Ask HN: Do you ask to use cookies or check IP?

https://news.ycombinator.com/item?id=14421985

by ge96 • 9 years ago

37 54 9 years ago

news.ycombinator.com

This whole EU thing...

Until today I had no problem throwing Google Analytics on a site, same with Facebook for a share button (not sure if this uses a cookie).

Recently when I figured out how to use cookies and now use it for tracking/faster lookup for site usage... I came across the thing of "asking for permission to use cookies" ahh... this is like the noscript/accessibility/modifying social media buttons thing...

Is this something to be concerned about? For me it's not a credentials thing, though it is an identifying thing, just for easier database lookup to update the user's interaction with a site ie. pages visited, scrolls, stuff clicked on... for data driven dev.

I do intend to put the question but it seems like an annoying thing for them to deal with. When I see it I'm like "Ahh..." and don't click them myself. But I've seen very few sites ask.

Edit: I think the most useful thing I've found for cookies is the persistence for example using guides to use your website to help people get used to how it works. Then they only see it once until the cookie expires.

I realize that's probably the definition/reason for cookies is persistence.

chipperyman573• 9 years ago

For me it's not a credentials thing, though it is an identifying thing, just for easier database lookup to update the user's interaction with a site ie. pages visited, scrolls, stuff clicked on... for data driven dev.

This is exactly what the law is targeting, using cookies to track users.

Realistically, as long as you don't and have no plans to do business in the UK (Edit: EU, not just the UK) you should be fine. But it can't hurt to put small notice to be safe.

giobox• 9 years ago

My understanding is the rule comes from some form of EU legislation, in which case the issue is far more extensive than just the UK, ~500 million people.

ge9612• 9 years ago

I asked about "soliciting" everyone or checking IP (despite proxy/vpn) so you don't get the prompt. It reminds me of those email-popups when I see a popup appear even in site not necessarily a window.

Our site is deployed in the Philippines (though does no use a .ph domain) so I wonder if the UK thing would even apply. Currently no products/associated with the site so no "business" not even ads at this time.

molecule• 9 years ago

That's correct.

https://www.cookielaw.org/the-cookie-law/

It started as an EU Directive that was adopted by all EU countries in May 2011. The Directive gave individuals rights to refuse the use of cookies that reduce their online privacy. Each country then updated its own laws to comply. In the UK this meant an update to the Privacy and Electronic Communications Regulations.

...

All websites owned in the EU or targeted towards EU citizens, are now expected to comply with the law.

ge9612• 9 years ago

Yeah it does seem contradicting, however in my case, no user sign up/don't know who exactly is visiting due to changing IP's. This is the point of the unique string in cookie

It's mostly to update tracking data regarding site usage and not overwrite existing entries

What does that mean to "track" haha, I don't mean location. Identifying... unique

rompic• 9 years ago

There may be same changes to the cookie law soon: http://www.lexology.com/library/detail.aspx?g=859d2614-cf11-...

ge9612• 9 years ago

from scanning the contents of their users’ email for the purposes of delivering targeted advertising

that's how you make money... if only I could read people's minds as they dreamt... cue the exploding egg (Futurama)

eriknstr• 9 years ago

I seemed to recall having read so too. Thanks for the link. This should be higher up IMO.

IshKebab2• 9 years ago

Finally!

hartator• 9 years ago

This law is nonsense. You don't have to respect it if you are not in the EU.

dazc2• 9 years ago

It sure is nonsense since, most of the time, the site may already have dumped a boat load of cookies before the opt-in appears on the screen.

"You don't have to respect it if you are not in the EU."

Like most of these silly laws, it depends how big you are, Google couldn't get away with it but 99.9% of smaller websites could.

pluma• 9 years ago

Google couldn't get away with it because Google does business in the EU and has subsidiaries in the EU so it needs to comply with EU law.

