Stupid EU cookie law will hand the advantage to the US

http://eu.techcrunch.com/2011/03/09/stupid-eu-cookie-law-will-hand-the-advantage-to-the-us-kill-our-startups-stone-dead/

by emmanuelory • 15 years ago

107 99 15 years ago

eu.techcrunch.com

ericflo• 15 years ago

EU to the internet: You shall store no state!

naich2• 15 years ago

This is not about storing state, but using cookies to track users across domains in order to build up a profile about the user. It is only the latter that needs explicit permission under the new law.

naich2• 15 years ago

Of course, phrasing new regulations to cover only that specific application of cookies while allowing any other legitimate or future uses is going to be interesting. And by interesting I mean pretty much impossible.

loup-vaillant• 15 years ago

I don't use cookies myself for my web site, but Apache logs a good deal of data. I think this alone warrants a "privacy policy" page. I plan to set up one soon.

berkes2• 15 years ago

You may be interested in Weinberg's (founder of DuckDuckgo) blog-entry on privacy-aware logging. http://www.gabrielweinberg.com/blog/2010/11/how-to-not-log-p...

nodata2• 15 years ago

So don't track - and sell that to your customers and visitors as an advantage.

rahoulb2• 15 years ago

That's the issue - what's the definition of "track"?

I've not seen a decent discussion of this anywhere - the BBC site says "shopping baskets are exempt" but what about session cookies? What about font-size preferences or logins?

I've asked my MP (in the UK) to look into it...

nodata2• 15 years ago

I presumed tracking meant cookies which were used outside of one website. Good point.

olalonde4• 15 years ago

That's how free markets work. Unfortunately, this law doesn't allow for the consumer to chose what's best for himself.

xsltuser2010• 15 years ago

Is this about tracking via cookies only, or cookies in general ? Does it mean I have to ask for consent to use ganalytics as well ?

joebananas• 15 years ago

how is google analytics not a form of tracking?

gst3• 15 years ago

There are some lawyers in Germany that already now presume that Google Analytics is illegal: http://eu.techcrunch.com/2009/11/24/google-analytics-illegal.... And due to the German "Abmahnung" law (see http://en.wikipedia.org/wiki/Abmahnung) it's rather easy for them to "fine" you if you use it anyway: "One German lawyer that gets cited in the article says the penalties could amount up to €50,000 (about $75,000) per website that uses Google Analytics to keep track of its visitors’ usage patterns."

blub3• 15 years ago

Good. User tracking is antisocial and Google is one of the worst offenders.

wladimir2• 15 years ago

Well, I'm against internet regulation in general, but I don't agree this is 'stupid' or a big disadvantage.

Sites could simply stop tracking users with long-term cookies. In this case, no warnings and popups need to be added. And everyone is happy...

gst3• 15 years ago

If you don't want to be tracked with a long-term cookie just configure your browser to not accept long-term cookies or to delete all cookies on shutdown. Problem solved.

joelanman2• 15 years ago

I don't think most people would know how to do that, or even that you could.

blub3• 15 years ago

I think it's the responsibility of the website to do the best that it can to protect the user's privacy, especially for those that don't know what a cookie is or does. On the contrary, most websites do the minimum they can get away with and try to squeeze every bit of data for profit.

Those companies can cry all they want but they get ZERO sympathy from me. I'm sick of having to install three extensions to counter their hostile behaviour towards my privacy.

Silhouette13• 15 years ago

> Problem solved.

Not really. You can achieve similar dubious goals with various other techonologies that are not so readily disabled, or that are usually implemented independent of the browser itself anyway (e.g., "Flash cookies").

csomar• 15 years ago

I can't figure out how this will hit EU startups. Actually, this is promoting transparency and I really like it. I won't be suspicious if the site is gathering some data from me or not; if it is, it'll just display a friendly warning.

