In May of last year, a new EU directive came into force which when fully implemented would have required all UK web site owners to gain consent from their visitors to set cookies in their browsers.
Cookies used for ‘strictly necessary’ were exempted, however cookies set by analytics tools such as Google Analytics were not classified as essential and would therefore require consent.
The latest set of guidance from the ICO contains some potentially good news at the end of the report
“The Regulations do not distinguish between cookies used for analytical activities and those used for other purposes. We do not consider analytical cookies fall within the ‘strictly necessary’ exception criteria. This means in theory websites need to tell people about analytical cookies and gain their consent.
In practice we would expect you to provide clear information to users about analytical cookies and take what steps you can to seek their agreement. This is likely to involve making the argument to show users why these cookies are useful.
Although the Information Commissioner cannot completely exclude the possibility of formal action in any area, it is highly unlikely that priority for any formal action would be given to focusing on uses of cookies where there is a low level of intrusiveness and risk of harm to individuals. Provided clear information is given about their activities we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory”
However this only applies to analytics. If you’re doing any retargeting, it looks like you’ll still need to get your customers optin.