Europe's war on cookies

http://www.wired.co.uk/news/archive/2011-05/11/cookies-regulations?page=all

by Jaderberg • 15 years ago

27 36 15 years ago

wired.co.uk

chalst8• 15 years ago

The UK Information Commissioner's report on the coming legislation:

http://www.ico.gov.uk/~/media/documents/library/Privacy_and_...

There is no requirement to ask for permission to issue cookies if the cookies are "strictly necessary" for the task, such as for logging into a user account or using a one-click -style purchase. I have the impression that it will principally affect user-tracking systems like Google Analytics and those used in targeted advertising.

Something about the law is unclear to me: the ICO's summary of the law seems only to apply if you store state about the cookie. If you insert Google's javascript to issue an Analytics cookie, doesn't that make it Google's problem, since they are storing the data about the cookie? Which would be kind of harsh, since they have no control of the web page's behaviour. But the ICO report talks of there being site owner's responsibility if they cause the data gathering to happen, which suggests that is the problem of the Analytics javascript embedder.

Jaderberg• 15 years ago

Thats a good find. However "strictly necessary" is pretty vague. Tracking your own users on your site to optimise it for them would potentially be out of the question. Though if you sign up you could implicitly allow it with terms and conditions.

Still doesn't help with anonymous users...

chalst8• 15 years ago

I'm still reading the ICO report. It does talk at some length about what kind of measures are needed to comply with the coming legislation, and emphasises that the rule is about privacy protection, and that uses of cookies that don't build up a picture of users aren't what it targets.

The legislation does look bad for startups whose business plan revolves around accumulating data on users or selling targeted ads, but the ICO report looks pretty aware of how cookies are used in practice and not at all the "ignorant intervention" that the article describes.

chalst8• 15 years ago

"Implicitly allow it with terms and conditions"

The ICO report says that is fine, provided that it is (i) sufficiently informative and (ii) you provide an update to existing users about the change in terms.

I'm wondering about the following: what if I wrote a bit of Javascript serving up a picture of a pile of cookies during normal use, which can be clicked on to to call up a pop-up window describing how my site makes use of customer-tracking software with a dialog allowing the user to switch to untracked mode. Untracked mode could be implemented by issuing -you guessed it- a cookie, but one which is only used to check that the user opts out, and so is "strictly necessary" for this approach.

It's sailing close to the wind: there's no positive act of consent; but by making it easy to see the state of privacy and change it, it is arguably more privacy-friendly than a T&C. I'm tempted to try it on my site and get feedback.

The ICO report also talks about use of browser settings to govern privacy.

dave1010uk3• 15 years ago

Page 4, section "What will happen to me if I don’t do anything?":

> In light of this if the ICO were to receive a complaint about a website, we would expect an organisation's response to set out how they have considered the points above and that they have a realistic plan to achieve compliance.

So basically compliance isn't required, just a plan to achieve compliance.

"Our realistic plan is to implement an invasive po-pup sometime within the next 3 centuries."

chalst8• 15 years ago

I interpreted that as describing their response to the first raising of a complaint, not a limit on the measures ultimately available to them.

darklajid4• 15 years ago

> Traditionally, the US and the UK have taken a more relaxed approach to privacy. But the legislative and interventionist tendencies of Europe -- and of France and Germany in particular

Now, this is the first time in a decade that I couldn't avoid a smug face and tiny bit of affection formy home country..

Seriously: As others pointed out here, this is a targeted law against privacy breaches. If your company builds its business model on user tracking you'd better ask them to opt in.

I seriously cannot even understand the negative sentiment.

relix3• 15 years ago

What's wrong with advertising geared towards your interests? Or do you enjoy watching ads on penis enlargements, gambling, whitening teeth and How To Get Rich While Sleeping?

barrkel• 15 years ago

It implies that someone has built a profile describing your interests from your behaviour. Many people find that creepy, and not worth targeted advertising. It's reminiscent of secret police behaviour with their networks of informants, and is not a distant memory in much of Europe.

codeup3• 15 years ago

You could also ask: What's wrong with news and political information geared towards your political opinions?