This is actually beneficial for users; and the ones who refuse are probably not the users you are looking for.

anigbrowl• 15 years ago

You're right. The comments are a lot more intelligent than the posturing article they are appended to.

fmavituna2• 15 years ago

Isn't it clear from the article?

"It clearly makes UK companies less competitive because sites we build will need to be plastered with warnings – and our competitors will not. It is a well known fact that at each stage of a signup process you lose customers – if you have to have a big warning sign just for a cookie that will remember you for purely convenience so that it keeps you logged in. The user wont read that detail – they will just think your a privacy nightmare and wont sign up."

whatwhatwhat• 15 years ago

>It clearly makes UK companies less competitive because sites we build will need to be plastered with warnings – and our competitors will not.

An American startup doing business globally and with citizens of the UK would have to abide by this law too, though, right?

mojuba• 15 years ago

If I read it correctly, the law addresses the cross-site cookies particularly, which I have been keeping disabled in all my browsers ever since the option was introduced (Accept cookies ... Only from sites I visit). And honestly, I don't care about "startups" that are trying to take advantage of ad cookies (edit: and Facebook tracking me via its ubiquitous thumb, and so on). Let alone that I use an ad blocker, too. Fuck that, you know.

xd2• 15 years ago

This is being blown out of all proportions.

http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/...

Read point 50.

The general gist seems to be, that if you use a cookie to track the communications between you and the user (à la sessions), no problem. But if you are using a cookies to track where and/or what the user has been doing across sites then you need to make said user aware.

Please correct me if I am wrong.

berkes2• 15 years ago

You are not wrong. Some examples: A login for your site needs no concent. A session to store some status-message to a user ("comment posted!") is allowed just fine. But Google (analytics) must provide a warning before it is allowed to track people, because it tracks people across domains and sites.

edit: I wrote opt-in but meant to say "provide a warning"

jkent• 15 years ago

Google Analytics does not track user behaviour across domains and sites, unless those domains and sites are specifically linked.

Google Analytics uses a 1st-party cookie set by the website that runs it.

http://code.google.com/apis/analytics/docs/concepts/gaConcep...

Tichy3• 15 years ago

So how does the police distinguish between a harmless session cookie and an evil tracking cookie?

fauigerzigerk2• 15 years ago

Thanks for posting the link - upvoted. However, I'm interpreting it a little differently. Consent is not just required for tracking across sites according to point 50 of that document. Their example of something that would require consent is storage of language preferences. That has nothing to do with cross site tracking.

xd2• 15 years ago

The bit in question: "For example, pursuant to the last sentence of this Article a data subject may not benefit from information and the right to oppose the processing of his/her data if a cookie collects his language preferences or his location (e.g. Belgium, China) as this kind of cookies could be presented as having as objective the facilitation of the transmission of a communication"

I think this regards storing the users locale information in a cookie .. you wouldn't need to store this in a cookie if you can store it on your server which links the locale information via a session cookie.

rahoulb2• 15 years ago

The linked document looks to me like a recommendation to alter the tabled amendment - and as things currently stand then language preferences and the like will not be exempt. Hence clause 51 stating "to prevent this we propose the following amendment to the article ..."

But I've only skimmed through it and it's making my head hurt.

lwhi2• 15 years ago

So we'll be able to use a cookie to store the user's preference once they've selected to allow or disallow tracking via Google Analytics?

EDIT: This [1] seems quite useful.

[1] http://www.google.com/support/forum/p/Google+Analytics/threa...

gacek• 15 years ago

And stupid enviromental laws don't allow excessive mining and require costly procedures when handling waste. It hands the advantage to China, and other less restrictive countries.

'This is how its always been done' is not reason enough. Many sites require you to accept terms&conditions. Another checkbox really won't matter.

paolomaffei• 15 years ago

Usability 101: every other checkbox matters and lowers conversions

john-n• 15 years ago

While this is true, alot of cookies are used without any login/signup process, so you need to provide these pop-ups alot more often.

borism• 15 years ago

yes, we should all be lean-and-mean like China!

speleding• 15 years ago

They will need member states to actually enforce this law. Until then it's a dead letter like so many other EU laws that get ignored.

prodigal_erik• 15 years ago

al_james10• 15 years ago

As a web-publisher, I find the general distaste of (advertising) tracking cookies a little hard to swallow. At the end of the day, tracking cookies exist because they allow the sites you visit (and probably don't pay for directly) to earn more money (on average) across all their visitors.

