Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the adequacy of the regulation of (a) optional and (b) essential website cookies.

We are taking steps in the Data Protection and Digital Information (No. 2) Bill (DPDI Bill) to reform the provisions in the Privacy and Electronic Communications Regulations 2003 (PEC Regulations) which set the rules on the use of cookies (and similar technologies).

The current legislation prohibits organisations from placing cookies on a person’s computer, or other connected device without consent, unless they are essential for the provision of a requested service (for example, to remember what is in their online basket).

In practice, this means that web users may experience multiple cookie ‘pop-up’ notices on every website they visit which can negatively affect their browsing experience. That is why

the Bill will remove the need to seek consent for the placement of some types of cookies that pose low privacy risks, such as those used to count the number of visitors to a web page. As a result of these changes, web users will know that if they continue to see cookie pop up banners, it is because their personal data may be used for more intrusive purposes, such as profiling for advertising purposes.

The Bill will also allow the Secretary of State to update the list of cookies that do not require consent through the use of regulations. This could be useful if other non-intrusive uses of cookies are identified or, when people become more confident about using different technology, such as browser and device settings, to set their online preferences.

The DPDI Bill was published on 8 March 2023 and can be found here.