"Almost every time you surf the net and explore a website, coded messages are hidden on your computer".

No, it's not the trailer for Will Smith's Enemy of the State - although you'd be forgiven for thinking so - but the intro to a report on the "threat posed to your privacy by internet cookies" by Mike McKimm for BBC Newsline (06/12/2011).

Scary stuff, eh..

What is a "cookie"?

A cookie is a very small text file that is placed on your computer when you visit certain websites. They can’t scan your hard drive or download viruses, but they do hold information about you, to a lesser or greater extent.

Any information that you enter provide to a website can be stored in a cookie and used by that website again: whether it's the pages you've visited, your login details, or even your credit card details (if you’ve made a payment).

The majority of sites store basic information, which they use to make your browsing experience as fast and as easy as possible. You might have noticed that you're automatically logged in if you go back to Amazon.co.uk, or that products related to the items you’d looked for previously have suddenly appeared on the homepage. They’re even used to store items in your shopping cart.

Google also uses cookies to inform website owners about how web users have found and used their site, so site owners can understand and tweak their site to meet the user's needs.

It's only when the amount of data stored becomes excessive and the monitoring of your behaviour becomes intrusive that alarm-bells should start ringing.

The law

There has been a recent change in the law to combat this sort of behaviour.

Following a EU Directive, a new law relating to the use of cookies came into force in the UK in May of this year which, on the face of it, means that website owners now have to get explicit consent from a user before their website places a cookie on the user's computer.

The Information Commissioners Office (ICO), the body responsible for enforcing this law and imposing financial penalties on the wrong-doers, has adopted a more practical approach, drawing a distinction between cookies which allow the website owner to improve their website based on your use of it and cookies which store very detailed profiles of an individual and their browsing activity.

The guidelines from the ICO have explained that "the more privacy intrusive your activity, the more priority you will need to give to getting meaningful consent." But what this means is still a bit hazy: at one end of the scale, you have to wonder whether stating that cookies are created in your "terms and conditions", along with the fact that the user's web browser allows cookies, is enough to satisfy the ICO - at the other, it seems pretty clear that explicit consent and transparency is a must.

Summary

What Mike McKimm's report glossed over in favour of a bit of sensationalism was this: cookies are useful. Sometimes, they’re even necessary, and the ICO recognise this.

But this wouldn't make as good a story as the wholesale invasion of privacy of an unsuspecting public, now would it?