Advertising is the life-blood of publishers on the Internet. Without advertising (and by extension, tracking) many of the sites you enjoy every day would cease to exist.

At least using cookies you CAN opt out (via browsing settings and plugins). All that will happen is that the tracking networks will switch to browser fingerprinting making tracking harder to control and more opaque.

thomasz• 15 years ago

> At least using cookies you CAN opt out (via browsing settings and plugins). All that will happen is that the tracking networks will switch to browser fingerprinting making tracking harder to control and more opaque.

It's been a little while since I talked to a specialized lawyer about this, but if I remember correctly, the same regulations would apply to this tracking strategy.

Silhouette13• 15 years ago

Your post is one unsubstantiated claim after another.

Just because you fund your content through ads, that doesn't mean someone else can't use a different model. Sorry to be brutal, but if you can't find a viable alternative model when ads aren't cutting it any longer, maybe your content simply isn't worth that much and losing your site isn't a great loss to anyone else.

Moreover, just because you associate ads with tracking, that doesn't mean everyone else does. The most lucrative advertising deals I know about are between sites catering to particular interest groups and advertisers who also cater to those groups and make a direct agreement with the site. It takes actual work to set this up, but can be very lucrative for all concerned, particularly without any middleman ad network taking a big cut of any money changing hands. Many models from classic sponsorship deals to modern product placement approaches are based on this idea.

> All that will happen is that the tracking networks will switch to browser fingerprinting making tracking harder to control and more opaque.

That's probably going to be illegal, too.

In any case, browser fingerprinting is becoming a hot topic for all the wrong reasons. I expect near-future browsers will basically kill it as a technique anyway.

al_james10• 15 years ago

> Just because you fund your content through ads

Me and 99% of the sites I have read today...

> The most lucrative advertising deals I know about are between sites catering to particular interest groups and advertisers

In my experience, the most lucrative advertising campaigns are based on audience tracking and retargeting.

jsvaughan• 15 years ago

It will be interesting if this actually works out worse for privacy; say the site decides instead to remember you (for ad purposes) by ip address instead of by cookie, so everyone from that ip address ends up in the same profile target.

e.g. i visit a website to buy a birthday present for my wife, but later everywhere she browses she suddenly sees adverts for the shop or product that i bought.

al_james10• 15 years ago

They will use a combination of user-agent, IP address and other browser profile information. This is surprising good at uniquely identifying most computers.

It only really falls down when there are a large number of totally identical machines in the same IP range, where the machines are locked down so plugins (etc..) cannot be installed. E.g. a large office or university lab.

randallsquared• 15 years ago

They will use a combination of user-agent, IP address and other browser profile information. This is surprising good at uniquely identifying most computers.

But useless for the case he mentions where he cleared the cookies, but it doesn't matter...

Tichy3• 15 years ago

There are already lawsuits in Germany against websites using AdSense or Google Analytics. Also the Wordpress plugin Akismet (distributed spam filter) is apparently a no go in the future.

Just some examples - so yes, I think this could definitely hurt EU startups, or at least smaller projects that rely on adsense.

biafra2• 15 years ago

It is by no means against the law in Germany to use adsense or Google Analytics. You just have to get the consent of the user before you are allowed to have their personal information processed by a third party.

