So what is going on? Why have websites decided to inflict this on us, and did they really need to do it?
The clue is in the timing: the last weekend in May marked the end of the "grace period" for websites to comply with new laws, requiring all EU websites to obtain prior consent before placing cookies on users' computers or mobile devices.
Cookies are small text files used to recognise and track website visitors, and the new law is intended to address privacy concerns about their use. The law came into force in May 2011, but the UK Information Commissioner's Office (ICO) announced a grace period of twelve months to give websites time to comply. In the event, almost no websites took any visible steps to comply with the new law until the very end of the grace period, at which point the current flurry of pop-ups started to appear.
What should websites be doing?
Any website owners who have not taken action – or who are wondering if they've taken the right approach – should take a look at the ICO's very clear and practical guidance on how to comply with the new law. The key point from the ICO guidance is that explicit consent – a user actively clicking a "yes" button – is not necessary. Implied consent will be sufficient for most purposes.
As for how you can obtain (or infer) consent from users, the ICO recognises the appeal of pop-ups or header bars as "an easy option to achieve compliance". However, the ICO also recognises that these "might well spoil the experience of using a website", as plenty of exasperated users can now testify. One approach is to have a fairly low-key message and then to infer consent if a user continues to use the website, which appears to be the approach taken by the Guardian.
Another approach is to obtain consent when people accept your website's terms and conditions, for example if registering on the site or making a purchase. However, most websites will want to place cookies before people register, and it will also require asking existing registered users to agree to the change in terms which allows you to place cookies.
Finally, in many cases information about cookie use can be built into the parts of your website that need them. For example, when people are setting options or using a new feature, you can inform them at that stage that this will involve setting a cookie.
Cookies which are purely 'technical' and necessary for the website to function properly don't need consent – this could include cookies used for a shopping basket, or to ensure that a user's login session is kept secure.
'Analytics' cookies are probably the most common type of cookie used on websites. These are used to count the number of visits to the site, and to find out other information about visitors: how they entered and left the site, how long they stayed on the site, and so on.
The ICO's official position on analytics cookies is that they are not technically necessary for sites to function, so consent is required. However, they go on to state that they are "highly unlikely to prioritise" analytics cookies provided information is made available to users about them.
The most problematic area is precisely the area that the new law is most intended to address: third party cookies, in particular cookies used by online advertising networks. These are seen as having the biggest impact on user privacy, and the ICO advises website owners to ensure that "they are doing everything they can to get the right information to users" and enable users to make "informed choices". However, detailed practical guidance remains sketchy.
So what should I do?
The first step is to download the ICO's guidance and see how your website fits into it. What types of cookies does your site use, and why? Then make sure you are providing appropriate information as described in the guidance.
As for obtaining consent, that will depend on what type of cookies you are using and how people use your site. However, it does look like many of the pop-ups that have been seen on websites over the past month are far more intrusive than the ICO sees as necessary, so in many cases it may be sufficient to adopt a relatively low-key approach based on "implied consent".
In short, if you're annoying your users with how you're informing them about cookies, you don't need to be, and you can probably rethink this while still complying with the law.
John Halton is partner at Cripps Harries Hall