
How everyone used to comply and why that won’t work The way that you make websites, and the way you ask for cookies will have to change completely. Together these changes should help privacy, but they’re going to be an absolute nightmare for website owners, and we’re sceptical how they’ll work in real life. You must provide access to your service without cookies, unless the cookies are technically required for it to function (e.g. Under the new guidance, this is expressly forbidden. Many websites block access until a user accepts their cookies. No denying access just because you don’t accept cookies (image source: Information Commissioner’s Office) 3. The ICO explicitly says this is not allowed: “A consent mechanism that emphasizes ‘agree’ or ‘allow’ over ‘reject’ or ‘block’ represents a non-compliant approach”. Nearly every cookie solution ever emphasizes accepting over denying cookies. In practical terms, this makes analytics worthless in the UK, as almost no-one is going to opt in, and you won’t know what percentage of your visitors did. To give you a compliant example, the ICO uses this cookie sidebar: This means no Google Analytics, no Facebook buttons, no comment boxes, no social plugins, and no tracking pixels unless the user has explicitly chosen to enable them first. No non-essential cookies until you ask first It’s all about things that you can’t do: 1. Now the UK body responsible for policing these laws has published new guidelines on how we must comply. The result has been wasted time, smaller screens, and precisely zero improvements to privacy.



Since then we have all grown used to a crappier Internet, where users routinely dismiss popups without reading them. Not that long ago some well-meaning-but-dumb laws required that websites ask for permission to set cookies. Share via Facebook (opens in a new tab).Share via LinkedIn (opens in a new tab).