It's no different than physical products. If you produce and ship your product locally to the local market that is not part of the EU and someone exports your goods to the EU, it's their problem if they need to comply with EU law, not yours. If you want to distribute your product in the EU directly and maybe even create a separate company within the EU to do so, you have to comply with EU law or face consequences.

IshKebab2• 9 years ago

I seriously doubt you have to respect if you are in the EU too. Unless you are the size of Facebook, Google etc.

crivabene2• 9 years ago

As a European who had to make sure the provisions contained in this law were implemented on a few high-traffic sites targeting consumers, I can definitively say that the law is at least a little bit "controversial" and unclear. We had to request the assistance of a law firm to make sure we complied.

Originally it looked like you had to give the users an option to decide if they allow the use of tracking cookies or not, potentially having to deal with NOT pushing such cookies in case the user did not consent. In reality, most of the implementations I've seen are just informing the customers that tracking cookies are used and let them know that usage of the site represents consent of such usage, adding that they can modify the browser preferences if they want to modify their cookie preferences. Additionally, you have to link to a cookie policy that you publish on the site.

As a clarification, this law does not apply to cookies in general: certain cookies, sometime referred as technical cookies (e.g. session) are exempted as long as they're not used for tracking purposes.

stephenr3• 9 years ago

As a clarification, this law does not apply to cookies in general: certain cookies, sometime referred as technical cookies (e.g. session) are exempted as long as they're not used for tracking purposes.

That's good to know. Any chance you know/can link to the specific section that makes that exemption?

simooooo• 9 years ago

Which is a bit silly as it's a tracking cookie by default

crivabene2• 9 years ago

Here's an excerpt taken from the EU Internet Handbook [0]:

Cookies clearly exempt from consent according to the EU advisory body on data protection- WP29 [1] include:

- user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases

- authentication cookies, to identify the user once he has logged in, for the duration of a session

- user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration

- multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session

- load‑balancing cookies, for the duration of session

- user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)

- third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

[0] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

[1] http://ec.europa.eu/justice/data-protection/article-29/docum...

ge9612• 9 years ago

thanks a lot, this is very helpful/enlightening.

zxcmx• 9 years ago

Check out: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

First party session cookies (e.g. login cookies) and several other reasonable uses are exempt.

The law is most strongly targeted at google analytics / facebook / omniture / etc cookies, which are third-party tracking cookies that follow the user around the Internet.

In your case, if you are setting a first-party non-persistent cookie which does not "identify" the user (except to determine usage patterns on the site) then it would be pretty reasonable to consider it exempt from notification.

However, you should throw up a cookie warning if you are setting a persistent cookie or using third-party tracking scripts (which will go ahead and use third-party tracking cookies).

ge9612• 9 years ago

Oh yeah

...follow the user around the internet

that is interesting, I'm not even sure how that would work once they leave your site (I am not aware at this time).

floatboth• 9 years ago

uhh… your site embeds google analytics, which sets cookies on google's domains. other site embeds google analytics, it reads the google cookies… and so on.

kennydude• 9 years ago

TIL session cookies are exempt. Seems it's a very misunderstood law, and is designed to make people think about tracking

bjpbakker• 9 years ago

Yeah this law is very unclear. Probably written by tech-agnostic folks, mostly.

The intention is mainly to prevent tracking without permission (so maybe 'no-tracking law' may have been a better name), no matter how you technically implement that. Obviously this concerns social media and analytics (not only third-party).

It's weird how the law states that a website must ask specific permission, given that (modern) browsers support the Do Not Track HTTP header [1]. IMO this would've been much more friendly to visitors (i.e. decide once if you want to get tracked or not; it's mostly the same few parties (Facebook, Google, et al) tracking you anyway).

[1] https://en.wikipedia.org/wiki/Do_Not_Track

mattbgates3• 9 years ago

When I write my terms of service, which I try to keep in simple language, I usually make known what I use cookies for or that I do log IP addresses, which is only used to prevent abuse of the application.

ge9612• 9 years ago

The ips are normally dynamic/I wouldn't think you could reliably use them to target them for whatever.

