Cookie Law - is it really important?

What are the legal problems I could have if I don't put a cookie policy on my website?

 

is it really worth it not to add a cookie popup from a free website, and find out the hard way?

 

I'm assuming you're talking about the EU "cookie law"?

It's a bit of a misnomer - it actually applies to any tracking mechanism, not just cookies.

There is an exception if the cookies are *technically essential* e.g. to provide a "remember me" feature on a login form, for load balancing, or to remember the contents of users' online shopping baskets.

In these cases it's reasonable that the user, by visiting your website or asking to be remembered, would expect and consent to the mechanism used to achieve this.

They would not necessarily consent, and you would need to explicitly obtain opt-in consent, for a tracking cookie/mechanism for any other purpose.

New powers put the maximum penalty for non-compliance up to £500,000 in the UK (previously only £5,000). Even if you are not based in the EU or the UK, if you have customers from the EU you may still be required to comply with the ruling.

Here is the guidance from ICO (a really good source for readable advice on the subject):

There is an exemption if:

• the cookie is for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or
• the cookie is strictly necessary to provide an ‘information society service’ (eg a service over the internet) requested by the subscriber or user. Note that it must be essential to fulfil their request – cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent.

This means you are unlikely to need consent for:

• cookies used to remember the goods a user wishes to buy when they add goods to their online basket or proceed to the checkout on an internet shopping website;
• session cookies providing security that is essential to comply with data protection security requirements for an online service the user has requested – eg online banking services; or
• load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers.

However, it is still good practice to provide users with information about these cookies, even if you do not need consent.