Cookie law makes most UK websites illegal: what you need to know

http://blog.silktide.com/2011/05/cookie-law-makes-most-uk-websites-illegal-what-you-need-to-know/

by Garbage • 15 years ago

75 74 15 years ago

blog.silktide.com

chalst4• 15 years ago

Enforcement has been delayed by a year. See, e.g., http://media.cbronline.com/news/ico-tins-cookie-law-till-nex...

Previously on HN:

1. Stupid EU cookie law will hand the advantage to the US - http://news.ycombinator.com/item?id=2304341 2. Europe's war on cookies http://news.ycombinator.com/item?id=2535837

The discussions here on HN were more useful, I think, that the linked stories.

benjash4• 15 years ago

ICO is literally a mile from house. Might pop round with some cookies.... a present for crippling UK industry.

Its not like where running behind already. Lets just nail that coffin fully shut.

chalst4• 15 years ago

Be friendly when you deliver the cookies: the ICO is trying to do its best with vague legislation - they don't get to decide how the courts will interpret the legislation.

yahelc• 15 years ago

Be sure that they're made aware of what's in your cookies, and have given full consent to receiving them.

sp332• 15 years ago

I hope UK websites don't start working like this: http://www.davidnaylor.co.uk/eu-cookies-directive-interactiv... (Don't click the checkbox, read the texts and keep clicking OK)

ehutch798• 15 years ago

So this law was passed without any technical solutions in place what so ever? It seems they completely ignored the tech community on this.

http://www.bbc.co.uk/news/technology-13541250

chalst4• 15 years ago

I think it was not so much that the community was ignored, but that the law was passed under unusual circumstances: usually the lobbyists inform the legislators, who defer to industry on the specifics. Here the lobbyists mostly hated the legislation, but legislators were more responsive to privacy activists because of widespread public concern. So the law is a triumph of democracy over technocracy.

And I think that's reflected in the legislation. The principles are OK, but the detail does not match up with practice. Hence the law is some way from being something workable.

It is well worth reading the ICO report: http://www.ico.gov.uk/for_organisations/privacy_and_electron...

yuhong• 15 years ago

Yea, I think the problem here is lack of technical competence of legislators.

extension4• 15 years ago

Ah, judging by that report, the law really seems quite reasonable.

Basically, if the user explicitly requests some functionality, like creating an account or saving a preference, and you need a cookie to do that, you don't have to ask permission to set it.

If you want to do anything else with the cookie, you have to get informed consent and the practical way to do that is by making it part of the request e.g. adding an explanation and checkbox to the signup or preferences page. Naturally, the more you want to do with the cookie, the more you have to explain to the user.

So effectively, you get to track users in exchange for their engagement with your site, and you have to (gasp) tell them exactly how you are tracking them.

extension4• 15 years ago

The solution is: a) stop using analytics and ads that set cookies or b) put an annoying dialog on your site.

I have to do some more research before I decide for sure where I stand on this issue, but I strongly suspect that the tech community is indulging in a little entitlement here.

As important as cookie tracking is to web developers, the vast majority of voting citizens do not believe they are deriving any value from it and do believe that it is a potential threat to their privacy. These beliefs seem reasonable to me.

It may be a financial blow to web businesses but I don't think it hurts any of the things that make the web valuable to people at large.

This is the kind of democracy that people scream for here: listening to citizens and citizens only. It kind of sucks when you are the corporate special interest being trampled on.

ehutch798• 15 years ago

actually, it hurts consumers, alot. without cookies, we won't have google analytics, or any of the major analytics packages. we therefore wouldn't know about things like screen resolutions, etc. so we'd have to design to the lowest common denominator possible, because we wouldnt know that only 1% of visitors have 800x600 screens now.

we also wouldnt be able to track conversion goals, which you seem to think is some kind of profiteering, but it's not just for ecommerce checkouts used in tutorials. for example i can use it to find out where people are hitting snags adding events to a community events calendar which i wouldnt consider a corporate special interest at all.

and what do we do about frameworks that automatically set a session cookie? they arn't just used on corporate websites.

also, i think you'll find that most corporate special interests try to minimize the numer of cookies set anyway, because when you compound a few bytes of cookies saved over a million visits, it's a large savings on bandwidth bills. not so much for cheaply developed local sites for non-profits and community groups.

mgkimsal5• 15 years ago

The google/doubleclick faction is being demonized somewhat by this. This will affect pretty much every company that has any sort of web presence beyond a static 'hello world' page.

Perhaps this will be a short term boon for freelancers to get to revisit existing sites and make them 'compliant' (a mini y2k all over again) but almost any interesting feature or functionality someone would produce is going to use tracking/cookies of some sort, both to provide value to the company and to the end user (collectively, "the public").

