EU rules require members to prohibit tracking an Internet user's online behavior, then targeting that user with unsolicited advertising if it does not have the individual's permission to do so. Users, the rules say, must provide consent to have their online behavior tracked so it can be turned into an advertising strategy.
In Britain, the law does not require a user's specific consent if there is "reasonable grounds for believing" consent has been given, the EUobserver reported Thursday.
In practice, in Britain authorities have drawn the line at "intentional interception" of surveillance of a user's online behavior. Under EU law even unintentional interception or surveillance is prohibited without consent.
Jim Killock, a spokesman for the Open Rights Group in London, called the lawsuit "great news."
"There are big holes in the U.K. privacy laws," he said.
British authorities said they had plans to comply with EU laws but had not gotten to it yet.
"We are planning to make changes to address the commission's concerns, and will be setting out more detail on any necessary amendments or legislation in due course," Britain's Home Office said in a statement.