Slashdot Mirror
New EU Net Rules Set To Make Cookies Crumble
NickstaDB writes "From the BBC article: 'From 25 May, European laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies." These files are widely used to help users navigate faster around sites they visit regularly. Businesses are being urged to sort out how they get consent so they can keep on using cookies.'"
Great - what the internet needs is more regulation.
Thanks EU.
They will just bury such "consent" in the EULA, privacy policy, terms and conditions, legal notices, and other such crud that no one reads.
What do they think the 'Remember Me' checkbox is for!?
That wouldn't work considering that most people click 'Yes' on everything.
I don't want to have to provide the EU with explicit pictures just so I can use cookies!
Does the EU do anything apart from make things harder for people? This effectively means no anonymous cookies. I'm guessing it's more about controling and monitoring citizens than about protecting their privacy. The thing is there are lots of legitimate uses for anonymous or one time cookies for which consent.isn't practical, so if this flies, it will detract from the Internet as we know it. And not just in the intended ways.
These posts express my own personal views, not those of my employer
Aren't they going to do it the way they've done it so far already anyway? Simply bury "By visiting this website you give consent to..." somewhere deep in your legal notices like all the other "We're going to sell your info" notifications.
I don't see the advantages of this new law, since if they really needed to _ask_ you for permission, it would simply become unworkable. To browse the internet, you'd spend 20 minutes of each hour clicking cookies notices away.
Some are arguing that allowing cookies in the browser is basically equivalent to giving your consent. Time will tell how this all plays out, but it's safe to say that people get bored of clicking "allow" really quickly.
Do browsers even ask if you want to allow cookies these days? I guess not? 10 years ago you did have to explicitly allow them (either globally or on a per-site basis) but I guess they are allowed by default these days? Can't remember seeing a cookie prompt in a long time.
.: Max Romantschuk
Cookies have legitimate uses that have nothing to do with "tracking". Perhaps the issue comes with trying to interpret the specific language used rather that knee-jerk "everyone must opt-in". If your cookies are not used to track -- if you do not use, for example, Google analytics -- then you are not in violation. The article basically states this.
The web browser, whichever one it is, that the user has decided to use should make the decision about whether or not to ask the users permission to set a cookie. Website are not doing anything malicious by setting cookies, they are simply asking the client browser to keep a bit of information and return it on subsequent visits. The web browser can ignore the request, ask the user for permission first, or silently accept it.
Many browsers can be configured to operate in either of those three modes. Effort would be better spent educating users... or better yet... just let it go already it isn't a big deal.
Most people aren't interested in explicit pictures of people who overuse cookies.
The first time someone visits your website, you redirect them to a consent form and then if they opt out of being tracked, you just set a cookie showing that they've opted out so that you won't have to ask them again. See, problem solved.
(I say that tongue-in-cheek, but it would actually probably work if you set a "don't track" cookie which wasn't personal to them. Most grocery stores also offer non-tracking versions of their loyalty cards. My dad has one for Harris Teeter and his card number is all zeroes. That's the number they give out to everyone who asks not to be tracked. Similarly you could set a cookie which only includes an "opt-out" code which is the same for everyone opting out so that you can't track them individually.)
Have they costed how much it will be to make their own sites compliant?
I just can't be bothered.
Blame Privacy International, who are basically the only ones lobbying for this.
The EU requires car manufacturers to get consent from drivers for the car to burn fuel.
Well, no. It's a fair bet that Hitler didn't like Muslims.
1. Force browsers in relevant countries to pop up a message "Would you like to accept a cookie from www.[...]?" for every website they visit (and every cookie).
2. People everywhere else live happily ever after.
3. ???
4. Profit!
You can set Mozilla to always ask, always accept, always reject, do one of those except for exceptions, accept for session only, remember your choices or not remember them, etc. At this point I don't know what the default it :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Try setting your privacy level not to accept 3rd party cookies and set it to ask you every time (Firefox). I have no problem denying cookies manually all day. Some of the most egregious use of cookies come from mainstream sites like msnbc, cnn, etc.. Those sites are whoring themselves out to advertising and data miners more than any other sites I can think of... so I don't visit them anymore. I don't need to read or listen to their junk when their interests aren't trying to serve mine.
will never die.
sysadmins and parents of newborns get the same amount of sleep.