Tichy3• 15 years ago

I'm not a lawyer. Anyway, I have yet to see a web site anywhere on the internet that asks the user for said content. So we'll just have to wait how it plays out once web sites start doing that.

iwwr• 15 years ago

Try configuring your browser to ask for your permission every time a cookie needs to be stored. Some websites have 4-5 cookies and clicking "accept" (or "deny") several times over for a site is just unusable.

mike-cardwell• 15 years ago

I use the Cookie Monster addon for Firefox. it provides a similar interface to that provided by NoScript. It blocks cookies by default, and lets you permanently/temporarily accept full cookies/session cookies, on a per domain basis.

I can use news.ycombinator.com because the first time I came to this site after installing Cookie Monster, I set it to accept session cookies from ycombinator.com, and to permanently remember that setting. I don't need to let ycombinator set long lived cookies, and I certainly don't need to let clickpass.com set a cookie on my computer when I visit the news.ycombinator.com login page.

patrickg2• 15 years ago

In 10,20 years people around the world may ask the europeans how they got such a rather high privacy standard. While I don't agree to all of the regulations, the tendency here is to make everything private by default and only disclose what is needed. We should be able do decide ourself what to disclose without having to install add-ons to block everything.

That said: I also use tracking, but anonymize as soon as possible. And: there are enough laws that contradict regulations like these (such as the goverments force the ISPs to store the communication data from the users).

nhebb• 15 years ago

I won't be asking that until places like London get rid of all the police cams. Although, apparently they are highly effective: http://news.bbc.co.uk/2/hi/8219022.stm

While I applaud the EU's efforts on this, it seems a bit of stepping over dollars to pick up pennies. The bigger battles for privacy still need to be fought.

patrickg2• 15 years ago

We can find numerous examples where there are things (like the cameras you mention) that contradict the privacy regulations. But I hope that we don't get into a "well, it's all hopeless" mode. Thanks for the good pointer.

Silhouette13• 15 years ago

> The bigger battles for privacy still need to be fought.

They do, but you have to start somewhere, and at least this is a step in the right direction.

My personal view is that a privacy backlash is building. For the past decade or so, we have lived under an unwelcome combination of commercial interests who now have the technology to conduct mass surveillance and government interests whose politics is governed by fear, which in turn drives the surveillance state. I think it's becoming increasingly obvious that the cost/benefit in both cases doesn't justify the price we're paying, and it's starting to be the common guy or girl in the street who is asking questions and not just the privacy advocates and civil liberties campaigners.

As debates like this one start to hit mainstream media like the BBC, the political winds will shift, helped by the fact that many of the over-reactionary post-9/11 government administrations have now been shown the door so the political resistance is lower. As long as those of us who care can keep building the momentum, and the global picture remains more one of hope as dubious governments are falling than one of fear after a string of terrorist attacks, I think we'll start to build a more reasonable regulatory framework for protecting privacy when it's important to do so, without unduly disrupting useful innovations.

randomwalker2• 15 years ago

As numerous commenters have noted, this article twists/omits facts, blows things out of proportion, and doesn't talk about the benefit to consumers.

Tracking is currently a hot topic in the US as well, where a different approach, labeled Do Not Track is being pursued. I happen to be at the thick of it, so I thought I'd add that to the discussion.

Do Not Track (http://donottrack.us/) is fundamentally an opt-out from tracking rather then an opt-in, which makes it much harder to claim that it will threaten the ad industry, startups, puppies, or anything else [1]. It is an HTTP header which, if enabled, signals to advertisers and other trackers to stop tracking you across multiple third-party websites. First-party tracking is OK.

The Do Not Track option has already been implemented in Firefox 4. As of yesterday it is an Internet-Draft[2], and on the legislation side, Congresswoman Speier recently introduced a bill to give the Federal Trade Commission powers to enforce Do Not Track.[3]

I'm a computer scientist and this is my first major foray into the policy arena, and having worked with most of the people/entities involved in this effort, I have to say I've been pleasantly surprised how the disparate parts of the technology/policy/regulatory machinery started to work together.

I don't want to get into which approach is better, but just wanted to describe how we're doing it in the US. Feedback welcome.

