It's apparently the responsibility of the website owner. The directive from the EU was brought in to combat spyware etc but is is going to be a huge hassle for everyone as the fine is a maximum £1/2million