Blog

With only days to go until the EU Cookie Law comes into effect, many website operators are likely to be wondering just how the new law will affect their ability to, among other things, make use of services like Google Analytics. This is a real concern; since tracking cookies such as Google Analytics are not considered to be ‘essential’ to a website’s operation, consent is needed from users before they can be deployed.

This means that if a web user declines the cookies, website operators will no longer be able to track what they do on the site. If multiple users do this, the value of Google Analytics data will naturally go down and it will be harder to make use of it as a resource. This is something that could affect a huge proportion of websites – it is thought that of the top 10,000 websites, 57% make use of Google Analytics. Many more use similar alternatives such as Statcounter.

We’re going to focus on Google Analytics in this post since that is the major player when it comes to this sort of software, but similar issues are likely to apply to Statcounter and other analytics alternatives.

Currently, Google Analytics automatically sets four cookies. There is also an optional fifth cookie that gives website owners the option to share website traffic information with Google. There is something called a first party cookie that is set by Google Analytics that means if you utilise it on your website, you will only need to gain user consent once before it can be used (in contrast to ‘third party’ cookies that require consent each time they are used).

If you have the fifth optional cookie enabled that passes information back to Google, this will also need to be made clear on your website so that users can see who you are passing information to and what the purpose of this is. The Information Commissioners Office makes the suggestion of having text in a header or footer on your website to highlight the cookies and what they are used for. Google Analytics says that website information they receive is typically used for ‘benchmarking’ performance of sites. This is the sort of thing that will also need consent from users.

From all of this, it is quite easy to see the scale of the impact that the Cookie Law could have on tools such as Google Analytics. However, it is thought that these sorts of cookies are considered to be low priority by the ICO. Their guidance states that ‘provided clear information is given about their activities we are unlikely to prioritise first-party cookies used only for analytical purposes in any consideration of regulatory action’.

Also, the Government’s Digital Service has acknowledged just how vital analytics are to government websites and that cookies are currently the most effective method for this. They say that the usage of these cookies tends to be controlled by a ‘first party’ and that they are minimally intrusive to users. This, plus the information from the ICO, suggests that as long as information about analytics cookies is made clear and that they are operated solely by first parties, compliance with the Cookie Law should not be too difficult. However, even though this sort of cookie might not be the highest of priorities, to not comply is still to break the law and so it’s an issue that needs to be taken seriously.

At this point in time, it isn’t entirely clear what the solution will be for analytics cookies requiring consent from users. Their usefulness has been admitted, but compliance is still important and so it isn’t inconceivable that the value of analytics data will be affected by users opting out of the cookies. Solutions could potentially come from a modification to the code used by Google Analytics, a browser-based solution or updated privacy policies, for example.

There are also a handful of non-cookie based analytics tools available. We’re currently testing one and will advise shortly on the results, but so far we’re seeing similar results coming back to Google Analytics – the downside, though, is that it’s a fee-based service.

The ICO blog has stated that there will be 'no knee-jerk formal enforcement action’ taken against sites that are taking steps to comply with the Cookie Law but who are not yet quite compliant, so there isn’t too much need to panic at this stage if you are still sorting out your compliance procedure.

However, only time will tell what the impact of the Cookie Law is on analytics results but for now it seems that the safest course of action is to do what you need to in order to comply with the law, make sure that your processes and policies are clearly defined and that users are made aware if you are using analytics cookies – and that a decent solution is found some time soon so that Analytics remains a useful, valuable resource for anyone who uses it.

Should you need any advice on implementing compliance with the new regulations, please contact us for further information and our Cookie Consent Service.

By Chelsey Evans

Follow @AmpheonLtd