Slashdot Mirror
"Breathtakingly Stupid" EU Cookie Law Passes
Reader whencanistop writes with some details on an upcoming EU law that slipped under the radar as it was part of the package containing the "three strikes" provision, which attracted all the attention and criticism. "A couple of weeks ago we discussed the EU cookie proposal, which has now been passed into law. While the original story broke on the Out-law blog from a law perspective ('so breathtakingly stupid that the normally law-abiding business may be tempted to bend the rules to breaking point'), there has now been followup from a couple of industry insiders. Aurelie Pols of the Web Analytics Association has blogged on how this will affect websites that want to monitor what people are looking at on their sites, while eConsultancy has blogged on how this will impact the affiliate industry. In all of this the general public is being ignored — the people who, if the law is actually implemented, will have to proceed through ridiculous screens of text every time they access a website. I know most of you guys hate cookies in general, but they are vital for websites to know how people are accessing the sites so they can work out how to improve the experience for the user."
Indeed, this isn't the '90s anymore. We have technology that allows us to better target advertising and better track our business. Why legislate ourselves back to the days of broadcast advertising and a stateless web? And to those who say to use log files for analytics, you have to be kidding me. You obviously don't run a website.
You can, could, and still will be able to block cookies in your browser, so whatever web site operators are doing with them, it isn't going to affect your privacy or "trackability".
Unfortunately, that isn't really what happens.
For example, many sites now use local shared objects ("Flash cookies") to store data, rather than regular cookies. No mainstream browser controls these by default, so even if you have disabled all cookies in your browser's privacy settings or asked to clear all your private data, LSOs will still work. Moreover, use of LSOs is often not even mentioned in a site's privacy policy; even big-name sites like YouTube have been offenders in this respect. Moremoreover, the way to disable these little buggers in Flash is hidden in a settings dialog that most users wouldn't even know to exist.
Maybe I'm crazy, but I don't see how failing to disable something that is being used to do something you never asked for, which you don't know is happening, via an obscure dialog you don't know exists, can constitute implied consent, particularly if you've explicitly disabled all similar functionality that is presented in your browser's UI.
I can't decide whether this is Brazil-style bureaucracy galore, or Eastern Standard Tribe-style anti-productivity warfare.
Neither, it's basic privacy protection, and as far as I can see it's long overdue and a good thing. Why should we support out-opt monitoring rather than opt-in, just to make life easier for those who want to produce targeted advertising and affiliate blogspam?
If you have a legitimate need to use cookies, for example to help a user with a shopping cart or remember they've logged into your forum, then there will be no problem stating clearly at the point that they start to use these facilities that a cookie will be set for that purpose. If you manage to wade through all the FUD blog posts and find the actual wording we're talking about here (you'll want article 2, clause 5, on page 76), you'll notice that this does not require UAC-style dialogs or 'screen after screen of "permissions" to continue'. In fact, there is even wording saying that the new rule doesn't apply in cases where the user has explicitly requested a service that needs to store cookie-like information to function properly.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
What browser do you use? IE, Firefox, and Opera all have a very simple user setting that you can turn on. It's off by default, but is really easy to turn on.
The instant you do, you'll be asked every time a site wants to set or use a cookie. With most of them you can even differentiate between first- and third-party cookies (so cookies that originate from the site you are visiting can be tracked differently from cookies that originate from other sites). Once a site has been asked about, most browsers allow you to choose between four functional options (they are presented differently in each browser):
1. Yes, and always allow cookies from this site or domain without asking.
2. Yes, just this once.
3. No, just this once. Ask me again next time.
4. No, and never allow cookies from this site or domain again, and never ask me again.
Actually, you owe it to yourself to turn this feature on, if only for a short time before the popup warnings drive you insane. It's a real eye-opener as to how much cookies are used on the Web today.
Ideally, all browsers would come with this set on in the beginning, with a large prominent button that said "never ask me this again - by pressing this I give my browser permission to gobble down all the delicious delicacies it wants". EU happy, users happy, trackers happy. And for those who really, REALLY care about tracking cookies, well, don't push the button.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."