And yeah, I guess many of us feel 'entitled' to keep using something which we've been using as a global standard for the past 15+ years.

benjash4• 15 years ago

Currently I have the freedom as a user to opt out of all cookies. But when & if this law even comes into play I wont be able to opt out of the endless pop-ups asking me to enable cookies.

I'm all for protecting user privacy, yet its not a problem. Most users understand how to use 'private browsing'. Yet a lot will be puzzled why a website wants cookies?

This will massively cripple the EU online industries. I'm shocked at the lackluster response from the industry it self.

Additionally the law is both overly specific and vague. It seems to pick out certain technical functions yet state a vague and broad solution.

Plus the laws fails to stop any really bad forms of tracking.

mgkimsal5• 15 years ago

You certainly have the freedom as a user. However, imo, what's been missing since day 1 is any sort of moderately understandable UI for controlling this. Most people understand the basics of bookmarking. If we had some browser UI with 3 or 4 lights (red/green/yellow, etc) that we could click to allow some or all cookies on a per site basis, people would have a sense of control over all this stuff (just like they do bookmarking).

The problem comes in when 'cookies' are intermingled with the word 'privacy', and control over that is typically buried multiple levels away in swathes of technomumbo.

http://gyazo.com/77a1c905b6477b10f6ee71e760075db3.png

^^^^

That's listed in 'under the hood', which non techies would probably shy away from. Even if I go there, I have to 'manage exceptions' and decide whether to 'block third party cookies from bet set' (while at the same time having to ignore exceptions if I want to block third party cookies).

I know this stuff inside and out and it's confusing to me. I understand the geek need for 'low-level controls to tweak everything how I want it!' but for goodness' sake - if we have a few up-front always visible controls in a user-friendly manner, the EU ministers could block cookies all day long, understand how to do it, and understand anyone else could do it too. It would not have the appearance of the black magic it does now.

waqf• 15 years ago

Well, your example's from Chrome which has the worst options management ever. Quick, is cookie management part of "Basics", "Personal Stuff" or "Under the Hood"? Or maybe it's not in any of those at all, but in the spanner [wrench] icon dropdown? Is there any setting you might want to change for which it's clear which of those categories is most appropriate?

Isofarro11• 15 years ago

Your choice to opt-out of cookies has the side-effect of sites breaking because they assume cookies are accepted. So you're pretty used to broken / non-working sites.

In that case, I don't see in your case why having a constant pop-up message on every page of a working site is worse than a mostly broken website.

Do broken websites still work well enough for you?

This won't massively cripply EU online industries. Cookies used by the core service are unaffected, so EU companies can offer the same service as normal.

The restrictions really affect cookie based traffic reports (so use weblogs or image beacons instead), A/B testing preferences, accepting money from advertisers to track visitors through your site.

This hardly cripples EU online industries, it might have a positive side-effect of site visitors being more amenable to paying for online services which are currently ad-supported, so as to opt-out of cross-site analytics and advertiser profiling cookies.

The consumer having the choice about their privacy is an issue that's only going to get more important over the next couple of years. If your business depends on building profiles of users without their consent, yes, those businesses need to adopt non-cookie methods of doing this, and/or consider being more upfront to the visitors, and explain clearly why these features are of benefit to the visitor.

jamiequint3• 15 years ago

The definition of "cookies used by the core service" here is so far off its insane. Analytics packages like Google Analytics are not part of my "core service"?

It increases the burden on site owners collecting data about thing that are happening on their own site. Less data leads to less ability to make optimization decisions leads to a worse online experience for everyone who uses that site. If I can't A/B test my site how the hell am I supposed to improve it?

Additionally, for ad supported sites, don't be shocked to see revenue drop like a rock when sites can't fill any inventory with retargeted ads or other forms of more targeted advertising that pay a higher CPM. Less money = less resources = worse experiences.

jodrellblank• 15 years ago

The restrictions really affect cookie based traffic reports (so use weblogs or image beacons instead), A/B testing preferences, accepting money from advertisers to track visitors through your site.

The article says that anything which you could use instead to get basically the same end result a cookie, but which technically isn't one, is still covered by this legislation. If so, you would need to get consent for non-essential image-beacons as well, or weblogs(?) or whatever else you chose.

ehutch798• 15 years ago

Question, does this affect websites hosted in america (the continents) who might have UK based visitors?

benjash4• 15 years ago

This hasn't been clarified yet. Some people think it may effect all EU traffic.

Seems like we might having a tracking paradox.

ehutch798• 15 years ago

Right? especially where you can no longer really trust ip based geolocation now that we've run out of ipv4 address, and they're allowing single address trading. What you could once reasonable guess was a us address based on the ip block, may now actually be owned by a uk organization.

ehutch798• 15 years ago

also, does this law just affects sites hosted physically in the uk? if a site is on a server in the us, does that avoid it?

