Privacy and Security TidBits

The New EU Cookie Directive Leads to Cookie Wars in The Netherlands

The Dutch Ministry of Economic Affairs, Agriculture and Innovation has introduced a new bill with the goal of implementing the EU ePrivacy Directive 2002/58/EC, as amended by the so-called “Cookie Directive” 10/2009. The dealine for EU member states to implement the “Cookie Directive” into national law is May 25, 2011.

As of now, the Dutch law requires an opt-out regime for cookies: users need to be informed about the placement of tracking cookies, and they need to have an option to opt-out of having these cookies placed on their computers.

In the initial proposal for the new bill, the Minister of Economic Affairs proposed an “unambiguous consent” requirement, which caused a big uproar. That would have involved having a window pop up each time a cookie was placed with the request “Do you want this cookie placed on your computer?” and was deemed to be very impractical by the ad industry.

The Minister thereafter dropped the “unambiguous consent” requirement and changed it into just “consent”, and also mentioned that this consent can be given through activation of the appropriate browser settings, as long as the user is properly informed.

The ad industry claims that self-regulation through placement of icons by each behavioral advertisement would be sufficient to provide the user with the necessary information and opt-out choices.

Since the Independent Post and Telecommunications Authority (OPTA), will be in charge of supervising the application of the new cookie law, it has requested an independent study from TNO (Netherlands Organisation for Applied Scientific Research) and IVIR (Institute for Information Law), in order to find out how well website owners have abided until now by the current Dutch cookie law. The current law requires that the user needs to be informed and given the possibility of opting out of having tracking cookies placed on their computer.

The study, published on March 17, came to the conclusion that the majority of Dutch website owners do not abide by these laws, that the majority of Dutch people have no clue about their rights under the current law, and do not have sufficient understanding of the cookie tracking mechanisms to even make an informed choice, or to give meaningful consent. See this Dutch article.

The publication of this study has led to angry reactions from the advertisement industry. Joris van Heukelom, president of International Advertising Bureau (IAB), claimed that the study was biased and Henry Meijdam, president of the Dutch Dialogue Marketing Association (DDMA), said that the study misrepresented the current legal requirements and that the current Dutch law did not require consent for the placing of cookies.

The ad industry did aknowledge that the general public is ignorant about the placing and working of tracking cookies. Advertisers and marketers claim that they are busy with self regulating measures, like the placement of icons by each behavioral advertisement, to inform the web users of the workings of cookies and behavioral tracking and to give users the chance to opt-out of being tracked.

In this previous post, this author has made it quite clear that the way the AdChoice icons currently are implemented is very user-unfriendly and that the AdChoice icons, while giving the user a choice to opt-out of being shown behavioral advertisements, does not guarantee a choice of opting out of being tracked.