Slashdot Mirror
"Breathtakingly Stupid" EU Cookie Law Passes
Reader whencanistop writes with some details on an upcoming EU law that slipped under the radar as it was part of the package containing the "three strikes" provision, which attracted all the attention and criticism. "A couple of weeks ago we discussed the EU cookie proposal, which has now been passed into law. While the original story broke on the Out-law blog from a law perspective ('so breathtakingly stupid that the normally law-abiding business may be tempted to bend the rules to breaking point'), there has now been followup from a couple of industry insiders. Aurelie Pols of the Web Analytics Association has blogged on how this will affect websites that want to monitor what people are looking at on their sites, while eConsultancy has blogged on how this will impact the affiliate industry. In all of this the general public is being ignored — the people who, if the law is actually implemented, will have to proceed through ridiculous screens of text every time they access a website. I know most of you guys hate cookies in general, but they are vital for websites to know how people are accessing the sites so they can work out how to improve the experience for the user."
I know this isn't going to be looked on well here, but here are my pro cookie, pro marketing comments...
1. Someone above complained about companies selling the data that they collect. As though it's the most terrible thing in the world to do. Guess what, every company that collects demographics about customers (grocery stores by example, the only way to not get tracked it to pay by cash. You don't need one of their store cards because they'll match your banking account numbers and STILL build a profile) and then sells them. How many useful websites on the internet are driven by 1. Selling demographics, 2.) Ad revenue. Making cookies opt-in kills both of those things. How much is /. charging you guys? Ask them what'll happen to their ad revenue if cookies are suddenly opt-in. Yeah, they can still technically serve the ads, but they will no longer be as accurate to the viewer, nor will they be tracked as well... meaning less profitable for the ad agency and the publisher.
2. Affiliate marketing... There are a lot of other sites with good information (a book review site comes to mind) that I enjoy. They all keep the site running by giving affiliate links to the products, say to a book on amazon. Kill that for them, and you kill their revenue.
So, would you propose that the people running these sites force the customer to consent before they allow them to use their services?? No, that won't work because they can only make them accept to their cookie, not the one downstream they actually get paid on. People have been so scared from cookie FUD that they will deny %90 of the time, and STILL kill many sites because their revenue has dried up.
I think this law, if they have to make one, should be more specific and say what you CAN'T use cookies for.
AND btw, affiliate links would be fine if we could JUST identify the computer, we do not need to identify the individual.
Do not meddle in the affairs of sysadmins, for they are subtle, and quick to anger.
Yeah, total agreement, here. This stupidly transparent, self-serving quote says it all:
"...but they is vital for websites to know how people are accessing the sites so they can work out how to improve the experience for the user."
User experience? WTF? Sorry,but the only reason you need invisible-to-the-user cookies is so you can monetize them without them realizing just how much privacy/anonymity they're giving up. Because that might give users pause before they accept your cookies, if they had an informed choice.
And everybody here knows that. The quoted jackass in TFS is just trying to make his industry look like a victim, to drum up support from civil-liberties sympathizers on Slashdot. Too bad we're not that dumb...
As an employee of the advertising industry, I have zero problems with monetizing Internet traffic, or with using cookies to track user behavior, etc., etc. But I hate liars, and I hate people who try to manipulate me.
This is an irrelevant and distracting question, because cookies are always used with consent.
A web server replies, in response to a request initiated by the user, with a header that says, "Here's a little piece of information and I hope you pass this back to me on subsequent requests."
The user's agent -- software chosen by the user to do whatever it is that they're trying to do -- sees this completely advisory information and decides, perhaps even with a confirmation dialog with the user (or not, if the user has decided that they usually want the same behavior every time without getting bothered), to store this information. And then it decides to pass this information with the next request.
The entity the user is communication with, ultimately has no choice about whether or not the user really does this. It's all up to the person who is using the browser. Or, in very old browsers that don't have dialog preferences for cookies, it's all up to the browser's author, to whom the user decided to defer to when they install the software.
Cookies don't do things. Users do things with cookies. Servers reward users for deciding to send the cookie.
If you have chosen to transmit cookies, take responsibility for your decision, instead of crying to the government and demanding that cookies never be offered to you.
The stupidity is this:
You can, could, and still will be able to block cookies in your browser, so whatever web site operators are doing with them, it isn't going to affect your privacy or "trackability".
But, it sounds as if this new law requires the web site operators to show you screen after screen of "permissions" to continue. These permission requests are stupid as EULA dialogs, Vista-like "admin authorisation" dialogs, etc, because they (a) don't offer a meaningful change in values (be it trackability or privacy), and (b) annoy the hell out of users. I won't go into how (c) these crap warnings numb users to real warnings, which they will also mindlessly click through.
I can't decide whether this is Brazil-style bureaucracy galore, or Eastern Standard Tribe-style anti-productivity warfare.
"Good news, everyone!"
Indeed, this isn't the '90s anymore. We have technology that allows us to better target advertising and better track our business. Why legislate ourselves back to the days of broadcast advertising and a stateless web? And to those who say to use log files for analytics, you have to be kidding me. You obviously don't run a website.
You can, could, and still will be able to block cookies in your browser, so whatever web site operators are doing with them, it isn't going to affect your privacy or "trackability".
Unfortunately, that isn't really what happens.
For example, many sites now use local shared objects ("Flash cookies") to store data, rather than regular cookies. No mainstream browser controls these by default, so even if you have disabled all cookies in your browser's privacy settings or asked to clear all your private data, LSOs will still work. Moreover, use of LSOs is often not even mentioned in a site's privacy policy; even big-name sites like YouTube have been offenders in this respect. Moremoreover, the way to disable these little buggers in Flash is hidden in a settings dialog that most users wouldn't even know to exist.
Maybe I'm crazy, but I don't see how failing to disable something that is being used to do something you never asked for, which you don't know is happening, via an obscure dialog you don't know exists, can constitute implied consent, particularly if you've explicitly disabled all similar functionality that is presented in your browser's UI.
I can't decide whether this is Brazil-style bureaucracy galore, or Eastern Standard Tribe-style anti-productivity warfare.
Neither, it's basic privacy protection, and as far as I can see it's long overdue and a good thing. Why should we support out-opt monitoring rather than opt-in, just to make life easier for those who want to produce targeted advertising and affiliate blogspam?
If you have a legitimate need to use cookies, for example to help a user with a shopping cart or remember they've logged into your forum, then there will be no problem stating clearly at the point that they start to use these facilities that a cookie will be set for that purpose. If you manage to wade through all the FUD blog posts and find the actual wording we're talking about here (you'll want article 2, clause 5, on page 76), you'll notice that this does not require UAC-style dialogs or 'screen after screen of "permissions" to continue'. In fact, there is even wording saying that the new rule doesn't apply in cases where the user has explicitly requested a service that needs to store cookie-like information to function properly.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.