The Information Commissioner's Office (ICO) has just published updated guidance on cookies and similar technology. It is essential reading for anyone running a website or app using such technology, whether for analytics or for advertising (which is very close to 100% of organisations). The ICO guidance is timely (maybe ironically so, given that we flagged up recently that its own website hadn't been compliant!) Although cookie law can look rather complicated, it boils down to this: for "essential" cookies (i.e. the ones that in technical terms your website needs to be able to run) you don't need users' consent, but for all others (and that includes analytics and advertising cookies) you do need consent. And consent requires an active opt-in, so no single buttons just saying "Accept" (you should offer a "Decline" button as well).