Slashdot Mirror
New EU Net Rules Set To Make Cookies Crumble
NickstaDB writes "From the BBC article: 'From 25 May, European laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies." These files are widely used to help users navigate faster around sites they visit regularly. Businesses are being urged to sort out how they get consent so they can keep on using cookies.'"
They will just bury such "consent" in the EULA, privacy policy, terms and conditions, legal notices, and other such crud that no one reads.
Great - what the internet needs is more regulation.
Thanks EU.
I think that's exactly what America needs: more EU regulation. We'll just host their sites over here, because we don't have to comply with their stupid laws.
John
IPv6 will give almost everybody practically static addresses, the ultimate undeleteable cookie. So the EU regulation will be futile very soon.
Some are arguing that allowing cookies in the browser is basically equivalent to giving your consent. Time will tell how this all plays out, but it's safe to say that people get bored of clicking "allow" really quickly.
Do browsers even ask if you want to allow cookies these days? I guess not? 10 years ago you did have to explicitly allow them (either globally or on a per-site basis) but I guess they are allowed by default these days? Can't remember seeing a cookie prompt in a long time.
.: Max Romantschuk
Cookies have legitimate uses that have nothing to do with "tracking". Perhaps the issue comes with trying to interpret the specific language used rather that knee-jerk "everyone must opt-in". If your cookies are not used to track -- if you do not use, for example, Google analytics -- then you are not in violation. The article basically states this.
TFA mentions "explicit consent" is needed. Burying stuff in some legal notices will be considered implicit consent at best. So at least from the face of it every site will have to ask for it. TFA specifically mentions more use of pop-up windows... interesting... are there still people without pop-up blockers then?
The web browser, whichever one it is, that the user has decided to use should make the decision about whether or not to ask the users permission to set a cookie. Website are not doing anything malicious by setting cookies, they are simply asking the client browser to keep a bit of information and return it on subsequent visits. The web browser can ignore the request, ask the user for permission first, or silently accept it.
Many browsers can be configured to operate in either of those three modes. Effort would be better spent educating users... or better yet... just let it go already it isn't a big deal.
The first time someone visits your website, you redirect them to a consent form and then if they opt out of being tracked, you just set a cookie showing that they've opted out so that you won't have to ask them again. See, problem solved.
(I say that tongue-in-cheek, but it would actually probably work if you set a "don't track" cookie which wasn't personal to them. Most grocery stores also offer non-tracking versions of their loyalty cards. My dad has one for Harris Teeter and his card number is all zeroes. That's the number they give out to everyone who asks not to be tracked. Similarly you could set a cookie which only includes an "opt-out" code which is the same for everyone opting out so that you can't track them individually.)
Have they costed how much it will be to make their own sites compliant?
I just can't be bothered.
Blame Privacy International, who are basically the only ones lobbying for this.
The EU requires car manufacturers to get consent from drivers for the car to burn fuel.
Make it harder for people to track other people for financial gain?
Sure.
Protecting the privacy of EU citizens seems more important to me than your transient concerns about having to do a bit more work.
1. Force browsers in relevant countries to pop up a message "Would you like to accept a cookie from www.[...]?" for every website they visit (and every cookie).
2. People everywhere else live happily ever after.
3. ???
4. Profit!
Hosts your sites as you like, but companies doing business in the EU will still need to comply or it will become expensive for them. Perhaps advertisers in this situation won't want to pay per click if they're not doing business in the EU any way, which will affect US hosted sites too. Also, the US courts have set plenty of precedent by feeling free to take legal action outside their own jurisprudence
Great - what the internet needs is more regulation.
Thanks EU.
I think that's exactly what America needs: more EU regulation. We'll just host their sites over here, because we don't have to comply with their stupid laws.
Or Sealandia or Naru or Libya or Russia.
Which of course simply undermines your own homegrown industry and once based outside the country other exploits are now feasible.
The way we deal with this for physical goods is tariffs. e.g. your country has no OSHA laws, or pays to low a minimum wage then we may slap a tarrif to equalize the playing field and protect the home industry.
This of course eventually leads to protectionist tariffs.
Some drink at the fountain of knowledge. Others just gargle.
HAHAHA. Says the guy who's country created the patriot act! American VPS companies have been losing lots of money because people don't want to put their data on a server in a country where the government can just go "This server is running on the same hardware as someone who MAY have sent a secret message to someone in IRAQ with a picture of a child, thus we are confiscating everything!"
You can set Mozilla to always ask, always accept, always reject, do one of those except for exceptions, accept for session only, remember your choices or not remember them, etc. At this point I don't know what the default it :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
HAPPY FUN GRAMMAR NAZI ADVENTURE: "Jurisdiction", not "Jurisprudence". Remember, a dictionary page per day keeps the lurking trolls at bay!
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Sorry, you are looking at it from the wrong direction. The difference between the US and the EU is that the EU (or by extension the state governments that form it) are protecting their citizens from violations of privacy by corporations. You see, over here, we actually care about privacy and our governments do actually help to protect it. Done properly and where needed, regulation is a Good Thing(tm). Corporate Fascism hasn't yet fully taken over here in the EU as it has in the US.
All you have to do is look at areas such as telecommunications: The EU's mobile phone operators and ISP's provide FAR better service, better prices and a LOT more competition in this area than in the US. I live in a small country of only 5.2 million, and I can choose from literally dozens of mobile phone operators and I have multiple ISP's to choose from with very competitive offerings. I can shop for the best price and/or service. I am not limited to one or two major monopolistic operators or ISP's like in some parts of the US.
