Cookie monster unleashed following EU ruling

Browsing the internet may become frustrating as a ruling forces all websites to gather user consent before storing data

Browsing the internet may become frustrating as a ruling forces all websites to gather user consent before storing data

Most popular websites are yet to implement the new security measures.

Warning notices at the top of websites, annoying pop-up windows, forms asking for your consent ... fears have been voiced that browsing the web could become more complicated and time-consuming as a result of "challenging" new EU rules on internet cookies.

They are small text files put on to our computers by websites so they can remember things about us, and almost every site uses them.

But at one minute past midnight on Thursday 26 May, the law surrounding the way they are used changed.

From that date, all UK businesses and organisations running websites in this country were required to obtain people's consent before they install cookies on their machines.

Some experts have said that where the new rules could have a big impact is if people are looking at lots of different sites they have no relationship with. For example, you might be browsing a dozen online retailers looking for the best price on an item. The worst-case scenario is that every time you visit a new site, you face a pop-up window, a "splash page" (which comes up before the home page) or a bar at the top, informing you about how cookies are used on the site, and asking for your consent.

If you accept, you hopefully won't be bothered again while you are on the site. If you don't, some of the website's functions may not work properly, or it may not even let you in. But anyone who has been on the internet since Thursday morning will probably be wondering what on earth this is all about, because you will struggle to find a UK website that is obeying the new law by asking for your permission to use cookies.

This is because, in an eleventh-hour intervention, the UK government – which is not a fan of the rules – announced on Wednesday that no business or organisation would get into trouble if they effectively turn a blind eye to the new rules between now and May 2012, provided they can demonstrate they are taking steps to address the issue.

With the government declaring there "will be no immediate changes to how UK websites operate," many online retailers, publishers and other businesses will have breathed a sigh of relief. The Information Commissioner's Office (ICO), whose job is to protect individuals' data privacy, says it will be giving all operators up to 12 months "to get their house in order", and that it expects them to be complying with the law from May 2012.

However, the ICO pointedly chose not to follow the government's advice on a phased approach. Since the middle of this week, its own website front page has featured a header bar giving visitors information about the cookies it uses and allowing people to tick a box saying that they accept them. If you don't say yes, you can carry on browsing without having any record kept of where you have been on the ICO site. (The Department for Culture, Media and Sport says there is "absolutely no truth" in the suggestion that there has been any disagreement between it and the ICO).

Some might say that, in announcing a breathing space, the government is merely delaying the pain. Others will applaud it for riding to the rescue, and say it is good that website operators have a year to develop workable technical solutions in an attempt to ensure that browsing doesn't become an unpleasant experience.

The ICO will have sent a shiver down many spines when it said immediate implementation of the new law could "significantly restrict the operation of internet services that users generally take for granted. It would be likely to cause disproportionate inconvenience ... Nevertheless, implementation is required". It adds that the 12-month breathing period "does not let everyone off the hook".

Some experts have outlined a potential nightmare scenario where someone who indulges in a spot of online browsing during their lunch hour is plagued by endless pop-up windows asking for their permission to use cookies.

Before the 26 May rule change, all a website had to do was to tell people how it used cookies, and how they could "opt out" if they objected. Many sites dealt with this by simply putting the information in their privacy policy.

Users of major websites will have so far noticed no difference. On Thursday, we could find nothing on the sites of major online retailers such as Amazon, eBay, John Lewis and Marks & Spencer. And what about the Guardian? For the time being, visitors will not notice anything different, but it is reviewing its website to ensure it is fully compliant, and users can expect to see changes "shortly".