To cookie or not to cookie?

This Kat is often perturbed that the advertisements in her Gmail and FaceBook accounts seem to be personalised through no action by her. Indeed, recent advertisements on both sites have related to wine, law, cats, Sydney and/or army boot camp training (the last, of course, being a complete mystery). It with interest, then, that this Kat has been following the progress and (lack of) implementation of the EU 'Cookie Directive'.

For those unfamiliar with the concept of a 'cookie', it is a file which is stored on your computer by your web browser when you visit a website. A cookie can be used for remembering log in details, site preferences, shopping cart contents and anything else that can be accomplished through storing text data. Accordingly, cookies are a provide a wealth of useful information for targeted advertising.

The EU first enacted provisions relating to cookies in 2002 in the form of the ePrivacy Directive. In the UK, this was implemented by Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR):

Confidentiality of Communications
6. (1) Subject to paragraph (4), a person shall not use an electronic communications network to store information, or to gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment -
(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) is given the opportunity to refuse the storage of or access to that information.

(3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient for the purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use.

(4) Paragraph (1) shall not apply to the technical storage of, or access to, information—
(a) for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network; or
(b)where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.

That is, websites had to tell users how they used cookies and how users could ‘opt out’ if they objected. Many websites did this by putting information about cookies in their privacy policies and giving people the possibility of ‘opting out’.

On 25 December 2009 an amended Directive came into force which had to be implemented into the national law of Member States by 25 May 2011. Accordingly, Regulation 6 of the Privacy and Electronic Communications (EC Directives) (Amendment) Regulations 2011 reads like this:

Confidentiality of Communications
6 (1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment--
(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) has given his or her consent.

(3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient forthe purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use.

(3A) For the purposes of paragraph (2), consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent.

(4) Paragraph (1) shall not apply to the technical storage of, or access to, information--
(a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or
(b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.

Therefore, a website operator required informed consent from the user before activating cookies. This amendment came into force on 26 May 2011.

Now 26 May 2011 was last Thursday. So why are UK websites not asking this Kat for 'permission to cookie'?

The answer is that Ed Vaizey, Minister for Culture, Communications and Creative Industries, and the Information Commissioner's Office (ICO) have reached a prior agreement concerning enforcement of the amended Regulations.

The ICO, as enforcer of UK data privacy legislation, was of the view that the new regulation needed to be interpreted strictly and immediately. Indeed, on the front page of its own website, the ICO states:

'On 26 May 2011, the rules about cookies on websites changed. This site uses cookies. One of the cookies we use is essential for parts of the site to operate and has already been set. You may delete and block all cookies from this site, but parts of the site will not work. To find out more about cookies on this website and how to delete cookies, see our privacy notice'.

Users are then invited to tick a box to accept cookies from the site.

However, the government was not so enthusiastic. In particular, it was concerned about the possible detrimental effects on UK online retailers: the burdensome necessity of obtaining consent from users could make online shopping so cumbersome and intrusive that consumers would use US sites rather than UK sites.

On Wednesday, Mr Vaizey stated in a press release that ‘there will be no immediate changes to how UK websites operate as a result of new EU rules’. Rather, he stated that the government would work with website operators to ‘come up with workable technical solutions’. In a press release, the ICO stated that website operators have up to one year to ‘get their house in order’ and that ‘this does not let everyone off the hook’.

The IPKat agrees with Mr Vaizey’s earlier comment at the CBI forum on e-privacy and the digital economy that the new cookie provisions were ‘a good example of a well-meaning regulation that will be very difficult to make work in practice’.

Merpel wonders, if she chooses not to accept cookies from a particular site, whether she can somehow stop that same site continually asking her if she wants to accept cookies (because that site cannot set a cookie indicating her 'no cookie' preference)?

The Pillsbury Doughboy rises to take on My Dough Girl

There is nothing this Kat loves more than bakery related IP stories, especially cupcake litigation (see post here). So this story especially caught her eye via a TechDirt tweet. But before delving into the IP fight, some background is necessary for non-US readers.

The Pillsbury Doughboy is an American advertising icon and mascot for the Pillsbury Company (owned by General Mills) who sells a variety of chilled dough that can be popped in the oven to reveal croissants, cinnamon rolls, buns and cookies. He is, as the name suggests, a "boy" made out of dough. (Picture, left - The Pillsbury Doughboy) His television commercial appearances normally end with a human finger poking his stomach and him responding with a giggle or his trade marked "hoo hoo" (click here to listen). Like Aunt Jemima and the Green Giant before him, the Pillsbury Doughboy enjoys a significant reputation in the US.

