Slashdot Mirror
"Breathtakingly Stupid" EU Cookie Law Passes
Reader whencanistop writes with some details on an upcoming EU law that slipped under the radar as it was part of the package containing the "three strikes" provision, which attracted all the attention and criticism. "A couple of weeks ago we discussed the EU cookie proposal, which has now been passed into law. While the original story broke on the Out-law blog from a law perspective ('so breathtakingly stupid that the normally law-abiding business may be tempted to bend the rules to breaking point'), there has now been followup from a couple of industry insiders. Aurelie Pols of the Web Analytics Association has blogged on how this will affect websites that want to monitor what people are looking at on their sites, while eConsultancy has blogged on how this will impact the affiliate industry. In all of this the general public is being ignored — the people who, if the law is actually implemented, will have to proceed through ridiculous screens of text every time they access a website. I know most of you guys hate cookies in general, but they are vital for websites to know how people are accessing the sites so they can work out how to improve the experience for the user."
I've seen examples where third parties require cookies to analyze the usage patterns of users on client sites but I don't require logs to understand usage trends on sites where I have easy access to log files. In fact, I think usability testing would reveal more than analysis of usage data.
Maybe it's a bit harsh. But so are the abuses of cookies.
Cookies are used to keep a shopping cart. That out-law.com article spells that out. Cookies are used to track logins on forum sites. There might be an implied consent, there. But to be sure, just ask for consent when users register. Previously registered users would be directed to the consent request page once the next time they try to login. Explain that the consent is for the cookie used keep their login state. Explain that without consent, the login process cannot be completed and the user would be limited to the access level of a non-logged-in user.
Now, what else are cookies used for, that consent should not need to be given for?
now we need to go OSS in diesel cars
I don't see the problem at all.
If you are running an Amazon affiliate program you should have no problem telling your users that by clicking on the link to the product you are recommending that you get a portion of the sale. If you can't admit to that, then you aren't being honest with your users.
Likewise with Google Analytics. What's wrong with telling your users that you want to track how they access your site so you can improve it? Oh, there's the little bit about letting Google build up a profile on you. Well maybe someone will come up with an Analytics system that doesn't have a big brother behind the scenes.
... is to an old slashdot story which even says the initial write up is wrong and it has a link to a yahoo story which no longer exists. Come on guys , I know this is slashdot but try a little feckin harder for gods sake.
Since we're talking statistics, the largest problem is understanding. Most people don't. Maybe that's why people prefer to use external tracking services instead of using the information already on their own website: The access logs. Otherwise I really don't see why you'd use them. No, it won't get everything, but it _will_ give you general trends. And with a large enough sample those trends will be obvious enough.
Plus, all this focus on ``user experience'' gave us dancing rodents and several big fat stacks of proprietary, closed, and platform-dependent stupidity of the likes of flash. The most prevalent user experience therefore has to be ``confused boredom''. And in a score or two years, bitrot has ensured all that crap stays lost forever. That's a definite boon, but not good for general archiving, and therefore a problem.
My core concern with websites is what content they have to offer, and if I can't find it, I'm gone. Flash? bye-bye. Confusing layout? Two more clicks and I'm gone again. A sitemap? Click on it and search for a couple keywords. Nothing? Ciao! And so on, and so forth.
``User experience'' is overrated. Focus on the message; write it for me and not at me, make it easy to find, easy to flip through, easy to search, easily available. And for that, you really don't need cookies, and you especially don't need and therefore shall not require javascript, java, or some other proprietary plugin.
If you want to track your users, all you need is a small shell script to connect requests, referrers, and timestamps together and you'll have more info than you could possibly need already.
"to know how people are accessing the sites so they can work out how to improve the experience for the user."
Oh please, pull the other one....we all know what cookies are ultimately used for.
Don't even try to feed us that line that this is needed for "proper feedback"
This isn't the 90's anymore....
End of Line.
From one of the linked articles:
Here's what's coming. The now-finalised text says that a cookie can be stored on a user's computer, or accessed from that computer, only if the user "has given his or her consent, having been provided with clear and comprehensive information".
