A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive. Most websites use cookies.
Organisations have to provide clear and comprehensive information about the way they use cookies, and ensure that for any cookie not strictly necessary for their website, they give users an appropriate means of consenting to that cookie being set on their device. As such the user/website visitor must actively consent to your use of any cookies, or you should not use them. The rules in this regard are strict, and there can be significant financial consequences including the possibility of fines and civil court action if you get things wrong. We have a precedent Cookies Policy available for your use on the FSB Legal and Business Hub.
Recently the Information Commissioner's Office (ICO) issued a reprimand to a company (trading as Sky Betting and Gaming), for unlawfully processing people's data by using advertising cookies without their consent.
The ICO announced in a press release that, from 10 January to 3 March 2023, Sky Betting and Gaming had processed people's personal data and shared it with advertising technology companies as soon as individuals accessed the SkyBet website, and before they were presented with an option to accept or reject advertising cookies. As such, their personal data could be used to target them with personalised adverts without their prior consent or knowledge, and the ICO concluded that Sky Betting and Gaming was processing personal data by using certain cookies in a way that was not lawful, transparent or fair.
Sky Betting and Gaming has since made changes to ensure that people can reject advertising cookies before their personal information is shared for targeted advertising purposes. The ICO state that they are currently working to crack down on websites that do not offer people a fair and informed choice over whether they want their personal information to be used for targeted advertising.
It would be wrong for small businesses to merely assume that because a big company “got away” with a slap on the wrists by way of a reprimand. Instead it should serve as a warning to all businesses that the ICO are monitoring this issue. Furthermore, as stated above, sanctions from the ICO are only one of the possible consequences of a business failing to comply with the law in this regard. Business could, for example have legal proceedings bought against them by individual website users, particularly if they can demonstrate that the failure can causes them loss, damage or harm.