Just like the 2-party political system, which is a joke, you guys over in the States need to get over your long-held belief that regulation is bad. Regulation in the EU generally *protects* the consumer and their privacy and prevents monopolistic business practices. In the US, practically everyone believes in the invisible hand of the free market. The problem is the invisible hand is stealing from consumers pockets and stuffing the pockets of corporations. The invisible hand is NOT working in YOUR favor, it's working in favor of the corporations.
Now before a troll comes along and says I do not know what I am talking about, I am an American living abroad in the EU, for more than 10 years. I have lived and worked in both places and I have worked for both American and EU based companies. I can assure you, the EU way really is better and I cannot really consider living and working in the US anymore. It is a major downgrade on practically every metric.
Back to the original topic: tracking cookies. This regulation is in response to companies who abuse users by tracking them using cookies. This is unwanted behavior. Cookies were not originally intended for this use and since companies have been abusing cookies (and by extension the consumers/users), it calls for regulation since companies in the free market cannot be held responsible for acting responsibly. Companies will only do what they can to increase profits and/or market share unless forced to do something else. Regulating cookies for tracking behavior is needed and I do not have a problem with this. It protects me as a consumer since it is widely known to be abused. This is precisely why regulation is sometimes needed.
You may be willing to allow corporations to perform uncontrolled data mining of your online habits but I prefer to have control over that information since the information is open to abuse. There is no legitimate justification for corporations to collect this information other than to use it for their benefit. They are certainly not collecting it to help you as a consumer.
Try setting your privacy level not to accept 3rd party cookies and set it to ask you every time (Firefox). I have no problem denying cookies manually all day. Some of the most egregious use of cookies come from mainstream sites like msnbc, cnn, etc.. Those sites are whoring themselves out to advertising and data miners more than any other sites I can think of... so I don't visit them anymore. I don't need to read or listen to their junk when their interests aren't trying to serve mine.
Yes, especially since the site now has no way of knowing whether or not it has previously asked for permission unless the answer was yes. Meaning that if you say yes then that's the last you hear of it, but if you say no, then it'll ask you for permission every time you visit the site.
My main concern is that there's not really any information given about why a lot of these sites are setting cookies for facebook and random other sites.
will never die.
sysadmins and parents of newborns get the same amount of sleep.
Europe today would be the same if Hitler had won. They are worse than Nazis
Wow am I out of the loop or what. They still practice genocide over there?
I think that's exactly what America needs: more EU regulation.
Actually, it probably is.
The Europeans take their privacy laws very seriously and, unlike the USA, they enforce the shit out of them.
The USA has a lot of laws, but enforcement is hit or miss, especially when it comes to consumer protection.
[Fuck Beta]
o0t!
Do not set any cookies if person is not registered (here is your consent). Problem solved. Actually, that would be pretty nice.
Quick way to get 30% Funny 70% Troll: defend Opera browser on
Well until IPv6 routers start randomizing the addresses... then it won't be much different from NAT.
Sure, cookies can be used for shady purposes but for heaven's sake - every useful website I can think of uses the hell out of cookies. It's the only practical way to maintain UI state. Browsers already have the ability to warn per cookies. They used to come with this turned on by default, but most have stopped that now. Ever tried turning those warnings on in the past ten years? You can't possibly browse the web like that. Even a once-off per site setup is absurd. This is the result of passionate but ignorant people.
Oh well. Like most such laws, there will almost surely be a legal workaround that dodges the spirit of the law. And in this case thank god for that.
IPv6 will give almost every computer practically static addresses
What if multiple people share the same computer?
You got modded flamebait but in reality you've understated the situation quite significantly. When the feds come to bust a private host for something they usually take everything in the room that is even plugged into the same power line and all the networking hardware out to the wall, then they leave it up to the owners of the hardware to litigate for return of their property.
How about a browser option of 'accept all cookies - but delete them once the session is over'?
The tracking companies get their cookies accepted and privacy is maintained. Everyone is happy. Kind of.
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
As for third party cookies: I use Ghostery on Firefox and it works pretty well and it's pretty unobtrusive once configured. It's amazing to see how many of these cookies are used and abused. Some sites have literally dozens of them. (./ has two: Google analytics and Addthis). FB and Twitter are major culprits, they have no business tracking me when I'm visiting some other site, I'm not one of their users and I don't give a sh`t about what they do. I support this legislation, we just don't know how much user data these companies are gathering and for what use so it's basically saying that you cannot track people that doesn't want to be tracked.
Of course when you lump cookies into the same category as trojan horses people are going to react this way. The nonsensical way some anti-malware programs behave is unethical. You cannot say "all cookies are bad" because it's simply a load of shit. I'm a highly experienced web developer and I really cannot think of any way that a cookie can harm you, your computer or your cat.
A cookie is just as revealing as your IP or your IP's RDNS entry. The only reason web sites use cookies is because they have no other way to distinctly identify which computer is hitting their web site from the other side of a NAT (your firewall). If each computer had a distinct static IP address (IPv6 or MAC) there would be no need for cookies. That cookies are somehow dangerous sounds just like people calming that vaccines are giving their children autism.... No... Actually, the vaccine people have a better case.
You absolutely need cookies to make web programs work and prevent accidental session hijacking. Any other method is a joke and therefore not used by serious programmers. Cookies cannot harm you. The worst thing that can happen is someone could tell you went to www.target.com because you have a cookie that says that on your computer, BFD.
This is not a score for privacy. This is a score for ignorance.
What if multiple people share the same computer?
The kids get to see pornography advertisments because you browser for porn last night. Fun for the whole family!
You may be willing to allow corporations to perform uncontrolled data mining of your online habits but I prefer to have control over that information since the information is open to abuse. There is no legitimate justification for corporations to collect this information other than to use it for their benefit. They are certainly not collecting it to help you as a consumer.