An exception exists where the cookie is "strictly necessary" for the provision of a service "explicitly requested" by the user – so cookies can take a user from a product page to a checkout without the need for consent. Other cookies will require prior consent, though.
~The Out Law Blog
So- some websites will have an EULA page. Big deal. Actually, that's not at all a bad idea now is it? So why all the hoopla?
(Note: The originally linked slashdot post linked a Yahoo News article that's no longer valid).
http://www.bistolas.net
Couldn't browsers be made "EU-compatible" and give users a settings checkbox that says (more or less) "I either don't care about cookies or I'm perfectly comfortable dealing with them on my own (either with plugins like CookieCuller or manually.) Bring 'em on!"? Or doesn't the new law allow that?
Prisencolinensinainciusol. Ol Rait!
There are in fact still people who refuse to allow cookies, and there are still browsers like lynx that require explicit confirmation from the user before they accept them(In fact, the directive does not ban cookies. It simply mandates the default behavior of lynx.). Ask yourself; what can be accomplished with a cookie that can't be accomplished using alternative mechanisms. Try thinking outside the box you've been in for the last 15 years.
Let us be frank. Cookies have been abused. Horrendously abused. Private companies have tagged, tracked, and stalked billions of people. We have allowed terabytes of data on the lives of everyday people to fall into the hands of completely unscrupulous entities. The information held by even smaller marketing outfits would 20 years ago have seemed like a treasure trove to organizations like the Stazi and the KGB. Does the fact that such information is akin to that desired by secret services mean that the collection and indexing of this information is inherently wrong? No; but it is a big hint that it probably is.
The EU may have blundered here, throwing the baby out with the bathwater. But I think their basic motivations were very admirable. As out lives move more and more onto the net, we cannot accept the current status quo of companies like Google, Yahoo, Microsoft and the rest being allowed to do as they please with data on other people. The Despite the unworkable nature of the law, the EU is moving in the right direction on this.
May the Maths Be with you!
Cookies are often used to store user variables when they go from one page to another - patching holes the stateless web protocol forces on the user experience. Session or server-side variables may also be used for this, but that's more work for the web designer, who usually is up to his neck trying to support different versions of IE misbehavior.
Sites I've worked on have never used cookies to send back personal information, but they have used them to improve the user experience.
This doesn't sound "breathtakingly stupid" to me. It's debatable. Maybe it's "breathtakingly stupid" that it slipped through without notice, but if we are talking about what's right and what's wrong, it can be argued (and often is, I'm sure) that one should expect to have privacy in regards to their browsing habits*. The fact that it negatively impacts businesses should be irrelevant, if we are talking about protections for the individual.
* Yes, you can turn off cookies from the user end, but laws are sometimes there to protect people who don't know any better, and there are a *lot* of them in this case.
They are also used by most PHP based web sites using the session feature.
What's the point to ask:
sessionID=zaFgGG13sddf.34ciuoy
Do you agree [Yes] [No]
The problem is you need to show the user the text before they can view your website. Just imagine you are using google to search for something and once you click a link, you end up not on the content you expected but on a
"We use cookies to track users in the following ways, blah blah blah. Is this okay with you"
That would suck so much.
Yeah, total agreement, here. This stupidly transparent, self-serving quote says it all:
"...but they is vital for websites to know how people are accessing the sites so they can work out how to improve the experience for the user."
User experience? WTF? Sorry,but the only reason you need invisible-to-the-user cookies is so you can monetize them without them realizing just how much privacy/anonymity they're giving up. Because that might give users pause before they accept your cookies, if they had an informed choice.
And everybody here knows that. The quoted jackass in TFS is just trying to make his industry look like a victim, to drum up support from civil-liberties sympathizers on Slashdot. Too bad we're not that dumb...
As an employee of the advertising industry, I have zero problems with monetizing Internet traffic, or with using cookies to track user behavior, etc., etc. But I hate liars, and I hate people who try to manipulate me.
This is an irrelevant and distracting question, because cookies are always used with consent.
A web server replies, in response to a request initiated by the user, with a header that says, "Here's a little piece of information and I hope you pass this back to me on subsequent requests."