[1] http://cyberlaw.stanford.edu/node/6592

[2] http://cyberlaw.stanford.edu/node/6633

[3] https://speier.house.gov/index.cfm?sectionid=48&itemid=6...

al_james10• 15 years ago

Yes, this is a far better solution.

It also gives flexibility back to site owners. If you business model depends on tracking (so much that a visitor who opts out of tracking costs you money) they are free to redirect the user away or throw up a paywall.

escanda• 15 years ago

This could be a good complementary way to tell the i.e. content provider you don't want to be tracked so it'd be no need to issue warnings.

Otherwise this measure is bland as it'd totally rely on the way the legislation is implemented or in the trackers' good faith.

Liability should be owned by the one providing the service you're consuming. The same way as they'd if I were paying them with my credit card in their commerce, I'm giving them my personal information as a retribution but instead of my credit card number.

smokeyj• 15 years ago

I'm always skeptical of a legal solution to a technical problem, but I wonder how this is to keep me safe from trackers on foreign soil? Wouldn't these companies just move there server a country over? What if our ISP allowed us to block traffic from those who don't comply with the don't track header, would that solve our problem?

randomwalker2• 15 years ago

Excellent question. One solution for this would be to prohibit US-based first-parties from doing business with noncompliant third-parties (similar to what you propose, but doesn't cut across different layers, so less messy, less potential for abuse). It is similar to how some other laws work, and it would be up to the FTC to make this rule.

obiwan421• 15 years ago

I'm usually not a proponent of EU regulations, but i don't think telling customers the truth should be considered harmful by any serious entrepreneurs.

Customers will probably be scared at first, but once they understand a bit more about tracking (which are harmful, which are not), opt-in system will definitely add to customer's confidence, and thus benefit to business in the long term.

sunsai• 15 years ago

This is another stupid face of Europe's health and safety madness. No wonder the growth rate is going down day by day in EU. Due to all these unreasonable regulations a lot of young start-ups have already moved to the US.

zepolen• 15 years ago

What if I write my app in such a way that makes it critical to use google analytics cookie, otherwise it won't work?

What defines critical?

jujjine• 15 years ago

if you have to have a big warning sign just for a cookie that will remember you for purely convenience so that it keeps you logged in. The user wont read that detail – they will just think your a privacy nightmare and wont sign up

The only times lay surfers have heard about cookies is in the news when severe privacy invasions have occurred. To those that have never heard of it, it is new, so they are cautious. Some parts of the industry have misused that technology and now the whole industry is called to gain back the users trust.

The EU law's intention is to shift the responsibility from the companies to the user, i.e. they will be the ones to decide weather they want to use cookies or not. To make that decision they need to be informed about it's positive and negative sides.

Regarding opt-out models, how many people will know about that? So if I'm not aware of opting-out, is it my fault if some company goes berserk with my privacy rights?

Facens• 15 years ago

The article does NOT describe the situation. The situation is different and is explained by this part of the Directive: "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service" And by the further comments to the text, clearly reducing the so claimed 'stupidity'.

Pascal Van Hecke wrote a useful comment explaining the situation and clearing the misunderstandings. The comment can be read here: http://eu.techcrunch.com/2011/03/09/stupid-eu-cookie-law-wil...

The real problem about this Directive (it's not a law, European Union does not make laws!), is how it will be converted in law by the single Countries; this could be the real source of confusion.

The real purpose of this directive is forcing to ask explicit consent for behavioral targeting purposes, not for simple analytics' cookies. We can't create buzz based on a misunderstanding!

lwhi2• 15 years ago

A tongue in cheek example of what users might face:

http://www.davidnaylor.co.uk/eu-cookies-directive-interactiv...

gyardley3• 15 years ago

Both the EU and US regulations will backfire badly. They both interfere with site optimization and advertising targeting, and both site optimization and advertising targeting impact profits.

Rather than taking the hit to their bottom line, publishers will adjust by making explicit user opt-in mandatory. Since explicit opt-in is nice and unambiguous, the targeting itself can then be a lot more invasive.

