DOI: 10.14457/tu.the.2014.18
title: Legal control on cookies

description: As it becomes to an internet world, internet users shall concern on their personal data whether such data will be accessed or collected by third parties including website owners and third-party advertisers. In this regard, there is an instrument, called “Cookie”, which is used by website owners and third-party advertisers for accessing and collecting internet users’ personal data and tracking internet users’ behavior while they are surfing on websites.The use of cookies by website owners and third-party advertisers provides advantages not only to the website owners and third-party advertisers, but also to the internet users. For instance, using cookies provides facility to internet users regarding online shopping, logging Facebook or emails, and doing transactions. However, at the same time, website owners and third-party advertisers may use cookies to access the internet users’ personal data, track internet users’ behavior and collect that information without any prior notification to the internet users and/or prior consent. Once website owners collect internet users’ personal data, they may sell this information to groups of people, who are interested in this information, which is normally related to the business of insurance, bank, advertisement, and marketing field. In addition, cookies, installed by third-party advertisers, may disguise on websites without internet users’ knowledge. Third-party advertisers usually place their cookies on websites in order to access, track and collect internet users’ personal data for several purposes, but the main reason is to analyze each internet user for the scope of interest and will provide web ads tailored internet users for suitable interest. This helps to promote brand and increase sales for third-party advertisers; however, on the other hand, this may annoy internet users.In this regard, using cookies for tracking internet users which causes them annoyance and collects internet users’ personal data without their consent shall be deemed as infringement of internet users’ privacy and infringement of personal data respectively. Regarding aforementioned, Thailand does not have a specific law to control, prevent or punish for this purpose of using cookies by website owners and third-party advertisers. Furthermore, applying these kinds of cases with Thai current laws are very difficult to punish the wrongdoers or offenders since it is hard to bring such wrongdoers or offenders to be punished and the scopes of Thai current laws do not cover all of such actions. Nevertheless, foreign states such as the United States of America (the US), the European Union (the EU), the United Kingdom (the UK) and Italy agreed that right of privacy and right of personal data are essential and are required to be protected from the use of cookies by website owners and/or third-party advertisers. Therefore, those countries had amended their legal control on cookies in order to protect internet users’ privacy and personal data. Although the methods among those countries are different, they had tried to protect their population’s privacy and personal data on the internet world.The US applies Do-Not-Track mechanism to control of the use of cookies.  Do-Not-Track mechanism provides the internet users opportunity to refuse the use of cookies while they are surfing websites, which is called “opt-out” method. On the other hand, the EU had issued Directive on Privacy and Electronic Communications 2009/136/EC of the EU parliament (“Directive 2009/136/EC”) to amend Directive on Privacy and Electronic Communications 2002/58/EC of the EU Parliament                  (“Directive 2002/58/EC”) regarding legal provisions applied for the use of cookies, provided in section 5(3). In addition, all members in the EU have to follow Directive 2009/136/EC. Section 5(3) of Directive 2009/136/EC informs that in the event of using cookies, website owners have to provide information of the use of cookies to the internet users by friendly method, i.e. pop-up window, and receive prior consent from internet users of such use of cookies or called “opt-in” method. However, there are also exemptions thereof, which website owners are required not to receive prior consent from internet users for the use of cookies, composing of (i) using cookies for sole purpose of storage of information for communications to take place over a network; and (ii) cookies are needed for website services and internet users have explicitly requested to use cookies. Since the UK and Italy are members of the EU, they also applied section 5(3) of Directive 2009/136/EC into their own laws in order to implement the aforementioned Directive. In this regard, the legal provisions related to the use of cookies in the UK are completely the same, which requires “opt-in” method for the use of cookies and such consent must be shown expressly to website owners. Italy also applies “opt-in” method for the use of cookies; however, the consent to be shown in connection with the installation of cookies is able to represent implicitly to website owners. In this regard, if internet users do not refuse the use of cookies clearly, it shall be deemed as impliedly consent for the use of cookies.