The user's agent -- software chosen by the user to do whatever it is that they're trying to do -- sees this completely advisory information and decides, perhaps even with a confirmation dialog with the user (or not, if the user has decided that they usually want the same behavior every time without getting bothered), to store this information. And then it decides to pass this information with the next request.
The entity the user is communication with, ultimately has no choice about whether or not the user really does this. It's all up to the person who is using the browser. Or, in very old browsers that don't have dialog preferences for cookies, it's all up to the browser's author, to whom the user decided to defer to when they install the software.
Cookies don't do things. Users do things with cookies. Servers reward users for deciding to send the cookie.
If you have chosen to transmit cookies, take responsibility for your decision, instead of crying to the government and demanding that cookies never be offered to you.
Even if it seemed reasonable, give it a week or two and most would hastily click 'agree' without reading. It would be like UAC in Vista, not the worst idea at the core, but the poorest possible implementation.
Personal data almost always isn't stored on cookies. You give your personal data to a company. They probably don't even link that data up with what you do on the website via cookies. If that company then sells that information on to someone else or uses it for reasons that aren't ethical, that isn't down to cookies. That is down to the company being crap.
Yes, grocery stores can match bank accounts and stuff. Reason why I pay cash and object vehemently to the "trend" where the combined stores are waging a vendetta against cash and are already trying to require use of electronic and therefore trackable means. All in the name of "safety" of course. Bunch of underhanded jackassholes.
Thing is, there exist alternatives for cookies, too. Only, you'll need access to the webserver to get the logs and that makes it much harder for third parties to gather the data. There was this trend, maybe it still exists, where sites required cookie acceptance. So I accept them all and safely store them in /dev/null. No ``user experience degradation'', heck, no discernible difference. Coincidence? I Think Not.
Indeed, this isn't the '90s anymore. We have technology that allows us to better target advertising and better track our business. Why legislate ourselves back to the days of broadcast advertising and a stateless web? And to those who say to use log files for analytics, you have to be kidding me. You obviously don't run a website.
There seems to be an assumption that cookies are almost entirely used for evil tracking of website visitors. People have brought up shopping carts and logins, but there are many, many other relatively minor uses for which cookies are useful. Are we to provide you with a disclaimer every time we want to make sure some little setting that you have clicked "sticks" as you jump between pages? Yes, there are other tools to do this job, but cookies are also a specific tool for a specific job.
I find it interesting to hear many people claim the evils of cookies are so bad that they need to be outlawed, when in the end, it is the user's choice if they want to accept them. Isn't this akin to saying that we need to ban content on television or the internet because sometimes it could be used for evil? If you can use the argument of "just turn the channel" or "just don't go to those websites" in those cases, then why isn't the same argument good for people to just turn off cookies? If enough people do that, then the web developers will use a different tool to get the job done, and cookies will fall by the wayside. You have an "off" button on your cookies. If you don't like them, then use it.
To quote Roger Waters: "Are there any paranoids in the audience tonight? Is there anybody who worries about things? Pathetic. "
Seriously. Not "most of us" hate cookies. A paranoid few do.
If it weren't for cookies, this site wouldn't remember my login. Google apps wouldn't work well. The browser would not retain my per-site preferences.
I rarely ever clear cookies.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Om nom nom nom nom nom nom nom!
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
Cookies are used to keep track of a user's session, especially when it crosses a load balancer and gets sprayed to any number of identical servers. Without the cookies, there is no way to keep your session on a consistent web server throughout a session. Remember things like "www3.netscape.com"? Cookie-based load balancers are what fixed that situation.
Yes, cookies are abused by advertisers, but quite frankly, I don't give a damn if a site wants to use them to follow me on their site. They DO use them to see which products are popular, what items are considered together - valid data that lets them make business decisions. I know from working with web design firms that they can be used to track flows through a site and tell what parts of navigation are difficult, and if users are missing the "intended" way of using a site.
