Digital Governance – A holistic view to compliance
The first point made was that, although the Cookie Law is the flavour of the month, compliance in the digital world is becoming increasingly necessary and therefore you should also take steps to:

• Protect your brand
• Maximise your ROI by aligning everything with your Business Objectives and ensuring its effectiveness
• Ensure all Regulatory and Legal requirements are met
• Fully understand your entire digital estate and what you own
• Make sure your assets are secure (e.g. from hacking)

and make sure that compliance and effectiveness is regularly monitored.

Then, of course, there is also “non-controlled” content i.e. what others are saying about you. You should be listening to this and exploring it through sentiment analysis.

So, on to what we were there for:

The “Cookie Law”
Ecouraginglythe advice was the same as that given previously by the ICO, i.e. that if you complete the following, that is a great start to the journey:

• Audit your assets
• Offer clear, accurate information on cookies
• Provide well-defined navigation to the detail

and, if you have a plan for your journey, then you have “stated your intent”.

One useful piece of advice was to use these changes as a marketing exercise, using it to help build that all-important online trust. So send out emails and tweet about the changes. Of course, that will also act as auditable proof that you have communicated!

N.B. If you look at the ICO privacy policy you will see against one cookie : “It is not used by the ICO for any purpose”. Nice to see that no-one is perfect! However, they are working to remove it and, if you find you have cookies that you don’t need, then you should do the same.

As noted previously, the least clear area lies in the definition of “Implied Consent”. Providing clear instructions on how to change cookie settings in your browser does seem to be sufficient at present. Don’t hide the navigation at the bottom of the page - put it at the top or in the bottom corner of the page (but in such a way that it doesn’t disappear when scrolling – see http://www.abc.org.uk for a neat implementation). Finally, it was recommended to keep the Cookie information separate from the Privacy Policy (which can be longer than War and Peace!).

One question that remained answered was “What do we do about Mobile e.g. GeoLocation”? I guess that falls into the category of “lets cross that bridge…”.

Three other things to consider:

1. You are responsible for all cookies placed by visitors on your site, even when placed by a third party (e.g. for ad placement). It may be impossible to define all of these (think of a newspaper or job site where there will be many thousands of ads and they may change for each visit!), so you can only do what you can do and wait for industry best practice to become clear. Your suppliers should help you here (although it is as murky for them as the rest of us!)
2. Talking of suppliers, do you know who has access to your site to provide content (and potentially set cookies)? There are not just those ad placements, but anyone that embeds content. For example, did you know that a Facebook icon on your site will set a cookie? Can you guarantee that (a) you have found them all and (b) they do not change over time? This highlights the need to make this a continuous process. Many sites now state in their Cookie Policy page when the last audit was completed (and hence, by inference, how up-to-date the page is).
3. Ensure you have considered flash cookies. These cannot be changed by browser settings and, are potentially the most invasive of all as they can be programmed to achieve virtually anything.

Legal Consequences
While the law is so unclear, no one is able to provide proper legal advice. However, there is a consensus that even if the ICO do prosecute, it would only be someone who is being particularly underhand and hiding what they are doing. So, anyone “on the journey” will be fine.

I liked a couple of quotes so much that I recorded them verbatim:

• “It’s a nightmare to be honest. It is risk management, do you, don’t you?”
• “The ICO’s hands are tied… (because it will be so difficult to prosecute and see below)”

There even arose the interesting question as to whether the law is enforceable at all, because each country is implementing the Directive differently and EU rules do not allow any country to gain a competitive advantage through this. Also, the UK always implements new rules in the minimum timeframe of a year, whereas e.g. Germany goes for the maximum of five (don’t start me on that one!).

So, still clear as mud! However, it did confirm my view that “starting the journey” to full compliance is what everyone should be doing now and, meanwhile, we will all carry on looking out for that map!

Dave started by setting the background in terms we can all understand:

A man walks into a bar…
… and the barman pours him a pint of Blacksheep Bitter (don’t ask!) and a glass of red wine for his companion. Whilst that could usually be seen as excellent service, it would lead to awkward questions being asked by the wife that had never been there before! So, maybe we sometimes want to be able to opt out…
In digital terms it is all about content delivery. It is easy for marketing people to present the case for understanding the customer leading to tailored/targeted/personalised/more relevant service, but that doesn’t mean that everyone will give up everything to get it. N.B. Interestingly Dave also made the point that “the same people who say they want more relevant content are the same people who do not wish to be tracked online”, but that doesn’t let us off the hook!

The revised law based on the EU Directive

6. - (1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment -
(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) has given his or her consent
The key here being what constitutes consent and, more specifically, what about “implied consent”?

