Wondering how your business will address the new law that requires users
to opt in to cookies? There’s good news: you can procrastinate.

That’s because the ICO, perhaps facing the reality that the new law is
fatally flawed, has decided to give everyone amnesty (as the Telegraph
calls it) for violating the law over the course of the next year.

According to the ICO’s Christopher Graham, “We’re giving businesses and organisations up to one year to get their house in order.” Translation: we’re not sure how to implement or enforce this law, so please hold tight.

Which highlights the one big problem with the delay: the ICO really hasn’t told companies how to get their house in order.

As I’ve noted before, the ICO has essentially punted on the issue of third party cookies, but those are the cookies that generally cause the greatest privacy concerns.

What is instructional is how the ICO has chosen to handle cookies on its website. If you go to http://www.ico.gov.uk/, you’re now greeted with the following message:

On 26 May 2011, the rules about cookies on websites changed. This site uses cookies. One of the cookies we use is essential for parts of the site to operate and has already been set.

You may delete and block all cookies from this site, but parts of the site will not work. To find out more about cookies on this website and how to delete cookies, see our privacy notice.

Below this message is a “I accept cookies from this site” checkbox and a Continue button.

Needless to say, this doesn’t provide for the most elegant user experience and realistically, this sort of implementation isn’t viable on a commercial site. After all, there’s a good chance that visitors not opposed to cookies will not accept them because they don’t see or understand the message.

So what should businesses do? Wait and see. The ICO isn’t going to be enforcing its new cookie law for a year because it doesn’t know how to.

As The Telegraph notes, the person who is responsible for implementing the cookie law has told worried advertisers and retailers, “there is no indication in the definition as to when that consent may be given, and so it is possible that consent may be given after or during [data] processing.” Whatever that means.

At the end of the day, there is no indication that the new cookie law will ever be deciphered, and in a year’s time, it’s likely that everyone will still be at square one.