This move won't give you that. In fact it does the exact opposite. Corporations are going to force you to sign EULA that includes allowing them to track you for EVERYTHING. Think of Google requiring login (no anonymous searches). The first thing you're going to have to do no matter what URL you type in, is log in.
These posts express my own personal views, not those of my employer
In my experience with ADSL and cable you have a fixed address already. It is just not guaranteed to be fixed but a new IP every few months is fixed enough for lots of tracking purposes. Just leave your own router connected; usually DHCP will give you the current IP address upon renewal. There is no reason it would have to change to begin with.
Haha - I was think about both, and in this case the difference between jurisprudence in both places. Jurisdiction is indeed what I meant. It's been a long day...
NickstaDB writes
"From the CNN article: 'From 25 May, US laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies". These files are widely used to help users navigate faster around sites they visit regularly. Businesses are being urged to sort out how they get consent so they can keep on using cookies.'"
And then consider how different the reactions and comments would be.
My UID is prime. Hah!
I don't know where you live, but here in the EU those EULAs are not enforcible.
You have total control over the cookies you allow to be set in your browser, and the data you send to someone. You always have. This is regulation for the sake of appearances, nothing more. It's also going to prove nearly impossible to enforce or track, and it's going to effect very negatively things that are well beyond it's scope. This is because typical of most regulation, it will be broadly worded, and poorly understood.
Sure, they will, but there are things that can be achieved simply by blocking some cookies.
For instance - why should facebook be able to track people across every site with a "like this on facebook" button, regardless of whether they have a facebook account?
This can be worked around by switching off third party cookies (and perhaps blocking any content loaded from fb when not actually visiting FB), which IMHO aren't useful for anything BUT tracking.
I can't say it would bother me to see all the "affiliates" on the net die off.
who needs cookies? tracks geeks best http://yro.slashdot.org/story/10/01/27/1638216/Tracking-Browsers-Without-Cookies-Or-IP-Addresses
"You are still innocent until proven guilty. What's changed is what they do to innocent people." by notnAP (846325)
Google requiring log-in = people start using bing (have they renamed it again yet?) / yahoo / altavista.
Really... this is what would happen.
I have seen plenty of people who, when encountering a log-in / register window, they just close the web-page and do something else. Come, to think of it, all sites requiring log-ins, would be a huge boost for productivity.
"Civis Europaeus sum!"
Hahaha, that's pretty funny. Just exactly how many sites do you know that moved behind a registration wall and gained readership?
It doesn't hurt to be nice.
There is no free market in the US. There are lots of regulations and government intervention here, they just happen to be on behalf of corporations rather than individual citizens. One of the reasons you can choose multiple ISP's and we cannot is due to monopoly agreements granted to ISP's in the US. You have more favorable regulation in the EU to be sure, but don't pretend the problems in the US have anything to do with a lack of government involvement...
Remind me to generate a new IPv6 address for every hour of the day...
The interpretation of the EU regulation is different. I think the latest bet on how Denmark understand the EU regulation is:
The users must be informed that cookies are used, and always have easy access to the "cookie policy".
The user must have a way to opt-out. It is still debated if it is enough to inform him how he adds sites to the Internet Zone, and denies cookies to sites in the Internet Zone. Persistent Cookies needs user approval, session cookies not.
There is also the other solution that wil kill the regulation: Just tell users that to use the site they must accept cookies. If they don't, they can go away. When they can visit no websites at all, they will start accepting the cookies. Most technical skilled people thinks this is the worst law ever decided by the EU. So many websites are dependent on cookies today, that most of the web would stop working if cookies was disabled.
As it is now, it is the user that decides if he want JavaScript or Cookies.
IPv6 will give almost everybody practically static addresses, the ultimate undeleteable cookie. So the EU regulation will be futile very soon.
That problem has been solved by RFC 4941, otherwise known as the Privacy Extensions. Most OSes support it, though I believe some don't enable it by default. IIRC the iPhone is one of the devices that doesn't support it, but that should be fixable once IPv6 becomes more widespread.
1. the user sent the information in the first place 2. the cookies are on thir computer 3. just use a cookie blocking extension, no need for server side implementation
I have a perfect solution! Rather than continuing to use magical cookies which can follow you around and tell everyone where you've been, I'm going to re-implement a cookie-like thing which cannot possibly do anything you don't want!
Here's how it will work: When you go to my website, I will send your browser a "brownie". The "brownie" will just be a short text string.
Then, if you want me to track you, simply inform your browser that you would like to send back the "brownie". whenever you connect to my server.
In this way, every single connection will require explicit consent to be maintained! If your browser doesn't send the "brownie" with every connection, I won't track you.
The unicorns which maintain the magical cookies that track you without requiring your browser to explicitly send them back every time may be upset by this scheme, but I am never in favour of rejecting a technology simply because it will put people out of work.
-- 'The' Lord and Master Bitman On High, Master Of All
Ironically, the BBC have a follow-up article, the first paragraph of which reads:
Interesting idea: Different IPv6 address per user account.
All of that doesn't matter. Things work differently around here. Not complying with laws or trying to subvert them is considered an unfair competitive advantage and your competitors can sue you.
I think that's exactly what America needs: more EU regulation. We'll just host their sites over here, because we don't have to comply with their stupid laws.
Doesn't matter where the site is hosted -- this is about data collection. Even if the site is hosted in the US, it would be illegal for an EU company to download the data from their US servers in order to perform any kind of analysis. If the site is designed in the EU, it would be illegal for the EU designers to set it up to track visitors without consent. If the site is designed in the US, it would be illegal for the EU owning company to request the US designers to set it up to track visitors without consent. Simply offshoring the hosting wouldn't help: you basically have to offshore your entire operation to get around this.