Europe today would be the same if Hitler had won. They are worse than Nazis
Wow am I out of the loop or what. They still practice genocide over there?
Do not set any cookies if person is not registered (here is your consent). Problem solved. Actually, that would be pretty nice.
Quick way to get 30% Funny 70% Troll: defend Opera browser on
Sure, cookies can be used for shady purposes but for heaven's sake - every useful website I can think of uses the hell out of cookies. It's the only practical way to maintain UI state. Browsers already have the ability to warn per cookies. They used to come with this turned on by default, but most have stopped that now. Ever tried turning those warnings on in the past ten years? You can't possibly browse the web like that. Even a once-off per site setup is absurd. This is the result of passionate but ignorant people.
Oh well. Like most such laws, there will almost surely be a legal workaround that dodges the spirit of the law. And in this case thank god for that.
How about a browser option of 'accept all cookies - but delete them once the session is over'?
The tracking companies get their cookies accepted and privacy is maintained. Everyone is happy. Kind of.
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
A bright future for libraries doing browser fingerprinting and other tricks that enable tracking.
As for third party cookies: I use Ghostery on Firefox and it works pretty well and it's pretty unobtrusive once configured. It's amazing to see how many of these cookies are used and abused. Some sites have literally dozens of them. (./ has two: Google analytics and Addthis). FB and Twitter are major culprits, they have no business tracking me when I'm visiting some other site, I'm not one of their users and I don't give a sh`t about what they do. I support this legislation, we just don't know how much user data these companies are gathering and for what use so it's basically saying that you cannot track people that doesn't want to be tracked.
Of course when you lump cookies into the same category as trojan horses people are going to react this way. The nonsensical way some anti-malware programs behave is unethical. You cannot say "all cookies are bad" because it's simply a load of shit. I'm a highly experienced web developer and I really cannot think of any way that a cookie can harm you, your computer or your cat.
A cookie is just as revealing as your IP or your IP's RDNS entry. The only reason web sites use cookies is because they have no other way to distinctly identify which computer is hitting their web site from the other side of a NAT (your firewall). If each computer had a distinct static IP address (IPv6 or MAC) there would be no need for cookies. That cookies are somehow dangerous sounds just like people calming that vaccines are giving their children autism.... No... Actually, the vaccine people have a better case.
You absolutely need cookies to make web programs work and prevent accidental session hijacking. Any other method is a joke and therefore not used by serious programmers. Cookies cannot harm you. The worst thing that can happen is someone could tell you went to www.target.com because you have a cookie that says that on your computer, BFD.
This is not a score for privacy. This is a score for ignorance.
I simply set my browser to delete all cookies on exit. I still use firefox for the extension to also delete flash cookies. I log out every few days just to reset them all.
NickstaDB writes
"From the CNN article: 'From 25 May, US laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies". These files are widely used to help users navigate faster around sites they visit regularly. Businesses are being urged to sort out how they get consent so they can keep on using cookies.'"
And then consider how different the reactions and comments would be.
My UID is prime. Hah!
If they slap a notice on a login page saying "by logging in you are consenting to having this site track you", then doesn't that sort it for most sites? It's explicit because you have to log in to proceed.
Maybe this is an underhand way of pushing a technology upgrade to HTML5 and web storage!
Most user fingerprinting that people should be concerned about can be done without any cookies. Development on these techniques hit full swing when all the browsers started tightening the screws on cross-site scripting protection which also included much stricter enforcement of cookie policies. So this will do little to nothing to actually stop the big players, governments, etc from identifying a browser or even a user across multiple browsers (something cookies alone can't possibly do).
As a web developer, I just wonder how much it will cost to audit all of our software (both written in-house and purchased software) that may use cookies to store session data, shopping details, form data for allowing the user to quickly shuffle back and forth through form screens without losing previously-entered data, etc.