There are lots of valid technical uses for cookies. I've never understood why they're vilified. It's a tiny chunk of usually random/hash data that's put on your computer by the remote site. Why should you care if they then retrieve it? The only objectionable use is cross-site cookies used by advertisers, and most decent browsers let you disable that class of usage, but not the rest.
I don't know what kind of crack I was on, but I suspect it was decaf.
If it weren't for cookies, this site wouldn't remember my login.
But then again, having a site "remember you" between sessions is a security risk. I mean ok, who cares if your brother starts trolling people with your slashdot account if he comes over for the weekend... but just the concept. You know, you CAN provide unique service to someone using a login, session ID's and designing your website with the appropriate GET/POST commands. Admittedly it is a LOT more work for the web designer, but far more secure than cookies. However you guarantee that the session "expires" the minute you close the web browser.
Seven puppies were harmed during the making of this post.
Ok, no cookies. Poor me. You're just making it more difficult, but there are ways around it.
1. The malware and other scrupulous sites you hate so much... They wont obey your rules.
2. I hope you enjoy long query strings, because everything is going to be passed from page to page.
3. If you don't, expect every link to become a javascript POST.
4. You'll be required to create an account a lot more often so we can store everything server side and restore to SESSION variables when you return.
5. And expect a lot of free content sites to go belly up. No cookie, no revenue.
6. What percentage of sites these EU customers visit are hosted outside the jurisdiction?
Do not meddle in the affairs of sysadmins, for they are subtle, and quick to anger.
Why do government people think that passing laws like this can fix a problem that is fundamentally a technology problem? The problem is that when lawmakers focus on tech, they often focus on regulating the tool instead of regulating behavior. So you get situation like this:
Trigger: People are killed with a hammer.
Response: Ban Hammers.
Unintended consequence: Entire construction industry out of business, everything falls to disrepair, screw industry explodes, scarcity of hammers lead murders to switch to using rolling pins.
In this case, the issue is user privacy. Regulating cookies does little other than break the web which is in many ways cookie dependent for many different dynamic interactions between applications on servers and browsers. So, you break the internet, reduce security, and move advertisers to using something that's not a cookie to tag visitors with (lots of ways to accomplish this).
It's that old guns don't kill people, people kill people thing.
-- $G
The reason this has come to the extreme is simple. If a website / web app uses cookies, it should clearly state so in it's disclaimer / privacy policy in such a way that people who visit the site should be able to know exactly what information is being taken from their visit by the website. If this was done upfront and in an honest fashion, this issue simply wouldn't be. As it is, many websites either keep this info in a generic way or just plain omit it. Now I'm not talking about fishing/scam websites, of course. These make the issue even worse. So now, cookies are being managed through legislation.
You can use php sessions without cookies. Search for "php sessions without cookies". It's all there. And turn in your programmers' card because you didn't know something as basic as that.
If you're site is using cookies, no problem - this directive isn't going to affect you. If you're site loads third party cookies then this is what this law is addressing. There are legitimate uses for third party cookies, and your users will have no problem recognising and understanding those uses and probably consenting to the cookie. I'm guessing you're only going to be concerned if you're loading some advertising, affiliate stuff that you'd rather the user didn't know about. And check your logs - all those none IE visitors can already disable third party cookies easily in the browser preferences. If you're site, or revenue relies on using technology from the 90's then the EU is the least of your problems...
Submitter apparently is counting on /. readers to not follow links but merely form opniions from TFS. This is presented as though it were a list of blogs bashing the new law from all angles... but in reality:
- The first link is to an old /. entry. TFS from that entry has an update acknowledging that the summary write-up is wrong and encouraging readers to RTFA, but its article link is broken.
- The 2nd link is to a blog hostile to the law. Its writing style clearly shows bias. It is light on facts or citations to authoritative references, and heavy on assumptions about how to interpret the law.
- The 3rd link is to another blog disagreeing with the interpretation from the blog in the 2nd link, and saying that the law doesn't really look that bad. ...and at that point I gave up. This information just isn't important enough to me personally to justify continuing to navigate a dishonest compilation.
Here's an idea for future attempts: how about a link to the damned law?
You can, could, and still will be able to block cookies in your browser, so whatever web site operators are doing with them, it isn't going to affect your privacy or "trackability".
