Privacy expert: Google pushed for cookie law delay

A privacy advocate has accused Google, the Department of Culture, Media and Sport and the Information Commissioner’s Office of colluding to shape the way the EU’s “cookie directive” was implemented in Britain.

The allegations date back to May last year, when the ePrivacy Directive was being transposed into national laws, with the intention of giving web users more control of behavioural tracking tools used by advertisers and websites.

The ICO initially appeared to be taking a hard line on how cookies should be deployed, saying that browser settings were not enough to infer acceptance of tracking.

However, the stance was at odds with the Government’s position, and the ICO soon appeared to soften its line on the regulations.

According to privacy advocate Alexander Hanff, who works with groups such as Privacy International, the change of heart followed meetings between Google and the DCMS, and came at a time when Google was talking about significant investment in the UK economy.

The communication clearly shows that Google suggested the UK Government should ignore the deadline to implement the changes in to UK law

“I became suspicious given the information I had been passed by various third parties, so I decided to apply for disclosure under the Freedom of Information Act 2000 to find out whether the Information Commissioner’s Office (which is supposed to be independent of Government) had been coerced into their 180-degree change of position by a Government agency, specifically the Department for Culture, Media and Sport,” Hanff said in a blog post.

Google email

In response to initial FOI Act requests, Hanff received a copy of an email from Google’s UK managing director, Matt Brittin, in which Google appeared to put pressure on the DCMS, complaining about how a user’s consent to receive cookies is obtained “via the amendment or setting of controls”.

“We are extremely concerned about the implications of this,” Brittin said. “This is not the wording in the Directive and therefore is not the approach that the DCMS consulted upon last year. As such, it appears to be `gold-plating’ a European Directive in a way we understand the coalition Government has committed not to do.”

Google went on to suggest the UK delayed the implementation of the cookie laws in order to further consult with business and protect the UK’s valuable e-commerce sector.

“I was outraged; the communication clearly shows that Google suggested the UK Government should ignore the deadline to implement the changes in to UK law – which is exactly what happened,” Hanff said.

Regulations not ready

Hanff also suspected the ICO of being swayed by the DCMS, given its change of stance over the the severity of regulation.

At the time, the DCMS said it was not ready to impose the regulations and that the ICO would not be expected to enforce any breach of the laws when they technically came into effect on 25 May 2011.

“We recognise that work will not be complete by the implementation deadline,” said Culture Minister Ed Vaizey at the time.

“The Government is clear that it will take time for meaningful solutions to be developed, evaluated and rolled out. Therefore we do not expect the ICO to take enforcement action in the short term against businesses and organisations as they work out how to address their use of cookies.”

However, when Hanff requested details of the data watchdog’s communications with DCMS over the issue under the Freedom of Information Act – which is policed by the ICO – the request was turned down.

The ICO claimed revealing the information was not in the public interest and that the communications were subject to “Attorney-Client Privilege”.

Official response
Google declined to comment on the allegations, but both the ICO and DCMS denied any wrongdoing and said the ICO’s position remained independent.

“The ICO’s decision to give organisations a 12-month lead-in period to comply with the new Regulations was made independently. Any suggestion otherwise is wholly inaccurate,” an ICO spokesperson said.

“It would run contrary to the principles of good regulation to enforce a new law straight away when we knew it would take time for businesses to develop compliance solutions. In the context of the cookie rules, websites were not capable of complying immediately.”

The DCMS said: “It is completely wrong to suggest the Government ‘put pressure’ on the Information Commissioner’s Office.

“The Government carried out a full public consultation and considered a range of views on implementing the e-privacy directive. The ICO is an independent regulatory authority and it takes its own decisions on enforcement.”