The effect the EU cookie law has on websites, marketing and users

Following the post “The implications of the EU Cookie Law” I thought I would clarify what impact there could be for online businesses and users who use cookies. But first we need to review first principles:

1. HTTP is stateless, a website does not know who you are from a simple browser request
2. A session can be maintained by a website where it can recognise a user for a period of time or during a series of transactions by using either encoded URLs or session based cookies that are stored in temporary memory.  In this scenario only an ID related to a session is stored with no user specific details.
3. By using a persistent cookie a user can be recognised across different sessions even if the browser has been closed.  These cookies hold personal details about the user stored in text files on the user’s’ machine.
4. There are two types of persistent cookies, first party cookies given directly from the site you are accessing and third party cookies given by third party services used by the site you are accessing.

So if we assume the EU Cookie law pertains to the consent of persistent cookies, how would this actually effect websites, marketing and user experience? Well let’s look at the broad areas of functionality persistent cookies support:

• “Remember me” and silent log–ins.  We have all become used to not having to remember every username and password as we flitter from Facebook, to hotmail, and twitter.  Compliance for these types of cookies should be relatively easy as consent is given for “Remember me” during log-in, all that is needed to meet the requirement for comprehensive information is a link at log-in to the privacy statement. 
• Site analytics – Cookies are used by site analysis systems(Google analytics, Ominiture, WebTrends, etc) to track a customer’s behaviour while browsing a website to provide behaviour profiles and insights into areas such as drop-outs during checkout, product conversion and campaign effectiveness.  The issue here is statistical data will be inconsistent and incomplete if large numbers of users opt out as they don’t see any value in accepting these cookies.  Site analytics can still track general traffic statistics but these often prove to be to generic or technical to be off real use to the business users.
• Personalised recommendations and content – Product recommendations are becoming more sophisticated going beyond simple logic based on previous transactions and popularity.  There are now dedicated technologies which can track an individual customer’s interactions with a website and recommend products based on their patterns of behaviour. Many of these technologies such as Coremetrics rely on cookies to identify a customer as they interact with a website and some services such as Aggregate Knowledge capture details from across the sites they are active on. Without persistent cookies these systems are incapable of providing personalized recommendations, however, there are services such as Certona and Baynote that can provide personalized content without the use of cookies.
• Multi-Variant-Testing (MVT), Targeting and segmentation – this is similar to personalised content but works on the concept of targeting different versions of content to customers or customer segments and then testing and analysing its effectiveness e.g.. Omniture Test & Target.  MVT is used for simple actions such as optimising home/landing pages to defining complex merchandising strategies and promotions.  These tools often rely on persistent cookies to track the effect of targeted content on users and allow further targeted content to be optimised.
• Targeted Marketing – Sites with display advertising (banner ads etc) will almost certainly drop third party cookies on a user’s machine from marketing networks ad servers.  These cookies are used by the marketing companies to track and target users during any time spent on sites which uses the same ad server. 

There are other methods that can be used for simple tracking, however, the reasons why cookies are the most commonly method for tracking is they enable:

• A specific banner or link that the web visitor clicked to be tracked
• Tracking of users browsing behaviour across multiple sites while the cookie is active
• The tracking of conversion for the period of time the cookie is active
• The tracking of repeated sales
• Ads to “re-target” products a user has viewed on pervious visits to eCommerce websites.
• Ads to be personalized based on a user behavior profile

The use of cookies by marketing companies is probably the most contentious.  Many of the cookies used are identified as malicious cookies by anit-virus and spyware sites for example the revsci cookie is often represented as a malicious cookie.  spywareremove.com 

say this cookie comes from porn and gambling sites.  However, this cookie is distributed by Revenue Science through websites such as guardian.co.uk, foxnews.com and timesonline.co.uk and is used for behavioral targeted of ads.  Revenue Science even quotes a Forrester report on their homepage stating that an Independent Study Finds that Online Shoppers are More Receptive to Behaviorally Targeted Ads than Contextual Ads.   Even if we are more receptive to targeted ads we may not necessarily want to consent to our behavior being tracked by cookies. 

The argument to whether users consent to having targeted Ads or any other service using cookies will depend upon the messaging and how the information for cookies is presented to users.