What do they think the 'Remember Me' checkbox is for!?
Erm... exactly what this is about. This legislation means that such checkboxes are mandatory, rather than just a good idea. And they have to default to unchecked.
IF this had been the US government introducing this law you'd all be applauding it. Reminds me how all the yanks jumped to Microsoft's defense when the EU fined it heavily for anti-competitive practices, despite everyone constantly complaining about Microsoft. Typical anti-European sentiment from Americans.
Now before a troll comes along and says I do not know what I am talking about, I am an American living abroad in the EU, for more than 10 years.
You don't know what you are talking about. You can't reasonably think of the EU as one homogenous unit. The tiny country you're living in sounds pretty good, but remember the EU also includes Italy and Latvia. Things that work for 5.2 million people don't always scale to 60 million or 200 million. Italy is where you can go to jail for a youtube video critical of politicians. Italy where the ties between business and government are so much more imaginably corrupt than happens in America. They don't even try to hide it. Is that the Europe you want?
That's why it annoys me when people say they want a healthcare system like Europe's. Ya right, do you want a healthcare system like Estonia? Do you even know what you are talking about? Please think these things through.
"First they came for the slanderers and i said nothing."
How do you track consent in the first place, without cookies?
A user giving consent (or not) means that you've got to have a unique way of identifying that user. In the stateless HTTP protocol this means that you've got to have some state preserved. You can either do that with very fancy URLs (but then back buttons, bookmarks, browser history and such will not work properly) or with cookies.
What I want to know is what I have to do explicitly to comply with this thing, apparently it's been in the pipeline for over 3 years, and it's the first I hear from it. Some practical info would've been nice. Guess I'll have to dig up the regulation itself on one of the EU sites... Wish me luck!
Do you have to click yes to all 12 trackers to "authorize the page to load"?
"Sorry, you didn't agree to all 12 trackers, so therefore we can't afford to give you the page."
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
You try to read the cookie.
If you fail then they haven't got one. You don't try to write one until you actually need one (shopping basket, account signup or login etc), at that point you ask permission with it spelled out that they can't go any further without it.
If they decline then you send them back to your front page or to google or something.
If you're a forum or something then sure, you need cookies for pretty much anything (other than random drop-in people just looking). If you're something like an online newspaper, that's not behind a subscriber/pay wall, you don't bother with cookies at all.
Seriously, if I wasn't coming here to comment, can you think of a reason slashdot would *need* to set cookies?
Somehow i doubt that. You see, google doesn't really need to use cookies to track you, all they need is a HTTP GET from your browser in order to do some pretty decent tracking based on your browser, OS & IP combination.
The whole point of a hierarchical addressing scheme is that you DON'T randomize the addresses. That's, incidentally, the problem IPv6 was supposed to solve (before, of course, politics got in the way).
Why ? A hierarchical routing table only needs to contain your own clients, and a single upstream route. That's maybe 10-20 routes for any "normal" point in the network. 50 at the most.
Randomizing addresses, for political reasons, got us to ... checking ...
345750 network entries using 41835750 bytes of memory
(and of course, rising fast). The difference ? A 10000 route switch is $2000, one that can take one million routes (the minimum you'll risk if you're smart) costs around $50000 (that's per device).
And what if my operating system connects to the network BEFORE showing the login screen?
Great - what the internet needs is more regulation.
How dare those cheese eaters interfere with companies' God-given right to spy on us?
Every process on a system already runs under a user account. Even the process that displays the login prompt. Shouldn't be a problem!
Nope, most IPv6 implementations do periodically randomise the host part of the address (low 64 bits). They keep the old one around until all existing connections are gone, then switch to using the new one exclusively. Two HTTP subsequent requests from IPv6 hosts may come from different IP addresses without the user doing anything, although they will come from the same subnet (but that subnet can easily have a few thousand people in it if it's a university or corporate campus).
I am TheRaven on Soylent News
IPv6 explicitly requires every network adaptor to support having multiple IP addresses concurrently. You can have one for the system, one for the web server, and one for each user.
I am TheRaven on Soylent News
Don't forget sites which want RL data (name, address) without really having a need for those details.
Isn't it the case that the most basic connected home router only needs 1 routing entry for it's /64, and that clients would then have 18,446,744,073,709,552,000 different random addresses within that /64 to choose from?
Ah, just re-read, GPP said 'routers'. Agreed, having the router doing some sort of random address translation would be insanity. What if the client picked a new random address every, say, week? day? hour? minute?
There is nothing interesting going on at my blog
Sounds fine to me. If your content is really that valuable to me, I'll agree. If not, then I'll go to your competitor.
I am TheRaven on Soylent News
hey what's not to like about securing your own privacy?? that is exactly what it needs..... not an internet kill switch like some countries are trying to have -ahem- not looking at anyone america
Why would I need a cookie to read things?
This is where my understanding of all the protest over this breaks down. To just read a site, what use is it to me to have a cookie?
Sure, for buying stuff, or for logging in or whatever else, I see how they're used. But for just reading a site (or loading an ad) why should I have to maintain a cookie?
This isn't limited to 'the feds' - most police around the world behave the same way. Oh, and it doesn't even have to be plugged in... :(
Old monitors standing idle in the corner - confiscated.
MP3-player in the kids bedroom - confiscated.
Ancient 5.25" floppy disks - confiscated.
Standard household power-strips and cables - confiscated.
The list goes on and on and doesn't make sense. Quite obviously, it's all about harassment and nothing else.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
I think we need a car analogy before we start.
