FASHION LAW Cookies – what do online fashion


retailers have to do to comply? (and why your social media targeting may be unlawful) By Ben Nolan & Stephen Sidkin.


W


hen a consumer views some shoes on your website, will they see it on their newsfeed next time they log in to their Facebook or Instagram account?


If so, do you know whether you are complying with the law when using the cookies and tracking technologies (such as the Facebook pixel) which result in this happening?


A quick check online at the end of January showed that some of the UK’s


largest retailers, such as Sports Direct and Boohoo, are still not complying with the rules.


For some time, the position as to the use of cookies and similar technologies


(referred to generally as “cookies”) was unclear, particularly following the introduction of the General Data Protection Regulation (“GDPR”). Retailers have generally taken advantage of this uncertainty, with many using a wide range of cookies on their websites by default, allowing them to gain a greater insight into their customers and target them through digital channels, such as their social media feeds.


However, recent guidance from the UK’s data protection regulator


(“ICO Guidance”) has helped to shed some light on the matter. The regulations which govern the use of cookies in the UK (which are based on


an EU directive) provide that website operators may only use cookies where:


1. clear and comprehensive information about the purposes of, or access to, the information in the cookie are provided to the user; and


2. the consent of the user has been obtained (unless the cookie falls within the “strictly necessary” exemption – as described further below).


ICO Guidance The ICO Guidance has now helped to clarify the above requirements. The key points are as follows: 1. Clarification of the “strictly necessary” exemption User consent is not required for cookies which are “strictly necessary”. This


means that the use of the cookie must be “essential” for the provision of the service which has been requested by the user or to ensure compliance with applicable law.


Perhaps not surprisingly, the ICO Guidance clarifies that advertising cookies,


such as the Facebook pixel, which are commonly used by retailers and allow them to target users online (for example, through their social media accounts) are not considered to be “strictly necessary”.


Examples of the types of cookies which would benefit from this exemption include those which:


• remember the goods in a user’s basket when a user is shopping online; or


• are required to provide adequate security standards to ensure compliance with the GDPR. It follows that cookies which are often considered important but are not


essential to the provision of the service to the user or for compliance with the law, such as analytics cookies, do not come within the strictly necessary exemption. Accordingly “performance cookies”, such as Google Analytics, which measure the way in which individuals use a website and can help evaluate the success of promotions and campaigns are not covered by this exemption.


2. Clear and comprehensive information


The ICO Guidance emphasises the need to provide users with transparent information concerning the use of cookies. The information provided must be in line with the higher standards of transparency as required by the GDPR, meaning it must be presented in a “concise, transparent, intelligible and easily accessible form, using clear and plain language”.


Stephen Sidkin is a partner in Fox Williams LLP and chairs its Fashion Law Group


www.foxwilliams.com - www.fashionlaw.co.uk www.agentlaw.co.uk - www.distributorlaw.co.uk


FEBRUARY 2020 • FOOTWEAR TODAY • 15


In relation to cookies, this means that online retailers need to review and


update their cookies policies to ensure that these are drafted in a sufficiently clear and easily accessible manner to be understood by a normal user.


3. The standard of consent is high


The ICO confirmed that the standard of consent for using cookies is the same as that set out under the GDPR, even for cookies which do not involve the processing of personal data. Under the GDPR consent must be:


• fully informed and freely given; • express as opposed to implied; • specific (that is, not bundled with other matters); and • capable of being withdrawn. Implied consent can no longer be relied on for cookies. Websites which use


non-essential cookies without specifically requiring users to consent to these upon their first access to a site are therefore not compliant. As a result, non- essential cookies should be switched off by default.


Of the various fashion retailers’ websites that we reviewed at the end of


January 2020, a large proportion of these were still relying on implied consent, using language along the lines of: “By continuing to use our website, you consent to us using cookies in accordance with our cookies policy”. This does not constitute a valid consent under the relevant regulations.


Take home points


• If past history is anything to go on, it would be reasonable to expect the ICO to seek to make examples of businesses which do not comply in the future. Meanwhile it is the case that the ICO is currently receiving a large number of complaints in relation to cookies and it can be expected that this is also resulting in bad publicity for the retailers concerned on social media.


• Irrespective of the above potential ICO fines and bad publicity, retailers are being trolled by some individuals who are bringing court cases claiming infringement of data protection law and forcing retailers to settle out of court by paying them off.


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52  |  Page 53  |  Page 54  |  Page 55  |  Page 56  |  Page 57  |  Page 58  |  Page 59  |  Page 60  |  Page 61  |  Page 62  |  Page 63  |  Page 64  |  Page 65