The only cookies I can think of that we use that can be considered tracking are cookies used to keep track of visitors that came from specific affiliates so that the affiliate can be properly credited with the purchase. I have to assume that these will now need explicit consent, which will either result in a cascade failure of online affiliate systems, yet another "OK" / "Accept" button that users are conditioned to always confirm without any thought of origin or purpose, or a complete migration of developers from cookies to more insidious ways of tracking users that avoid cookies and could usher in even more privacy concerns.
The last possibility is the most-concerning and most-likely as it has already happened on the large-to-medium scale; the solutions would simply become more widely available and pervasive. These solutions also use such a variety of information to fingerprint users that coming up with a law that effectively bans such tracking would effectively gut the HTTP protocol and many established standards.
I know this as I created a proof-of-concept next-gen analytics system three years ago that could track users across multiple sites and with enough data on a user, could identify them as they switched between different computers and browsers. No cookies were used and Javascript on the client was not required. Clients with Javascript enabled simply provided more robust fingerprinting data as icing on the cake.
You can find out more about how this is done by visiting the EFF's Panopticlick site. I never launched my analytics engine as I quickly found out that I was not the first one to figure out these techniques and as I got closer to launch, a huge number of competitors jumped into the space, so I decided to look for less crowded avenues.
Fact is that there will always be people that want to keep track of you with or without your consent. No matter what changes of technology or laws occur, they will still successfully do this.
Sure, they will, but there are things that can be achieved simply by blocking some cookies.
For instance - why should facebook be able to track people across every site with a "like this on facebook" button, regardless of whether they have a facebook account?
This can be worked around by switching off third party cookies (and perhaps blocking any content loaded from fb when not actually visiting FB), which IMHO aren't useful for anything BUT tracking.
I can't say it would bother me to see all the "affiliates" on the net die off.
who needs cookies? tracks geeks best http://yro.slashdot.org/story/10/01/27/1638216/Tracking-Browsers-Without-Cookies-Or-IP-Addresses
"You are still innocent until proven guilty. What's changed is what they do to innocent people." by notnAP (846325)
The interpretation of the EU regulation is different. I think the latest bet on how Denmark understand the EU regulation is:
The users must be informed that cookies are used, and always have easy access to the "cookie policy".
The user must have a way to opt-out. It is still debated if it is enough to inform him how he adds sites to the Internet Zone, and denies cookies to sites in the Internet Zone. Persistent Cookies needs user approval, session cookies not.
There is also the other solution that wil kill the regulation: Just tell users that to use the site they must accept cookies. If they don't, they can go away. When they can visit no websites at all, they will start accepting the cookies. Most technical skilled people thinks this is the worst law ever decided by the EU. So many websites are dependent on cookies today, that most of the web would stop working if cookies was disabled.
As it is now, it is the user that decides if he want JavaScript or Cookies.
but only at shutdown, deleting everything not explicitly set to be kept, otherwise many sites might not work at all.
(look for "selective cookie delete" among mozilla addons)
1. the user sent the information in the first place 2. the cookies are on thir computer 3. just use a cookie blocking extension, no need for server side implementation
I have a perfect solution! Rather than continuing to use magical cookies which can follow you around and tell everyone where you've been, I'm going to re-implement a cookie-like thing which cannot possibly do anything you don't want!
Here's how it will work: When you go to my website, I will send your browser a "brownie". The "brownie" will just be a short text string.
Then, if you want me to track you, simply inform your browser that you would like to send back the "brownie". whenever you connect to my server.
In this way, every single connection will require explicit consent to be maintained! If your browser doesn't send the "brownie" with every connection, I won't track you.
The unicorns which maintain the magical cookies that track you without requiring your browser to explicitly send them back every time may be upset by this scheme, but I am never in favour of rejecting a technology simply because it will put people out of work.
-- 'The' Lord and Master Bitman On High, Master Of All
Do you have to click yes to all 12 trackers to "authorize the page to load"?
"Sorry, you didn't agree to all 12 trackers, so therefore we can't afford to give you the page."
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
...you will be set a cookie which basically says "this person does not want to be tracked". And then you are going to be tracked with that cookie anyway, so that the site knows you don't want to be tracked. Then, per EU legislation, you need explicit and upfront consent for that cookie, too. This is where the system goes downhill, I guess, you come to the site to buy things or read things or have fun, not to fill out shitloads of forms.