Unfortunately, that isn't really what happens.
For example, many sites now use local shared objects ("Flash cookies") to store data, rather than regular cookies. No mainstream browser controls these by default, so even if you have disabled all cookies in your browser's privacy settings or asked to clear all your private data, LSOs will still work. Moreover, use of LSOs is often not even mentioned in a site's privacy policy; even big-name sites like YouTube have been offenders in this respect. Moremoreover, the way to disable these little buggers in Flash is hidden in a settings dialog that most users wouldn't even know to exist.
Maybe I'm crazy, but I don't see how failing to disable something that is being used to do something you never asked for, which you don't know is happening, via an obscure dialog you don't know exists, can constitute implied consent, particularly if you've explicitly disabled all similar functionality that is presented in your browser's UI.
I can't decide whether this is Brazil-style bureaucracy galore, or Eastern Standard Tribe-style anti-productivity warfare.
Neither, it's basic privacy protection, and as far as I can see it's long overdue and a good thing. Why should we support out-opt monitoring rather than opt-in, just to make life easier for those who want to produce targeted advertising and affiliate blogspam?
If you have a legitimate need to use cookies, for example to help a user with a shopping cart or remember they've logged into your forum, then there will be no problem stating clearly at the point that they start to use these facilities that a cookie will be set for that purpose. If you manage to wade through all the FUD blog posts and find the actual wording we're talking about here (you'll want article 2, clause 5, on page 76), you'll notice that this does not require UAC-style dialogs or 'screen after screen of "permissions" to continue'. In fact, there is even wording saying that the new rule doesn't apply in cases where the user has explicitly requested a service that needs to store cookie-like information to function properly.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Passing a session ID around in the querystring has more severe security implications than storing the session ID in a cookie. You can't link your friend to your cookie.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
The approach is completely backwards. They're hampering all uses of a given technology, when what they want to control is bad behavior. It's like banning/limiting hammers because a fair amount of people tend to buy hammers and then hit people over the head with them.
The legitimate hammer users get hampered. The head bashers buy mallets.
The correct solution to the absurd hammer example here is to make hitting people over the head illegal.
The correct approach to information collection abuse would be to make collecting information subject to regulation. As numerous people have already pointed out, you don't need cookies to track people and collect information-- the well-financed information industry can get around this dumb rule trivially.
Who is RTFM and when will he help me with Unix?
As an employee of an advertising company, your usage knowledge is biased in that direction. As a long-time web designer who does not try to monetize most of my offerings, I use tracking cookies to simplify site design and to understand how users navigate and help them save preferences on those sites without asking them stupid questions like Windows Vista.
- Michael T. Babcock (Yes, I blog)
Thanks for the personal attack. Really appreciated it.
You do not make websites better by guessing what the user wants. Your own slashdot website probably has someone who looks at what people do, looks at how many people comment and generally advises on which are the most popular links. This helps them work out which stories are interesting to you and not a load of garbage. It also helps them work out what tags submissions should be grouped together based on the likelihood of users to read certain types of submissions.
Using cookise for advertising is completely different. You're using your cookies to make sure that either the money you spend gives you the biggest return (ROI). You're thinking about this the wrong way around though. You're thinking from your perspective as an advertiser (or someone who works for one). I, as a user, want to be able to click on ads of things I want to buy. Your job, as an advertiser of things I want to buy is to give me those ads at the right time and in the right place. You can't make someone buy something they don't want to. You can make it a lot easier for them so they don't get psised off and go to your competitor.
firstly, its not all cookies, just those that are not directly related to the operation of the site the user went to.
That means this regulation is mostly attacking tracking cookies.
When I went to my favorite site, I never gave anyone called "fastclick" (or whoever)permission to store their stuff on my PC. Nor would I ever give them or anyone else permission to track my surfing habits, yet they are doing it without ever having asked or even informed me. This is a privacy issue.
I totally agree with the EU legislation.
I think the only breathtakingly stupid things here are Kdawson and Timothy, who both seem to have never read Slashdot before, despite being editors.