The UK government earlier this year announced its plans to legislate against the hordes of cookie banners and pop-ups which are prevalent across the modern web – but it didn’t say exactly how it planned to do this while still getting users’ permission to drop cookies.
Now the government has revealed its strategy – stop asking for permission.
As part of its post-Brexit Data Reform Bill, the government will switch from an opt-in mandate for use of cookies to an opt-out model, meaning that publishers can drop cookies on users’ browsers without asking for consent first. This rule won’t apply however to websites which are likely to be used by children.
Under the opt-out model, users will be able to block non-essential cookies at the browser level, or using a similar technology which sets preferences across multiple websites. And they’ll still be able to reject cookies for individual websites. The difference is that they will have to actively choose to do so – and websites will be able to drop cookies until they receive that explicit opt-out signal.
A big change of course?
The UK’s approach is markedly different from that taken by the European Union, which requires specific opt-in consent.
Theoretically, this is a big difference for the UK. While third-party cookies are being deprecated anyway, first-party cookies will still play a significant role in ads personalisation and measurement – and in the UK publishers will be able to drop these cookies more freely in the future. So potentially we’ll see a big gap open up between the ability of publishers to target and measure their ads in the UK compared with the EU.
But the difference may not be quite so big, for a number of reasons.
Despite the fact that they seemingly violate the EU’s General Data Protection Regulation, many websites still use cookie consent mechanisms which either use dark patterns to encourage users to opt-in, or simply haven’t switched to a true opt-in model (e.g, still telling users that their continued use of the website is taken as consent for use of cookies).
The EU is cracking down on this with the Digital Services Act. But nonetheless, for the time being at least, it can be argued that many websites’ opt-in models are really closer to opt-out models, at least in terms of the number of users who end up giving consent.
Other forces could end up rendering the UK’s move somewhat obsolete anyway. The government’s proposal says it will only move to an opt-out model once technologies which allow mass blocking of cookies are widely available and functional. But web browsers, which are by-and-large pushing into privacy, could choose to set ‘reject all’ as the default option for non-essential cookies within these tools anyway (which is already the case on Safari).