What about server side tracking? This isn't particularly hard to pull off and theres no way anybody can know if it goes on or not.
Sounds fine to me. If your content is really that valuable to me, I'll agree. If not, then I'll go to your competitor.
I am TheRaven on Soylent News
Awesome, instead of cookies we will have ?session_id= parameters. It's like the 1990s all over again! Can we go back to writing CGI scripts in Perl now?
Now seriously, doesn't this mean that tracking will still be available to people who do really large scale behavioral-pattern datamining while us clods will have a hell of a harder time implementing any kind of non-static page?
It could be a good way of getting only legitimate cookies. Content-providers will be somehow forced to get rid of all hosted content (banners, flash videos, embedded pages and whatever) that silently drops cookies into my browser, as if they won't do so the users will be prompted with 50 cookie requests whenever they are visiting their pages, and they will quickly browse to fresher waters. They will have to chose other forms of advertisement that do not violate my privacy. They (the content providers) would also be forced to be more considerate about the usage of cookies, like pushing them to your machine only after log-in. Accepting every now and then a cookie from the sites that I choose to visit wouldn't seem such a big hassle to me. On the other hand, I do not like the idea of having laws for everything, I would rather let the responsibility on the users. If they are sensitive about their privacy, they should just set their cookie policy to "always ask" and run away from sites that try to drop cookie bombs on their machines. (Even though, at the rate cookies are delivered on almost every big-content page nowadays, this strategy would soon leave them with very few places to go...)
Unions are being banned and corporations can give limitless amounts of cash to politicians. Proud, very proud.
This legislation, which is close to being enacted, has avoided publicity to date. I can see why people might want it, though I think it would be better sorted by a browser fix (you can switch off cookies right?). From the point of view of smaller websites, having to specifically ask every time you want to issue a cookie is a nightmare - presumably we do this thorough a pop-up? (pop-up blocked anyone?)
The IP record fix looks like a way to avoid this, though paradoxically it results in our having to record more specific data about visitors, logging IP addresses and browser details in a database, and trying to match them up to each HTTP request to ensure that the visitor gets the service the site is intended to provide. Previously we haven't bothered recording any of this data - the cookie was between you and the temp folder on the server...
Sorry, but this is a crap bit of legislation...
I wonder how enforceable this is - asking all website owners to ask if they can set an anonymous cookie? Really?
However, I wonder if the spirit of it is best achieved in the browser. Essentially, accept cookies from the hostname/domain written in the address bar, and don't accept any others. Thus, visiting /. will give me a slashdot.org cookie (maybe), but won't give me (or send out) the Google Analytics or Addme cookies (which aren't in my interest, as they aren't sites I'm visiting).
Personally, I hope this gets watered down to a browser feature, rather than what it appears to be right now. But I can see worse worlds than one where you can't have anonymous cookies without permission. Of course, we realise that ad networks will move out of the EU to avoid this, but that will slow down ad delivery, which will make them less attractive to advertisers than the in-EU ones, so we may well see less of that than we might imagine at this point. In the longer term, I'm sure the lowlives of the tracking world will find ways to do their work without worrying about these regulations, but keeping them out of the EU isn't really a bad thing for us Europeans.
Fabulous. At least I now:
a) know you are wanting to load 12 trackers
b) can decide whether you site is soooo critical to me I'm willing to load them.
The answer to b is "unlikely" - great thing about the web, if you're doing it someone else probably is as well. I'll go there.
Yes it is a piece of crap legislation. Why?
It is trying to stop abuse happening through tracking with cookies. There really isnt any technical way to fix this without breaking or inconveniencing a lot of people.
Bad situations make for bad laws. I agree that it would be a bad idea in its present form, but dismissing the intention behind it is not.
If the user blocks cookies, then I won't set any cookies. If the user doesn't block cookies, I will set them.
