Hands Back in the Cookie Jar? A Look at What Updated Cookie Legislation Could Mean for UK Businesses

Following the UK government’s data reform bill update this week, we’ve created a freshly-baked tray of thoughts about what this could mean for UK website owners.

So what does the bill contain? Alongside increased fines for nuisance calls and texts, and more freedom for scientific researchers to conduct trials, a key proposal is overturning the way in which consent is captured for the deployment of cookies. Under the new bill, websites would no longer need users to opt-in before cookies are placed – rather, it would be on the user to opt-out.

Quick recap: what are cookies? Cookies are small text files which are stored in your browser by websites. Essentially, they’re a way of remembering who you are and how you interact with a site. There are three broad uses for cookie data; essential cookies, which support the basic functionality of a website (for example remembering what’s in your basket on an online storey); analytics cookies, used to send website usage and traffic statistics; and advertising cookies, which are used to feed information back into platforms such as Facebook and Google around how successful campaigns are, as well as to create audiences for digital advertising activity.

Why has this legislation come about? The press release centres the proposed change around user experience, and “minimising annoying cookie pop-ups,” whilst retaining the UK’s “gold standard” in data protection, a move supported by the UK’s Information Commissioner. Following the UK’s departure from the EU, the UK GDPR has retained much of the governing principles contained within its EU counterpart, so this would be a first move to a distinct set of laws, which seemingly allow for more flexibility.  Whilst not strictly personally identifiable information, cookies are still classified as ‘online identifiers’ by the ICO, meaning that consent is needed to use them in most circumstances.

What could the impact of the data reform be on these different categories of cookie?

Necessary cookies are already placed regardless of consent status, so we don’t expect anything to change here.

Analytics cookies. This could be a huge upside for marketers. Currently, if a user opts out of analytics cookies on a website, analytics platforms such as Google Analytics aren’t able to receive key data such as user numbers, leading to a falsified drop in reported traffic. This can be resolved using server-side tracking, but this can be challenging to set up and the complexity often prices-out smaller businesses who may not have access to extensive developer resources. There’s also a cost associated with hosting the server infrastructure required. Automatically enabling analytics cookies would give analysts a more complete view of who visits their website, and how they interact with it.

Advertising cookies. Perhaps the most visible change could be seen if advertising cookies are placed as a default. This would enable advertisers to gather larger audiences for retargeting campaigns, so users may begin to see more targeted display advertising on their devices. Crucially, these cookies also report conversion data back into platforms, to guide the algorithms in which campaigns are providing the most bang for buck and returning the best results for a campaign objective. Under the current opt-in framework, we’ve seen clients lose visibility of up to 50% of their in-platform conversion data, which is a killer with many ad platforms’ increasingly using automated bidding based on conversions. This has meant that the use of offline conversion uploads are of the utmost importance to ensure the success of paid advertising. Being able to track more conversions would add that layer of visibility back, resulting in the perfect blend of first and third party data to optimise campaign performance.

Embryo’s Head of PPC, Callum Leonard commented:

“The proposal for a reformed cookie legislation would be welcomed with open arms by the paid advertising arm of digital marketing. With the increased restrictions around data protection and privacy, advertisers have felt the strain greatly.

Increasingly tight parameters have required the utilisation of software such as CookieYes to guarantee website compliance with Google’s regulations.

These cookie policy parameters are very black and white, and if users decline or even ignore the pop ups – no tracking on websites has the ability to fire.

Loss of data within paid marketing is the most damaging scenario to occur especially with the use of automated bidding becoming prevalent

I’m optimistic about the announcement of change, but it will be interesting to see if the bill does pass, Google’s reaction, the process for worldwide businesses and how we ensure the balance of data accessibility and user privacy.”

Are there any possible downsides or limitations to this reform? As with any legislation covering access to personal data, there will likely be opposition from privacy campaigners. However, it’s still early days regarding the granular detail of this bill, and the scope of any changes. It’s also worth remembering that many tech companies, such as Apple and Google, are in the process of rolling out their own changes to the use of cookies and tracking – most notably the iOS14 update from last year. These may fall outside the governance of any updated cookie legislation. In any case, the fine balancing act of data protection of individuals versus data transparency for businesses looks set to continue.

We’ll be keeping an eye out for updates to the bill, and will be keen to see how the government consults with the marketing industry to shape the details and mechanics of how this can be practically implemented by businesses.