Something to address though as we log IP's though servers in general know IP's by connecting right? How is that different? "Not logged"

LeoHexspoor• 9 years ago

IP's are considered personal data according to GDPR, which will go into effect May 2018.

http://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip-...

It's been made clear in the General Data Protection Regulation ("GDPR") that IP addresses should be considered as personal data as the text includes "online identifier", in the definition of "personal data". Recital 30 clarifies that "online identifier" includes IP addresses."

mattbgates3• 9 years ago

I feel if you are taking any personal information, including an email address, you should have some kind of terms of service. If you set cookies on a personal computer, that could warrant a terms of service.

You can find Terms of Service generators online and you just modify it to be even more simple terms. If I were a large corporation, like Apple, I'd probably have lawyers writing it for me, but I do my best not to store too much personal data, while informing my users of the data collected from them. And if I do store it, its encrypted. I can't read it or recover it.

It is good practice to spend a few hours, at least once before you develop a good program, to check out the terms of services on a bunch of websites. It helps to understand the types of language to use and what to mention or not mention, especially those websites closely related to whatever you are doing.

My personal opinion is that the shorter your privacy policy and terms of service, the better. No reason to put up content that you can't even understand, so you may as well write something that you and your visitors can easily understand.

Privacy: information about your considerations when collecting and storing data from your visitors.

throwaway91829• 9 years ago

Has anyone ever been prosecuted or fined under this law, in any country?

Although many high profile sites now show the cookie banner, it still seems like 99% of sites operating out of the EU don't show anything, even when they use Google Analytics or use ad networks that use cookies.

lloydjatkinson• 9 years ago

99% of sites operating out of the EU don't show anything

Good.

apexalpha• 9 years ago

I think the EU is dropping this bs law. They figured out how the internet works, finally.

waibelp• 9 years ago

Are you sure? Seems like it's still Neuland.

justusw2• 9 years ago

(I am only describing the situation in Germany)

I can say from my own founding experience that you want to avoid being investigated, at least in Germany. While I am a big privacy fanatic, the current way rules are implemented is quite labor intense for small founder teams.

As a matter of fact, cookie laws will be your most benign issue to solve. The biggest challenge is that most tech startups that deal with personal data need to appoint a certified privacy officer, which can be ridiculously expensive.

captainmuon• 9 years ago

Please, somebody, make a service such that I can centrally "agree to cookies" for all sites that use this service. It would make my life easier as a user and also as a potential web site owner.

Side note: I personally hate this kind of thing where good meaning people force me to consent to or decline something. I liked the grey area where I didn't consent nor forbid tracking, and could be morally outraged and use a website at the same time. I think there is little use in displaying terms of service that nobody reads or understands, and especially terms that you have to accept if you want to use a service (which you most of the time not strictly have to use to live, but realistically, to take part in out society... yes, I have to access most of the services I do).

lewiseason3• 9 years ago

What we should've done is made browser vendors add EU cookie consent instead of every. single. website.

Then I can configure my browser for Always/Never/Ask or whatever.

That would've been too simple, of course.

ewanm89• 9 years ago

Well, if you look in the options you'll find Firefox actually does have an option whether to accept all cookies, only first party, no cookies or always ask. Chrome also has an option to deny all cookies, third party cookies or accept all (no ask here).

justusw2• 9 years ago

IIRC uBlock used to have an anti-cookielaw-popup blocking list you could enable. It worked quite well for a bunch of websites.

helb• 9 years ago

There is a browser extension called CookiesOK: https://cookiesok.com/

pleasecalllater• 9 years ago

Well, none of the pages I saw asked me to allow them for storing cookies. They just inform me about the cookies and the ways I can use to remove them.

Ask HN: Do you ask to use cookies or check IP?

Related Stories