You go to a retail store and park your car outside, and while you are in the store, the retail store goes and places a GPS tracker to the underside of your car. You are unaware of this tracker, and the retail store starts tracking your exact movements. They want to know which competitors you visit, for how long and how frequently, they may also find you go to a gym every day, or figure out where you work. To remove the tracker, you will have to look under your car and remove it.
Would you say that this unknown tracker by a brick and mortar store is acceptable?
The EU want web sites to ask you explicitly before they can track you. A little like the analogy above asking you when you arrive at the store if they can stick the tracker under your car.
Correct. The lower 64 bits change, the upper 64 bits stay constant.
Now ... which of these 2 identify the client ? The changing part, or the non-changing part ?
I live in a small country of only 5.2 million, and I can choose from literally dozens of mobile phone operators
No shit, it's almost like it's easier to provide coverage for 5 million than it is for 250 million!
Awesome, instead of cookies we will have ?session_id= parameters. It's like the 1990s all over again! Can we go back to writing CGI scripts in Perl now?
Now seriously, doesn't this mean that tracking will still be available to people who do really large scale behavioral-pattern datamining while us clods will have a hell of a harder time implementing any kind of non-static page?
It could be a good way of getting only legitimate cookies. Content-providers will be somehow forced to get rid of all hosted content (banners, flash videos, embedded pages and whatever) that silently drops cookies into my browser, as if they won't do so the users will be prompted with 50 cookie requests whenever they are visiting their pages, and they will quickly browse to fresher waters. They will have to chose other forms of advertisement that do not violate my privacy. They (the content providers) would also be forced to be more considerate about the usage of cookies, like pushing them to your machine only after log-in. Accepting every now and then a cookie from the sites that I choose to visit wouldn't seem such a big hassle to me. On the other hand, I do not like the idea of having laws for everything, I would rather let the responsibility on the users. If they are sensitive about their privacy, they should just set their cookie policy to "always ask" and run away from sites that try to drop cookie bombs on their machines. (Even though, at the rate cookies are delivered on almost every big-content page nowadays, this strategy would soon leave them with very few places to go...)
now I might missunderstand that rfc, but it seems totally useless.
You can only get a different address within the subnet your provider assigns to you, so companies will simply maintain a table of which ISPs use which size of subnet, and ignore the corresponding variable part of the address.
Presto, unique ID per household again
Google requiring log-in = people start using bing (have they renamed it again yet?) / yahoo / altavista.
Really... this is what would happen.
The whole point of a law is that everyone must obey it.
There is also a matter of Google benefiting from any laws that make things harder for all search engines and ad networks -- it will hurt its competitors more than will hurt Google because Google still has more data and more sophisticated analysis, so it can afford to base its ads on data available without tracking. Google gets plenty of information from overall statistics, searches and association of ads with pages where ads are displayed. Persistent tracking is a bonus for them, however nothing will be broken if ads won't be able to set cookies all by themselves.
Contrary to the popular belief, there indeed is no God.
I live in a small country of only 5.2 million, and I can choose from literally dozens of mobile phone operators
No shit, it's almost like it's easier to provide coverage for 5 million than it is for 250 million!
That is SO true. If you have 250 million people, there's no potential customers! Or hey wait a minute. It's exactly the same. Bullshit argument.
Unions are being banned and corporations can give limitless amounts of cash to politicians. Proud, very proud.
This legislation, which is close to being enacted, has avoided publicity to date. I can see why people might want it, though I think it would be better sorted by a browser fix (you can switch off cookies right?). From the point of view of smaller websites, having to specifically ask every time you want to issue a cookie is a nightmare - presumably we do this thorough a pop-up? (pop-up blocked anyone?)
The IP record fix looks like a way to avoid this, though paradoxically it results in our having to record more specific data about visitors, logging IP addresses and browser details in a database, and trying to match them up to each HTTP request to ensure that the visitor gets the service the site is intended to provide. Previously we haven't bothered recording any of this data - the cookie was between you and the temp folder on the server...
Sorry, but this is a crap bit of legislation...
The detailed drafting of the regulations, which is how European directives are implemented, will not be ready before May. It's hardly unreasonable to state you're not going to be strictly enforcing regulations which haven't yet been promulgated.
[FUCK BETA]
Ad networks and tracking behavior of users between unrelated visits. Things can get seriously creepy if, say, news site will always first display the stories similar to the topic user looked at before, even if the user does not have an account and did not want the site to choose those things for him.
Contrary to the popular belief, there indeed is no God.
I wonder how enforceable this is - asking all website owners to ask if they can set an anonymous cookie? Really?
However, I wonder if the spirit of it is best achieved in the browser. Essentially, accept cookies from the hostname/domain written in the address bar, and don't accept any others. Thus, visiting /. will give me a slashdot.org cookie (maybe), but won't give me (or send out) the Google Analytics or Addme cookies (which aren't in my interest, as they aren't sites I'm visiting).
Personally, I hope this gets watered down to a browser feature, rather than what it appears to be right now. But I can see worse worlds than one where you can't have anonymous cookies without permission. Of course, we realise that ad networks will move out of the EU to avoid this, but that will slow down ad delivery, which will make them less attractive to advertisers than the in-EU ones, so we may well see less of that than we might imagine at this point. In the longer term, I'm sure the lowlives of the tracking world will find ways to do their work without worrying about these regulations, but keeping them out of the EU isn't really a bad thing for us Europeans.
Fabulous. At least I now:
a) know you are wanting to load 12 trackers
b) can decide whether you site is soooo critical to me I'm willing to load them.
The answer to b is "unlikely" - great thing about the web, if you're doing it someone else probably is as well. I'll go there.
EULA /= EXPLICIT CONSENT.
Guess what is required by the directive.
Or you can be taken to court, have criminal proceedings brought against you and the directors put in jail.