Isofarro11• 15 years ago

As far as I understand, from an off-hand chat with a lawyer last year, UK law applies to businesses that have a record or filing in Companies House. http://www.companieshouse.gov.uk/

modernerd• 15 years ago

In response to step 3, "decide what solution to obtain consent will be best in your circumstances", there's a discussion on ux.stackexchange related to potential methods for obtaining consent: http://ux.stackexchange.com/questions/7318/what-ux-solutions...

chalst4• 15 years ago

Oh, good link.

I've been toying with not explicitly asking for consent, but prominently displaying the fact that data gathering is taking place with an icon, along the lines of the cookie monster eating tracking data. Clicking on the icon pops up a control that explains what tracking I'm doing, the usability consequences of switching off tracking, and gives an off switch for tracking. The off switch is implemented by another cookie, but since this cookie isn't tracked (i.e., I don't store any data about the cookie on my machine), it isn't covered by the privacy law.

This seems in keeping with the spirit of the guidance on p8 of the FCO report: http://www.ico.gov.uk/for_organisations/privacy_and_electron...

5h• 15 years ago

as idiotic and frustrating as this is, I find it amusing to note this includes direct.gov.uk,

edit: the ICO's website now has a horrific warning at the top of it, which it didn't yesterday.

edit2, ICO's website has google analytics & an asp.net session ID yet their warning states "One of the cookies we use is essential for parts of the site to operate and has already been set." this would lead me to think that a cookie for a session key "essential" therefore admissible? ...

benjash4• 15 years ago

Need troops people. Anyone against this new cookie law please join this page. Need to spread the word.

http://www.facebook.com/pages/This-EU-cookie-takes-the-biscu...

charlesmarshall• 15 years ago

have you setup a petition? - http://petitions.number10.gov.uk/

Facens• 15 years ago

At iubenda we are working to solve this problem once and for all, by embedding a simple widget which provides a small popup for allowing the unnecessary cookies. We are working with our lawyers for designing an opt-in which is service-based, so that you need to "allow" Google Analytics just once for any website.

Stay tuned, we are working hard for fixing this issue.

plainOldText• 15 years ago

Rejoice while you still have time people cause the internet as we know it today will be no more. With so many attempts to alter the internet's status quo, is hard to believe none of them will go through. I dont want to sound pesimistic but I believe is the truth whether we like it or not. Things are about to change, for worse imo and most people are quite indifferent.

Luyt• 15 years ago

Indeed, it is time to write off the Web. I didn't like the Web anyway; I was happy back in 1991, with email, usenet, FTP, Archie, Gopher and Veronica. That was all we needed. The early Web looked interesting at first, but after a few years it became quickly overwhelmed by commercialism. The past years have even been worse, with the big-brotheresque webtracking of individuals and the erosion of online privacy. I wonder what will appear when the Web finally has become unusable.

Hisoka• 15 years ago

This should be an entrepreneurial opportunity for someone.

mrschwabe• 15 years ago

Peter Thiel was on to something....

"We need to figure out a way to escape from it (politics)".

Shit like this is a reminder that we don't have much time.

tomelders• 15 years ago

Slightly over egging the pudding with the headline I think. The government has stated that they wont be enforcing this law until they've figured it out themselves.

woodall• 15 years ago

In other articles I have read mention of allowing the user to opt in via the browser:

For example the directive suggests users can express consent through the use of browser settings, whereas the ICO guidance states, "At present, most browser settings are not sophisticated enough to allow you to assume that the user has given their consent to allow your website to set a cookie… We are advising organizations which use cookies or other means of storing information on a user’s equipment that they have to gain consent some other way."

http://www.clickz.com/clickz/news/2073597/cookie-law-creates...

This would be pretty easy to do with an extension and something like OnePass or OpenAuth. My issue with that solution is the centralization. I like having multiple passwords, however, I also like having everything blacklisted and making the user whitelist websites.

We are still waiting on over half the EU to say that they will implement this. Can't wait to see what interesting ideas spring up.

eiji3• 15 years ago

What am I missing?

Example 1: Amazon uses a cookie to keep track of login and a shopping cart. -> No popup since they are essential.

Example 2: foobar.blog.com uses cookies to track me (ad-banners and analytics). -> Popup to ask for my consent for those "useless" cookies.

Now I understand that the "useless" is somewhat debatable, but I very much welcome the discussion. This is not about breaking the web, and postpone this law is a good idea, but I look forward to start cleaning up the cookie mess. "Do not track" and "don't accept third-party cookies" get's us half the way, but since the web-industrie does not react to the european pursuit for high privacy standards, it might be a good time to suggest some laws to create pressure.

