Companies risk fines over new data rules Most British companies have failed to prepare for new data protection rules due to come into force next month amid fears the measures will make it much harder for websites to secure commercially valuable information about their users. About 95 per cent of UK companies have yet to comply with the regulations, which require websites to get permission from consumers to use the tracking "cookies" that monitor people's internet habits, according to KPMG, the consultancy. IN Companies Companies risk fines of up to £500,000 if they fail to fall into line with the rules but critics say compliance could put some e-commerce websites out of business. Cookies - small packets of data sent between a website and a user's computer - have become crucial tools for analysing web traffic and delivering targeted online advertising. Internet retailers are worried about annoying customers with too many requests for permission, and of losing valuable data if people refuse to be tracked. "If you follow the letter of the law you will go bust very quickly," said Michael Ross, chief executive of ECommera, which provides web analytics tools. It is like asking a retailer to operate with a blindfold on. The law, which stems from a European Union directive, was supposed to come into effect in Britain last May, but confusion over the measures led to companies being given an extra year to comply. Many companies are now hoping the Information Commissioner's Office, which is responsible for enforcement, will take a lenient view when the rules finally kick in at the end of next month. Mr Ross said: "I am advising people to put a footer on their website outlining which cookies they use, and how people can turn them off if they want to. It is enough to show the regulator they have done something. However, while the UK data protection authority is known for its pragmatic stance, Lindsey Greig, managing editor of Data Guidance, said there was concern "regulators in Europe might not take the same approach." Robert Bond, partner at Speechly Bircham, the law firm, said big international companies were among those that had left it "to the last minute" to comply. "They are either blissfully unaware or waiting to see who will be the first mover," he said. If they started working tomorrow, many of them would not be compliant in time. Even among financial services companies, which generally are at the forefront of regulatory compliance, only 7 per cent say they are fully compliant, according to a study by DataGuidance, which advises on data protection. Another survey in January showed that no UK online retailers were yet fully compliant. Alex Hanff, chief executive of privacy campaign group ThinkPrivacy, said the UK had been too lax in enforcing the EU directive. You don't bring in a burglary law, and then give the burglars a year to figure out what they're going to do. The regulations come amid an intensifying debate over how much information companies and governments should be allowed to collect from web users. Even as Britain prepares to tighten internet privacy rules for companies, the government is pressing ahead with contentious plans to give police and security services greater powers to monitor online communications. Cookies are small packets of data sent between a website and a user's computer, often used to identify the person visiting a particular site. This can enable companies to recognise a returning customer, track items being put in an online shopping cart, or deliver advertising targeted to a person's interests, writes Maija Palmer. Cookies, whose name comes from the computer science term "magic cookies," were invented in 1996 by Netscape, the internet browser company, which was trying to develop online shopping technology. They have since become ubiquitous - the average website using five to 10 cookies. Companies running a large number of websites might have several thousand in use, and might not know what all of them do. Even the Information Commissioner's Office, which aims to set the standard for data protection measures, discovered a cookie on its site with an unknown function. The average computer user will have thousands of cookies on their browser. Some track individuals even after they have left a particular site. Websites can also contain cookies from other companies that are gathering data about them, often for advertising use. All this has raised concern over the extent to which companies monitor online habits. Regulators have warned that some practices could be a breach of privacy, leading the European Union to stipulate that sites must get explicit consent from consumers to use cookies.