No, it's just that it isn't that hard to either write, or in the case of browsers that support add-ins (IE, Firefox, Chrome -- maybe opera with 11+) to manage/deny cookies if you are that much of a privacy nut.
Personally, I *like* advertising companies knowing more of what I like and don't like. That way I will stop getting bombarded by viagra/cialis products. I don't need them. If you are going to put an ad up, put one up that I might actually be interested in.
As for the EU/Microsoft... The whole browser thing we all said was a farce when the EU was fining MS. They forced them to implement a browser ballot box to "prove" there was injustice, and finally level the playing field (Because EU residents are obviously all sheep and can't download their own browser). And what were the effects of all the EU bullshit? Nothing. Nothing at all. Ok, well, the 9th place browser manufacturer claiming they had their downloads per week nearly DOUBLE, statistics show that IE usage actually INCREASED shortly after the ballot box was introduced. Nice job EU.
If you are going to trot out some bullshit about how the US has "typical anti-EU sentiment", please pick an example that doesn't show how ridiculously stupid the EU was being.
Fortunately the EU isn't that stupid and covers all methods, not just cookies. The BBC focused on cookies because they something people have heard of, but the rules cover all forms of tracking. ISP level, Google-style redirect-URL level, malware level...
It seems like the US is trying to have something similar with an opt-out do-not-track list. In the EU we prefer the option that by default gives citizens the most protection/benefit, so ours is opt-in.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Yes it is a piece of crap legislation. Why?
It is trying to stop abuse happening through tracking with cookies. There really isnt any technical way to fix this without breaking or inconveniencing a lot of people.
Bad situations make for bad laws. I agree that it would be a bad idea in its present form, but dismissing the intention behind it is not.
Did you forget NAT64?
"Lame" - Galaxar
If the user blocks cookies, then I won't set any cookies. If the user doesn't block cookies, I will set them.
What we need is not a rule like this, which is stupid. We need an accessibility rule that says any website which must be accessible (government and utilities for example) must work without cookies.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The invisible hand is just another religion.
Sigh ... you know so little about what is going on outside of the USA. ...
In the EU you can not waive rights/privileges which you have by law by "signing" an EULA EULAs in the sense as they exist in the USA are not existing in Europe. It is illegal to put something into an EULA which is contradicting to law. Sigh, you can not give up your rights. Not even by clicking on an EULA thing
It is so simple: EU law > state law > region law >> EULA / contract / agreement etc.
angel'o'sphere
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
I'd argue that US =/= Utah times 50 (fortunately for US)
And Estonia is a great place, you should visit it.
The situation he's describing is true for the UK as well (population : 61.8m as of 2009).
Now, as I understand it that's about a fifth of the population of the USA. However, the USA is a collection of states with their own governments, much like the EU. There's *NO* reason that regulations like this couldn't be implemented at the state level - the largest state in terms of population is California, with 38m, and there are only 7 states with more than 10m people (april 2010 census figures).
Actually, I take that back. There is *one* reason you won't see this in the US - a lack of political will. California seems to be the only state that actually cares about its citizens privacy, and it's constantly butting heads with Federal as a result.
Back to the original topic: tracking cookies. This regulation is in response to companies who abuse users by tracking them using cookies. This is unwanted behavior. Cookies were not originally intended for this use and since companies have been abusing cookies (and by extension the consumers/users), it calls for regulation since companies in the free market cannot be held responsible for acting responsibly. Companies will only do what they can to increase profits and/or market share unless forced to do something else. Regulating cookies for tracking behavior is needed and I do not have a problem with this. It protects me as a consumer since it is widely known to be abused. This is precisely why regulation is sometimes needed.
Except that's not what requiring permission for all cookies does.
Requiring explicit permission for all cookies trains users to "just click OK" to the cookie permission popups. This also means that by disguising something else as a cookies popup you can get users to click "OK" and give it permission to do something else enteierly.
A passable solution would be requiring browsers to default to denying all cookies not on a white list. But that is very different from requiring web pages to secure permission every time they want to issue a cookie.
Cookies are so last millenium. Firefox 4 is pushing that new WebDB or whatever it's called so companies can keep a whole database of info on your local machine. Heck, they won't even need to keep user information in their own database, they can just query your machine any time you visit them. Go ahead, let them ban cookies altogether so we're forced into this new more scalable and flexible replacement.
The U.S. is not "trying" to have an internet kill switch. It has one, under a law that goes back to the 1930s and grants the President broad authority over wired and wireless communication. The bill in question would have limited, not expanded, this power.
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
But this is largely already the case with IPv4. Either your single IPv4 address rarely or never changes or even worse, reverse DNS will return your DNS address assigned by your ISP. Do those DNS addresses ever change?
At least some IPv6 tunnel brokers allow you to setup your own reverse DNS.
When you leave a site you can have a popup / popunder to say that the site has put a cookie on your browser so that when you come back you can auto-login. That makes sense. How to explain to a user why a website at www.site1.com has allowed www.site2.com to put a cookie on your browser (e.g. advert networks, google analytics) is much harder. Differentiate between the two and you could have a workable system. Screwing up google analytics would leave me looking to auto-upload all my apache logs to Google somehow, which would then beg the question of 'Who do server logs belong to?" I'm assuming they are mine in the same way that if I sat by the roadside and made a list of the number plates of the cars that passed, that data would be mine as well...... What do you think? P
Can already do this with IPv4.
If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
And why should Google require login? I can use Google with cookies disabled just fine.
The Tao of math: The numbers you can count are not the real numbers.