So when over eighteen months ago a Salt Lake City resident opened a cookie store called "My Dough Girl" it was only a matter of time until the Pillsbury Dough Boy came a knockin'. My Dough Girl specializes in gourmet cookies named after a specific "Dough Girl" with names such as Penelope, Vivianna and Margo. Like the Pillsbury Doughboy brand, she also sells frozen dough to customers for home baking. When the owner, Tami Cromar, picked the name of her bakery she told NBC affiliate, KSL in Salt Lake City that she went through the proper procedures, namely checking for any potential copyright infringement.

This is supposedly where she went wrong because as many will know this is a trade mark issue, not a copyright issue. The Doughboy then came after her for trade mark infringement when Pillsbury sent her a cease and desist letter this past May demanding she change the name of her business or face a lawsuit. The Pillsbury Company also filed oppositions to The Dough Girl's trade mark applications pending before the USPTO. It is reported that My Dough Girl will be changing their name at a cost of around $50,000 rather than face the costs of litigation.

The fans are not impressed, however, with the organization merely threatening a small business with the prospect of court. A Facebook page devoted to boycotting Pillsbury following its threat to My Dough Girl has drummed up over 800 members in support of Ms.Cromar. A post by Facebook user Cheryl Hawkes Skelton stated:

"Corporations think consumers have no brain power. There is NO way one could possibly confuse the blue and white dough boy with the red sign of My Dough Girl. I haven't purchased Pillsbury in the past, this clinches the deal that I won't in the future."

Another more terse post from user Christopher C. DeSantis stated that:

"Pillsbury's attorneys are far too hungry for billable hours; they should eat some of their own pastries instead. Legal shenanegans (sic) of this nature are frustrating beyond belief, and serve only to underscore the abuses of the legal profession and the greed of mega-corporations. For shame, Pillsbury! What planet are you from? No Pillsbury products for me until you withdraw this ridiculous lawsuit."

This Kat must again reiterate, that as far as she is aware, Pillsbury have only sent a cease and desist letter and have not actually issued proceedings.

Legally speaking, this Kat is skeptical how strong Pillsbury's case really is. The marks and goods are indeed similar when comparing Pillsbury mark as registered, i.e. DOUGHBOY. However, there is something to be said to how the Pillsbury Doughboy is actually refereed to and identified by consumers. This Kat grew up with the Pillsbury Doughboy's reputation, but the link, if any, between the two marks as used is small. This is because in common American nomenclature, the Doughboy is only ever referred to with the "Pillsbury" precursor.

Evidence of actual confusion would be difficult to come by, as well. My Dough Girl operates out of a stand-alone shop, and not, like Pillsbury's products, in every national supermarket through out the US. (Picture, left - is that a litigation ax he is wielding, or just a spatula - you decide) The marketing channels used by the two are extremely different as well. My Dough Girl's marketing seems, as far as can be ascertained, to rely primarily on social networking through its website, Twitter, Facebook page and word of mouth. The Pillsbury Doughboy enjoys multi-network national television campaigns. Further it seems impossible to envisage a scenario where a consumer gets in their car to drive to the grocery store to pick up a can of Pillsbury croissants, drives past My Dough Girl in Salt Lake City, gets confused, stops and purchases their products instead. Economically speaking, as well, if you are in the market for a Pillsbury Doughboy product it is highly unlikely you will be stopping at a gourmet cookie shop instead.

But what about dillution, an astute IPKat reader asks? This Kat believes that the blurring argument is again weaker given the smaller degree of similarity between the marks and the different consumers of the product (thus, decreasing the two's cross-association). And unless Pillsbury would be arguing that the pin-up names of the cookies tarnishes the innocent nature of the Pillsbury Doughboy, she is again unsure how far a dilution argument takes them. For recent dilution case involving Starbucks see this AmeriKat post here.

This Kat believes that this type of threatening conduct by large corporations can actually be more damaging to the reputation of their overall brand than the harm a small business name would actually cause to their trade marks. This Kat suggests that before big businesses blindly send out cease and desist letters they consider the benefit in doing so, not only for their intellectual property protection, but also their brand's reputation.