What we need is not a rule like this, which is stupid. We need an accessibility rule that says any website which must be accessible (government and utilities for example) must work without cookies.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Only if they specify the sites they use. If they ask for tracking for them, then they have to track with a cookie from their site. If they want to use other sites to track or want other sites to track (e.g. adsense), then they'll have to say that they want you to accept an adsense cookie to track them. Including one for doubleclick would be illegal unless they'd said doubleclick too.
This seems to be reasonable and necessary.
Why, for example, are 12 different sites needed to track you? What if you don't want to be *tracked* but do want to be remembered? At the moment, you have to know how to use adblock or other cookie cleaners. This isn't right.
The first time I read the headline I thought it said "explicit content", I wonder how their going to collect that? :-)
Sure it can:
https://addons.mozilla.org/en-us/firefox/addon/cookie-monster/
Cookies are so last millenium. Firefox 4 is pushing that new WebDB or whatever it's called so companies can keep a whole database of info on your local machine. Heck, they won't even need to keep user information in their own database, they can just query your machine any time you visit them. Go ahead, let them ban cookies altogether so we're forced into this new more scalable and flexible replacement.
When you leave a site you can have a popup / popunder to say that the site has put a cookie on your browser so that when you come back you can auto-login. That makes sense. How to explain to a user why a website at www.site1.com has allowed www.site2.com to put a cookie on your browser (e.g. advert networks, google analytics) is much harder. Differentiate between the two and you could have a workable system. Screwing up google analytics would leave me looking to auto-upload all my apache logs to Google somehow, which would then beg the question of 'Who do server logs belong to?" I'm assuming they are mine in the same way that if I sat by the roadside and made a list of the number plates of the cars that passed, that data would be mine as well...... What do you think? P
As far as I can see the purpose of the legislation is to prevent targetted advertising, though if you have a real heap of information on people I guess you could try to profile them in more detail. This isn't something that most websites can do effectively in isolation, as we simply don't have the market coverage to track what people are doing outside of the 20 seconds or so most visitors spend on the site (short of downloading your browser history - NOTE update your browser!). It is more of an option for big online retailers, like Amazon, though I honestly don't object to them suggesting products on the basis of what I've looked at already - I guess there is a trust relationship there which I find adds to the browsing/shopping experience.
In the UK the big stink came with the Phorm contract with BT, one of our main ISP's, but this is a very different technology to what we as web developers usually have access to, and I don't believe it was cookie based...
In fact the only people I know of at the moment who track you (me and everyone else) like a hawk are the Search Engines. They do do it to offer you targeted searches, which are pretty annoying if you are logged in as they can give you a seriously distorted view of the web (why is that little site you have just created at the head of the Google rankings? - Oh bugger, logout and look again!), but even if you are not logged in they will set regional preferences for your search, though clearly they use IP tracking rather than cookies.
To get a similar level of intelligence to that in the possession of the likes of Google, large numbers of websites would have to pool information, and if you are talking about this level of integrated development, then you would be using IP tracking as well, and not cookies, which are site specific (again make sure your browser is up-to-date!).
Now, just perhaps there is a business model for world domination here...
Lawmakers can demand whatever they want, and ultimately get it by means of force. I am not going to dispute that, or EU's right to (however misguidedly and stupidly) attempt to protect peoples' anonymity.
But .. this is lame, because it is so utterly at odds with how cookies work.
All cookies used by websites are voluntarily sent, at least as far as the website can tell. The website offers a cookie, and the browser (or user, depending on how good the UI is) decides whether or not to store that cookie and later send it back in future requests. If there is any lack of consent here, it's that the browsers aren't asking users what they want.
You can pretend that this is all just technicalities, but nevertheless that is the reality of the situation, so anything stemming from the false pretense is likely to have unintended consequences and fail to accomplish its goal.
Websites do not store cookies on your computer. They do not have that capability. Your browser really is the problem, and if you try to hold websites responsible for what happens, instead of whoever is actually responsible, then all the bad things that you worry about, are going to continue to happen.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
It ought not to be possible to post cross-site cookies, though with many sites adverts and other content is displayed in frames, so it is not clear what site you are actually on... Perhaps it shouldnt't be possible to download framed content from a different root URL in the one browser window? (Browser developers - does this make sense?)