As far as I can see the purpose of the legislation is to prevent targetted advertising, though if you have a real heap of information on people I guess you could try to profile them in more detail. This isn't something that most websites can do effectively in isolation, as we simply don't have the market coverage to track what people are doing outside of the 20 seconds or so most visitors spend on the site (short of downloading your browser history - NOTE update your browser!). It is more of an option for big online retailers, like Amazon, though I honestly don't object to them suggesting products on the basis of what I've looked at already - I guess there is a trust relationship there which I find adds to the browsing/shopping experience.
In the UK the big stink came with the Phorm contract with BT, one of our main ISP's, but this is a very different technology to what we as web developers usually have access to, and I don't believe it was cookie based...
In fact the only people I know of at the moment who track you (me and everyone else) like a hawk are the Search Engines. They do do it to offer you targeted searches, which are pretty annoying if you are logged in as they can give you a seriously distorted view of the web (why is that little site you have just created at the head of the Google rankings? - Oh bugger, logout and look again!), but even if you are not logged in they will set regional preferences for your search, though clearly they use IP tracking rather than cookies.
To get a similar level of intelligence to that in the possession of the likes of Google, large numbers of websites would have to pool information, and if you are talking about this level of integrated development, then you would be using IP tracking as well, and not cookies, which are site specific (again make sure your browser is up-to-date!).
Now, just perhaps there is a business model for world domination here...
Lawmakers can demand whatever they want, and ultimately get it by means of force. I am not going to dispute that, or EU's right to (however misguidedly and stupidly) attempt to protect peoples' anonymity.
But .. this is lame, because it is so utterly at odds with how cookies work.
All cookies used by websites are voluntarily sent, at least as far as the website can tell. The website offers a cookie, and the browser (or user, depending on how good the UI is) decides whether or not to store that cookie and later send it back in future requests. If there is any lack of consent here, it's that the browsers aren't asking users what they want.
You can pretend that this is all just technicalities, but nevertheless that is the reality of the situation, so anything stemming from the false pretense is likely to have unintended consequences and fail to accomplish its goal.
Websites do not store cookies on your computer. They do not have that capability. Your browser really is the problem, and if you try to hold websites responsible for what happens, instead of whoever is actually responsible, then all the bad things that you worry about, are going to continue to happen.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
It ought not to be possible to post cross-site cookies, though with many sites adverts and other content is displayed in frames, so it is not clear what site you are actually on... Perhaps it shouldnt't be possible to download framed content from a different root URL in the one browser window? (Browser developers - does this make sense?)
Oh ya, thanks, Id love to visit Estonia sometime.
"First they came for the slanderers and i said nothing."
You see, over here, we actually care about privacy and our governments do actually help to protect it.
In other words, by protecting people from themselves we make them more free, is that it?
Look, this isnt hard. Dont want facebook to try to monetize you? Dont use facebook. If people care enough about such things they will educate themselves on them; if they do not, they will not.
Over here in the US, you see, there has historically been an emphasis on "freedom to do things" rather than "freedom from things", though here too it is changing recently.
If Bing cannot track you, it cannot monetize you. What makes you think a corporation wants to lose billions a year on a search engine that raises 0 revenue?
This is exactly what evil corporations do all the time. Request consent for something seemingly innocuous that in fact signs any your rights to any confidentially at all, with about as much opportunity for negotiating the terms as the average EULA.
This is definitely not the case where I live.
My ISP gives a new ip on each connect, often a different subnet, and the reverse-dns adresses are tied to the IP and change with them. Any DSL provider I know does the same thing.
Several even force a disconnect after 24 hours, others have longer periods, but changing your ip is as simple as setting your modem to disconnect on idle.
Well, ... or from where does your wisdom come? ;D ... the country of contrasts. The second richest region the EU is in north Italy. In fact I think it is the third richest in the world, the area in the Lombardai and around has the highest per capita income. As a side note, the richest area of the world is San Marino, an enclave state with perhaps only 100,000 inhabitants and likely only a dozen villages ... even smaller than Lichtenstein.
I assume you are either an Estonian living in Italy or an Italian living in Estonia
Anyway, the EU consist out of 27 countries. You picked Italy as a very bad example out of those
The is political and cultural in fact a very homogene area. At least as homogene as you can be if the south west in Portugal is Catholic and speaks a romanian language while the 3 Baltic nations speak their own micro languages and the north is protestantic and speaks mainly indo germanian languages. Anyway, in culture we much in common. So, Italy
OTOH the south of Italy is by far the poorest region of Europe.
Regarding healthcare, well, I think you took the wrong topic to pick on. Especially the young nations, where you would not believe, it have excellent health care. The Estonian one is outstanding.
Italy has the lowest infant death rate of the world, e.g. A lot of people in Switzerland (which has an excellent health care system) travel for difficult operations to Italy. Because the Italian hospitals are better.
Anyway, just to set some stuff straight.
Best Regards
angel'o'sphere
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
While I approve of privacy oriented legislation, I'm more concerned with regulating humans than software.
A good analogy is how a doctor wouldn't get in trouble for collecting your medical history, but will get in trouble if he sell that information to advertisers. I don't think making it illegal to store cookies is the right way about it. Rather make it illegal to sell this information to others, or to retain it for periods longer than a certain threshold.
Regulate the use of the information collected, not the technology used to collect it.
But... the future refused to change.
EU can't regulate US companies, so all the ad services will just operate over here...
Luke-Jr
You guys seem not to et that the hosting location is completely irrelevant, or do you?
If my web address is www.denominazione.it, entreprise.fr, corporation.co.uk or firma.de it is obviously a web address serving content for a european company.
Who the fuck cares in what bana republic the server is hasted?
You are liable under EU law for what you as a EU company do ... after all obviously such a company would offer its web services very likely mainly to EU citizens.
angel'o'sphere
P.S. do you really think a US corporation would get away with breaking US laws by placing their server into german?