LaGrange• 15 years ago

Wait, what, what's wrong with optimizing the brainwashing techniques applied to myself?

Yeah, I do prefer seeing ads for stuff I don't need and would never buy than ads for stuff I don't need but it's vaguely possible I might be brainwashed into buying. If I think I need something and I want to browse ads for that something, I will just find a relevant catalogue/industry magazine/whatever.

See, if someone finds a security bug that allows to change something in our computer's software, we freak out and go for patches. If someone finds a bug in our brains, we call that "ads custom-tailored for your needs."

darklajid4• 15 years ago

"My interests" are hard to define without collecting far too much information about me.

Good example for "of interest" in my opinion:

If I shop with Amazon and bought Product A, B and C and your database of previous orders suggests that I'd like to buy the new Album of Justin Bieber: Fine, go ahead and suggest that to me.

In that case you used just the information that I sent to you and correlated that with a little bit of inventory/anonymous order history magic. I get recommendations from you because I am your customer already and provided you with a limited insight into "my interests".

Now - if you track me across sites, try to create a profile of me without my consent and my explicit knowledge and then try to sell this as being relevant, a good idea and targeting "my interests" I have some doubts that we're talking about the same thing.

Travis• 15 years ago

For me, informed consent is the issue here. If I sign up for your website and then log in, I think it's probably fair game to target things to them. In fact, that's generally the point.

My real world analogy is an invisible store employee following you around, helping you shop, but also writing down every movement you make, and every conversation you have.

It's more than a little creepy if they do it without asking.

dave1010uk3• 15 years ago

There are other ways to track users than cookies[1]. With enough browser information you can identify users fairly uniquely.

[1] http://panopticlick.eff.org/

Knacker_Hughes2• 15 years ago

I see this also covers the use of Flash cookies, but I wonder about the use of Etags as a tracking mechanism.

If I recall correctly, some of these sites use cookies, Flash cookies and also unique Etags on an object in the browser cache to try to work around people blocking cookies from their domains.

chalst8• 15 years ago

Any technology causes client machines to store information for later access are within the scope of the law.

The exact wording is a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements ... are met.

Knacker_Hughes2• 15 years ago

OK - that's great.

In practical terms though, all they're storing is a key. The actual data is held elsewhere. In the same way, an entity tag on a cached object is like a key to identify whether the object has been modified on the server since the last time it was sent.

How would it be possible to spot that it was being used for tracking a user rather than just part of the normal functioning of the browser?

meow• 15 years ago

I don't get it, how do users login to the websites (like gmail) without using cookies ? Does this legislation target only permanent cookies that stay even after the user has logged out ?

chalst8• 15 years ago

According to the ICO report on the legislation I linked to, use of cookies needed to provide the user with a service they have requested is explicitly permitted. Likewise, if your use of the cookie does not violate privacy (i.e., you don't build up a user profile), it is OK.

dave1010uk3• 15 years ago

That would most probably come under "strictly necessary".

hardik988• 15 years ago

Do the regulations say anything about localstorage ? I guess one could use that in place of a cookie..

mooism2• 15 years ago

AIUI it's not specific to http cookies, but applies to anything being used as a cookie. So flash cookies, html5 local storage etc all count as cookies for the purposes of this rule.

JonoW4• 15 years ago

One thing I don't get is how a site-owner is meant to know what cookies a 3rd party may send. If I add a Facebook "like" button to my site, does FB send a cookie? What if they don't now but decide to later. And if FB does decide to use cookies down the line, how do they ask your opt-in?

You can send cookies with any HTTP reply, so how do you know if that image you are hot-linking from a 3rd party site doesn't send back a cookie?

There seem to be so many technical vagaries that make this so tricky to implement properly.

chalst8• 15 years ago

This seems to be pretty hazy. The ICO report says we would advise anyone whose website allows or uses third party cookies to make sure that they are doing everything they can to get the right information to users and that they are allowing users to make informed choices about what is stored on their device.

Europe's war on cookies

Related Stories