt-in from your visitors.
No. Online sources are often wrong about this as well. Once again, positive opt-in is needed for all optional cookies.
It depends. As mentioned in the introduction, even among the five leading consent management platforms only 11.8% out of top 10,000 British websites met the minimal compliance requirements. When using a third-party solution, don’t assume it’s fully compliant and that the provider will be responsible for any negligence. It’s still your responsibility, and they likely cover it in their contract with you. When you choose a service provider for consent management, you should still verify whether it’s fully compliant.
No. You can’t assume all visitors have the capability and know-how to block cookies. This would also go against the requirement of positive opt-in, as you would be pre-loading cookies before obtaining consent.
No. According to ICO’s guidelines, this is not a form of positive opt-in, even if you only preload the cookies after the user accepts the selection. Visitors have to actively select these cookies.
No. You can group cookies into relevant categories, as long as you clearly explain your choice and inform visitors which cookies belong to the categories of your choice.
You can only pre-load cookies that are required to communicate with the visitor, or to provide basic functionality of the website, i.e. e-commerce cookies that allow users to add items to the cart, authentication cookies that remember the visitor’s previous login credentials, or a chatbot functionality – but only if communication is impossible without the use of these cookies.
We’re doing our best to keep the article up-to-date with the current guidelines. However, if you spot a discrepancy or have additional questions, please get in touch with Dawid. He’ll answer your questions and we’ll consider including them in the article to help others as well.
Please note that our advice isn’t legally binding. For more complex enquiries, please contact ICO directly. They offer a variety of contact channels – live chat, e-mail, and over the phone.
Originally published Sep 15, 2020 3:20:45 PM, updated July 31 2023.