Do Browser Settings imply consent?
Browsers are progressing in terms of allowing the user to define their privacy settings and “can work and will be one method of gaining consent for all the cookies which you can honestly categorise as “privacy” neutral”. However, you need to show that “your website is not taking advantage of … people who might never have set or amended anything”.
In practice, this means:
1. Understanding what cookies you set and why
2. Providing full explanations of both the cookies set and what people can do if they don’t want them
3. Ensuring that this information is clearly navigable
N.B. You may have already heard of the ICO visitor traffic apparently falling off a cliff on the day they began asking the visitors to positively consent to cookies (http://www.computing.co.uk/ctg/news/2083389/90-cent-drop-visitors-ico-web-site-changes-eu-cookie-laws). So, it was encouraging to hear Dave Evans say this was an awful implementation and not to be recommended!

What about Web Analytics cookies?
As I work day-to-day with web analytics, this was obviously a key question for me.
He did say that “they are not exempt…BUT saying that analytics activity (is) allowed by the setting of a cookie is within the scope of the law is not the same as saying the law requires an opt-in model”.
Also, following a question on the performance-based digital marketing companies (i.e. where you pay for advertising based on the number of Clickthroughs that result in a conversion), he stated that even for the cookies required to do this, normal rules apply.

What next?
Going forwards, the ICO will be assessing what is happening and clarifying acceptable solutions to obtain implied consent and, in the meantime, “we all need to fill those gaps with evidence of good practice, practical and realistic guidance and consistency across websites”.
Finally, it was noted that “we (the ICO) need to do our job in a responsible and proportionate way; for this to happen we need assurances that the good work will continue”.
So, for those of us hoping to be given a definitive statement or concrete examples of what passes muster, we were disappointed. However, we were reassured that, as long as we can demonstrate we have taken genuine action towards being compliant, then that will suffice, for now!
Finally, if you want to read more about our Cookie Audit solution, which will take you on the first step of the journey to compliance, it is available at http://www.matraxis.co.uk/services/website-cookie-audit.htm, and includes FAQs on the EU Directive.

So

· Monday there was just one Visitor (A) and they were a New Visitor

· Tuesday both A and B came, B was a New Visitor, but A had come the previous day, so they were a Returning Visitor

· Wednesday, C was a New Visitor, but both A and B were a Returning Visitors

Hopefully that makes sense so far?

Then it starts getting more complicated!

For the week, we have the following:

Note that New vs. Returning Visitors report is actually counting Visits (not Visitors) and segmenting them by whether or not they were from New or Returning Visitors.  The total is the therefore the total number of Visits (not Visitors) and matches the total in the Visit Summary table.

To make sense of it you have to look at each number in isolation e.g.

· Visits by Returning Visitors = 3

· Visitors Who Visited More Than Once = 2

· (Unique) Visitors = 3

                not always appear to make immediate sense…

            Firstly – from the notes at the top of the Campaign report:

This report shows activity occurring during the report time period segmented according

to the campaign ID of the most recent campaigns. For the report time period, all conversions

and other activities are tracked and attributed to the last campaign to which visitors

responded. Thus, even if the conversion does not happen on the first visit generated by the

most recent campaign, the appropriate source is “credited” with the conversion.

                i.e. it will attribute later visits to the campaign as well, regardless of whether or not they

                click through a second time.

                To answer the question about the difference between Visits, Page Views and Clickthroughs,

                from the Help Card at the bottom of the report:

·         Visits - A visit is a series of actions that begins when a visitor views their first page

        from the server, and ends when the visitor leaves the site or remains idle beyond

         the idle-time limit. The default idle-time limit is thirty minutes. 

·         Page Views - A hit to any file classified as a page. (i.e. it does not include

        downloads etc.)

·         Clickthroughs - A single instance of a click on an advertisement link.

        (More accurately whenever the visitor looks at any URL which includes the

        WT.mc_id parameter on the end)

                I thought this would be explained best with a short example:

        Consider 3 people who click on a link including the campaign id:

1.       Fred – arrives on the site and goes on to a second page

2.       Bert – arrives on the site, goes on to a second page and then either:

a.        Presses the browser back button

b.       Clicks through again

(we can’t tell which)

3.       Tom – arrives on the site and goes on to a second page which he bookmarks

        in the morning.  Returns via the bookmark in the afternoon

In a table:

So:

1.       Fred – is straightforward

2.       Bert – has 1 Visit (no gap of greater than 30 minutes), but 2 clickthroughs because

        the WT.mc_id parameter appears twice

3.       Tom – has 2 visits (there is a gap greater than 30 minutes), only 1 clickthrough

        (because the WT.mc_id parameter appears only once), but this second visit is still

        attributed to the earlier clickthrough from the campaign

However, the Information Commissioner’s Office (ICO) launched a privacy notices code of practice on 12 June 2009 for both websites and other media which has proved very useful.

In brief, it states that businesses must legally process personal information fairly, and a privacy notice should state:

· the identity of the organisation in control of the processing

· the purpose or purposes for which the information will be processed

· any further information necessary in the circumstances to enable the processing in respect of the individual to be fair.

The full document is surprisingly easy to read and I can recommend it – available from the ICO website…