In October 2009 the EU issued a Directive which proposed amends to member states laws on electronic privacy. These member state law changes were due May 2011, but in the UK at least were put back a year which means that come May 2012 (next month!) you (companies based in the UK) need to be aware that new laws governing the use of cookies on websites are likely to be in force.
What does this mean?
Well that’s where the confusion is. In brief it appears that laws will require that websites ask visitors for consent to use ‘most’ web cookies. Most websites use cookies in some way or another and these are often integral to the workings of the site as they remember information between web pages (for login status, preferences, shopping cart items etc).
The new law is well intentioned, aimed at protecting privacy. For instance if you search Google for ‘holidays’ in the morning, you may well find that when visiting another website later in the day that there are banner adverts on there about holidays. This isn’t a coincidence. Google is using cookies to store information about what you’re interested in and then serving relevant adverts to you on other websites showing banner ads. Scary huh!?
What’s affected?
So cookie use in advertising is one of the targets of this law, but most users would say that changing this so that you have to opt in to have this sort of information stored about you isn’t a bad thing, but for site owners who finance their websites through advertising this could destroy their business model.
Same goes for the use of cookies in affiliate marketing. If you can’t use a cookie to validate affiliate links then all online affiliate marketing could be threatened.
The law does allow you to use “strictly necessary” cookies, for example those used to remember when you add an item to your shopping cart. Users want you to remember that information, so it’s not really a privacy issue. Other cookies use, such as remembering login, is also supposedly okay.
The issue is mainly with site owners or third parties storing information about what a user looks at on a website, so the biggest immediate concern for most people is quite probably analytics. Pretty much all tracking system that uses cookies, Google Analytics included, so by the letter of the law it’s likely that you’ll need to get users to agree to cookie use in order to be able to continue to use these systems.
Also in order for someone to ‘like’ your article in Facebook, or indeed via any social media site, cookies are generally needed. So does this law scupper social networking too??!
So you see, whilst the intention of the law is well intentioned, the results of it’s wording are potentially far reaching for all Internet users.
What are people saying?
Now you would have thought that companies such as Google might have responded by now and come up with a plan to solve this problem, but the general response from all those companies is pretty much “go talk to your own legal people”. Now the reason for this it appears is that most observers feel that the everyone is taking a “wait and see” mentality, with the attitude that 92% of websites use cookies, so how exactly is this law going to be enforced?
All I know is that the recommended route of getting your users to approve use of cookies on your website is to pop up a box to ask their approval. Of course, you’ll need to use cookies to remember their response, which is fine if they say “Yes”, but if they say “No” then you obviously can’t remember that, so you’d have to ask that question again on every page they visit!! Methinks that might get a little annoying 
What should you do?
I’m no lawyer, so the only professional advice I can give at this time is indeed to consult your own legal people. If asked off-the-record I might recommend taking the same wait-and-see attitude of everyone else, in the hope that someone might see some sense!
If you do decide you want to make amends to your website in reaction to the law then get in touch to discuss the options for adding cookie approval functionality to your site (as there are ways to make it less intrusive if so desired).