I really don't understand the desire to mess with the current system we have today, which works well enough. The small percentage of users who truly care about tracking have simple and effective technical solutions available to them. Publishers turn a blind eye to these unprofitable users, since their numbers are small. Finally, since most ad targeting currently falls in a policy 'grey area', the ad industry self-polices reasonably well.

At least there's going to be some interesting startup opportunities in detecting tracking circumvention and forcing compliance.

Silhouette13• 15 years ago

I couldn't disagree with you more.

The current system does not work. Tracking people around the Internet is shady behaviour any way you cut it, and a lot of people don't like it.

A lot more people don't even know about it, which is why the effect on sites today is still relatively small. Try sampling a population who have been fully informed about what is going on and see the reaction you get.

Ultimately, businesses do not have carte blanche to engage in whatever shady practices they like in the interests of increasing profits. This is why we have laws and why we punish businesses that break those laws.

If publishers who want to spy on everyone make opt-in mandatory in response to measures like this, they will just create a market for publishers who are willing to share their content with ads based on that content alone rather than on tracking individual visitors' personal details. This worked well enough to establish things like Google ads in the first place, after all.

I have about as much sympathy for any company hit by these measures as I have for cigarette companies who are forced to display a warning about the proven health implications of their product in big letters on the packet.

gyardley3• 15 years ago

Try sampling a population who have been fully informed about what is going on and see the reaction you get.

I've yet to see a 'fully informed' sample from anyone. While people don't like getting tracked, they don't like getting tracked in contrast to an imaginary situation where they can access all the same content with no tracking whatsoever, which simply isn't possible.

Whenever people complain about ad targeting, you should think of the guy who spends all his time grousing about taxes while still wanting the government to pay his for roads and his Medicare and his Social Security. Same thing.

Ultimately, businesses do not have carte blanche to engage in whatever shady practices they like in the interests of increasing profits.

Of course. This is why online businesses will end up doing what, for example, a credit card provider or a magazine publisher does - they'll tell you that they're going to sell your information six ways as a condition of receiving the service, and the public will say 'well, I want the service, so what choice do I have?' Unless, of course, the government makes the very practice of ad targeting illegal, in which case the content goes behind a paywall where the poor don't get to read it.

Now this argument is like the guy who thinks the government can balance its budget and lower taxes just by getting rid of some sort of vague unspecified 'waste'.

You are more than welcome to try to make real money through contextual advertising alone. Unless you own a search engine or are churning out made-for-AdSense content tailored specifically to search queries, you will fail. Brand advertisers doesn't do much contextual, so say goodbye to agency CPMs. The contextual stuff itself performs horribly when users aren't explicitly in 'search' mode. Why do you think those 'three weird tips to losing belly fat' ads are everywhere instead of Google AdSense? Yes, even that spray-and-pray CPA stuff outperforms contextual. Now picture all your brand advertising going away and trying to subsist solely on the pittance you get from education loan and car insurance ads. Now picture doing this while trying to produce quality content. Good luck.

I get that people don't like advertising, and I get that they don't like analytics. People expect the web to be like a backlit newspaper, and when they find out that their reading material is reading them back, they're disconcerted. However, they're just going to have to get over it, because that's the real price of 'free'. The alternative is paying for it, which helps turn the internet into a place for the privileged.

I've yet to see a scenario that's going to end up better than the muddling-through we're doing now. You can effectively opt-out just by installing an extension, as can anyone else who really, truly cares about a website knowing they're a college-educated male between the ages of 25 and 34. Stop trying to fix the world, you're simply going to make it worse.

olalonde4• 15 years ago

Another case of well intentioned intellectuals trying to protect the poor consumers from themselves but ending up hurting them.

tzumby• 15 years ago

The point is not to prevent this law in EU but promote it in the US as well, we have to level the fields but in the same time move towards better privacy.

Stupid EU cookie law will hand the advantage to the US

Related Stories