Just like the 2-party political system, which is a joke, you guys over in the States need to get over your long-held belief that regulation is bad.
Later in your post you admit to being an American living in Europe, yet you refer to us as "you guys." Sounds like you need to make up your mind. I looked into dual citizenship with Hungary a short while back, and it really boils down to a) paying twice as much in taxes and b) not being truly trusted by either government, thus limiting your employment possibilities. If you want to burn your US passport and renounce your citizenship, that's your right to do so. But to keep it in your pocket as a backup plan when civil unrest in Europe gets really bad again (as it always does), all the while bashing the US, is just plain hypocrisy.
Regulation in the EU generally *protects* the consumer and their privacy and prevents monopolistic business practices. In the US, practically everyone believes in the invisible hand of the free market. The problem is the invisible hand is stealing from consumers pockets and stuffing the pockets of corporations. The invisible hand is NOT working in YOUR favor, it's working in favor of the corporations.
You need to remove some of your prejudice and realize that what's good for corporations is good for people. I work for a corporation. Just about everyone I know works for a corporation. Where do you work? The government? And you're somehow arguing that this is less susceptible to corruption and greed? Don't make me laugh! Here in the US, giant corporations that becomes greedy and fraudulent (like Enron) will eventually fail, go bankrupt, and ultimately GO AWAY. Not so with giant corrupt organizations like the EPA, Fannie Mae, or labor unions. Their existence is woven into law, meaning they will NEVER GO AWAY.
You're pointing out the fundamental flaw in European-style socialism: corporations are always bad and governments are always good. In fact, quite the opposite is usually true.
6th Street Radio @ddombrowsky
This is exactly what evil corporations do all the time. Request consent for something seemingly innocuous that in fact signs any your rights to any confidentially at all, with about as much opportunity for negotiating the terms as the average EULA.
While I approve of privacy oriented legislation, I'm more concerned with regulating humans than software.
A good analogy is how a doctor wouldn't get in trouble for collecting your medical history, but will get in trouble if he sell that information to advertisers. I don't think making it illegal to store cookies is the right way about it. Rather make it illegal to sell this information to others, or to retain it for periods longer than a certain threshold.
Regulate the use of the information collected, not the technology used to collect it.
But... the future refused to change.
EU can't regulate US companies, so all the ad services will just operate over here...
Luke-Jr
So.. you go to a site.. it says "please allow us to store cookies to enhance your experience" yada yada.. you say no.. next time..you get the same message...lather, rinse, repeat until you say yes because **there is no other way to maintain the persistent state of the selection**.
People will simply not go to the sites eventually or say yes after the umptienth time to get away from having to click no.
Does a "text file" only exist on secondary storage? What about session cookies - those without an expiration date that are generally not written to a file on disk. Do they count? No "text file" is created, so they wouldn't fall under this law? It's a bit vague.
There are other ways that are more secretive and much harder for users to control than cookies. Fingerprinting the user's computer isn't that hard and if you collect enough information through the browser you can probably do it with 99% accuracy or better. So then you can store the information on the server.
What this should do is annoy the crap out of users. The "proper" implementation is to ask with a popup every time a cookie would be stored. If the user has the browser confirming cookies this would result in two popups for every cookie - the more the better, right?
What this regulation seems to think they are addressing is some kind of special "tracking" cookie and not ordinary cookies that are used simply to save things like login information. I haven't read the regulation but from the article it sounds like they carved out some very small number of specific, none of which apply to my web site. So, do I assume the regulations aren't really going to apply to me?
Of course, there is the question of what possible point does this have for any US-based company? Would it mean that EU-affiliates would be prosecuted? Hardly. Would it mean that an EU subsidary would be prosecuted? Maybe. For a small US company, I'm not sure it has any meaning at all. Except we would get email from angry EU users trying to say that we were not following EU regulations and they were going to "turn us in to the Web police". Yes, I have gotten email like that before.
I think the real solution is for every web site to confirm every cookie individually. Annoy the crap out of users and make sure they know it is this new EU regulation that is requiring it. Maybe that would get some claification or a repeal. It sounds like an incredibly short sighted and pointless regulation.