What law would I suggest? Primary cookies (example 1) are okay without a popup, secondary cookies (example 2) either expire on the same day, or need a popup to ask for permission to stay on my computer for longer than a day.

dangrossman3• 15 years ago

How many sites have Google Analytics or something similar? I would argue that analytics are as essential to the operation of an online business as shopping carts. Allowing a large portion of your website users to opt out of analytics effectively cripples you compared to competitors based out of countries without these restrictions.

eiji3• 15 years ago

Fair enough! But let's separate between session-specific analytics, and lifetime analytics. As a person concerned about privacy, I don't care much about "your" analytics about click-through and how long I stay on your site and what I click and what not, this is session specific, and helps you with your business. However, this should be possible with "one-day" cookies. You don't need to know that I was on your site a week ago, and that I happen to leave your site with a full cart for some reason, or that the last banner with food did not work on me, so this time you'll try the car-banners.

Isofarro11• 15 years ago

> How many sites have Google Analytics or something similar? I would argue that analytics are as essential to the operation of an online business as shopping carts.

I think you are overstating the case for Google Analytics in particular, as well as blurring the value of other non-intrusive methods.

Remember, this only affects UK companies dealing with UK visitors (or perhaps EU companies dealing with EU visitors). You still have complete control to stomp over all privacy concerns of US and other non UK (or non-EU) visitors. So you are not completely losing the value of Google Analytics, you just need an informed consent of a subset of your audience.

adnam3• 15 years ago

FTA: "a cookie which was set to welcome a user back to a website, or to record what pages they view would not be strictly necessary"

I can imagine a good case for saying this kind of thing is essential from a usability perspective. Who's to say if it is "strictly necessary" or not?

Isofarro11• 15 years ago

The spirit of the law is protecting the privacy of site visitors from being leaked to third parties, intentionally or otherwise, and gaining their informed consent before doing things with cookies that violate that privacy.

So the particular focus on third party cookies (be it 3rd party analytics tools and/or third party advert networks and/or 3rd party AB testing frameworks). These 3rd parties amass browsing habits and habits of visitors across multiple sites and topics. They use that information to build personalised profiles of an individual. This is done without the individual's consent. So the individual believes they've visited a set of independent websites, and they don't realise that some third party is watching over their shoulder. If they realise that is happening, and the implications of that, they would probably decline to participate, if they knew how.

So consider the use of cookies with that as a guide (but I am not a lawyer, if you are not absolutely certain, consult a lawyer).

I, for one, would be very surprised if a business got successfully sued for having a first-party cookie that clearly wasn't shared with any other site that was used to present a "Welcome back" message. Unless there was a third party script on the page watching for the appearance or non-appearance of that message.

spjwebster4• 15 years ago

I don't get what's so hard about the concept of "strictly necessary". If you take the cookie away and the site ceases to function such that the user cannot complete tasks they are there to do, then the cookie is strictly necessary. If the site continues to function, even if your business analytics are somewhat impaired, it's not strictly necessary and you need to gain the user's consent to set it.

ChrisArchitect• 15 years ago

this has got me a bit confused and the absurdity of trying to put a blanket policy on something as global as the net and something somewhat not-geo-specific as domains and sites, confounds me

they should start by banning foreign hosting of uk ccTLDs...

Andrew_Quentin2• 15 years ago

Can't we all just ignore it? What are they going to do? Send us all to prison?!

The law is based on consent. Social Contract. All of that...

spjwebster4• 15 years ago

Ignoring this law means ignoring the privacy concerns of your users. If you're happy with that, you're part of the reason this law was introduced in the first place.

Andrew_Quentin2• 15 years ago

What privacy concerns? That they came to a site and stood around for 4 minutes and read some article?

Are my users concerned to go out too, and of their dress, and is that privacy also?

How would they like it if the first greeting in a shop was, Hello, we are watching you, we are here to serve you, and take as much money as we can from you.

Why do they not go after the people who actually do the tracking? Why do they not impose a legal obligation on google and ad agencies to not track, or on facebook or whatever. Why go after thousands of people. Not everyone is a programmer. Many website owners have no clue what a cookie is, which one is essential or otherwise, how to not store cookies, or delete them, etc.

The end effect is then that the web stops being free from all. The cooperation, with the resources to abide to such laws, once again take control. The man on the street can not any more simply get a template from some website and put some ads on it. He needs to pay some programmer which he probably can not afford.

What user has been hurt? What privacy has been infringed? What have we found out about anyone which was previously secret?

This is about control. Nothing else. As such, the people will do what they do best when met with ridiculous and far reaching laws, ignore them. Let them arrest us all!

Cookie law makes most UK websites illegal: what you need to know

Related Stories