On 21 November 2023, the UK Information Commissioner’s Office (the ‘ICO’) released a statement explaining that it has recently written to companies running many of the UK’s most visited websites regarding their use of cookies and compliance with data protection laws. The ICO mentioned that some websites are not giving users fair choices as to whether or not they are tracked for personalised advertising, and referred to its previously issued guidance on making it just as easy for users to ‘Reject All’ advertising cookies as it is to ‘Accept All’ advertising cookies.
These companies have been given 30 days to update their websites to ensure they comply with the law. Stephen Almond, ICO Executive Director of Regulatory Risk, has said “Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences.” The ICO has said that it will provide an update on this work in January 2024, including details of companies that have not addressed its concerns.
In order to avoid the high-reaching consequences of breaching data protection laws in respect of cookies, UK companies should ensure that:
- their websites operate in a way which makes it simple for users to reject cookies, as well as accept cookies; and
- their cookies policies are up to date and in compliance with data protection laws.
If you need to discuss any of the issues raised above, please contact Saba Mumraz.
For further information, please contact:
Saba Mumraz, Hill Dickinson
saba.mumraz@hilldickinson.com