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
You don't know what you are talking about. You can't reasonably think of the EU as one homogenous unit.
True, there's a huge difference between the member nations in many aspects... Especially when it comes to stuff like social services, income and wealth... However, in terms of regulation a lot of good work an consolidation of laws is happening at the EU...
In theory, yes, but how many people have enough public IPv4 addresses assigned to do this? IANA rules mean that they shouldn't have them if they do...
I am TheRaven on Soylent News
Does the EU do anything apart from make things harder for people? This effectively means no anonymous cookies.
What is an "anonymous" cookie? A cookie that I cannot see - a "stealth cookie"?
I'm guessing it's more about controling and monitoring citizens than about protecting their privacy.
Wrong guess. It has nothing to do with it.
The thing is there are lots of legitimate uses for anonymous or one time cookies for which consent.isn't practical, so if this flies, it will detract from the Internet as we know it.
Please elaborate.
BTW: I agree to another argument: We can use cookie filters within the browser and do not need to make it part of the Web sites. On the other hand, if all sites that do not actually need cookies from a technical point stop using them, this would be a Good Thing(tm).
Yes, but you are far less valuable to Google without knowing your habits that they can sell. So much less valuable that they are unwilling to provide service to you without said tracking.
And why should privacy protection require a log-in? It's the exact opposite.
Which of those involve routing? The changing part, or the static part?
Ignorance killed the cat. Curiosity was framed.
You seem to be more informed about this specific regulation then i am, do you happen to have a link to the text? I've got no clue where to even start looking for it
Quite obviously, it's all about harassment and nothing else.
And free old electronics recycling, apparently. It can get expensive to properly dispose of those lead filled CRT monitors.
They seem to be pretty vague on what cookies are allowed. Cookies that maintain shopping carts are specifically allowed, but I see nothing in the article about cookies to maintain a login session. So even logging into GMail would require asking permission to store a cookie, and users would think that it's only for advertising tracking. So just to use most sites, you'd have to grant them free access to write cookies anyway.
You must have a very strange version of C, where /= divides the right argument by the left. All C versions I know divide the left argument by the right.
The Tao of math: The numbers you can count are not the real numbers.
Maybe it's related to the fact that Schwarzenegger is originally Austrian?
The Tao of math: The numbers you can count are not the real numbers.
A cookie without a name, of course. :-)
The Tao of math: The numbers you can count are not the real numbers.
In order to have a monopoly on the user data?
The Tao of math: The numbers you can count are not the real numbers.
So.. you go to a site.. it says "please allow us to store cookies to enhance your experience" yada yada.. you say no.. next time..you get the same message...lather, rinse, repeat until you say yes because **there is no other way to maintain the persistent state of the selection**.
People will simply not go to the sites eventually or say yes after the umptienth time to get away from having to click no.
Does a "text file" only exist on secondary storage? What about session cookies - those without an expiration date that are generally not written to a file on disk. Do they count? No "text file" is created, so they wouldn't fall under this law? It's a bit vague.
There are other ways that are more secretive and much harder for users to control than cookies. Fingerprinting the user's computer isn't that hard and if you collect enough information through the browser you can probably do it with 99% accuracy or better. So then you can store the information on the server.
What this should do is annoy the crap out of users. The "proper" implementation is to ask with a popup every time a cookie would be stored. If the user has the browser confirming cookies this would result in two popups for every cookie - the more the better, right?
What this regulation seems to think they are addressing is some kind of special "tracking" cookie and not ordinary cookies that are used simply to save things like login information. I haven't read the regulation but from the article it sounds like they carved out some very small number of specific, none of which apply to my web site. So, do I assume the regulations aren't really going to apply to me?
Of course, there is the question of what possible point does this have for any US-based company? Would it mean that EU-affiliates would be prosecuted? Hardly. Would it mean that an EU subsidary would be prosecuted? Maybe. For a small US company, I'm not sure it has any meaning at all. Except we would get email from angry EU users trying to say that we were not following EU regulations and they were going to "turn us in to the Web police". Yes, I have gotten email like that before.
I think the real solution is for every web site to confirm every cookie individually. Annoy the crap out of users and make sure they know it is this new EU regulation that is requiring it. Maybe that would get some claification or a repeal. It sounds like an incredibly short sighted and pointless regulation.
*sigh* the point I was trying to make is that the unchanging part identifies the client.
It's the other way around. Logged in user has to be tracked just to maintain his logged in status (this still doesn't mean, site should report those things to advertisers). However when user is not logged in, there should not be any cookies that identify the user when he will look at the same site later, or (especially) cookies for completely unrelated advertisers' hosts that have nothing to do with functionality of the site.
Contrary to the popular belief, there indeed is no God.
The server can just drop/ignore all the bits that might change, which still identifies a single home router (like having a single public IPv4 address + NAT).
Dilbert RSS feed
Mine too. I use a dynamic dns service for my home server, but it's almost useless, it hasn't changed since I set it up last year.
Dilbert RSS feed
No, it's just that it isn't that hard to either write, or in the case of browsers that support add-ins (IE, Firefox, Chrome -- maybe opera with 11+) to manage/deny cookies if you are that much of a privacy nut.
That doesn't give companies the right to exploit people's privacy. Whether you can block it or not is irrelevant.
Personally, I *like* advertising companies knowing more of what I like and don't like. That way I will stop getting bombarded by viagra/cialis products. I don't need them. If you are going to put an ad up, put one up that I might actually be interested in.
So give them permission, the law doesn't stop you as the consumer to give your data away.
Dilbert RSS feed
From the actual directive:
(...) Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. (...)
Directive 2009/136/EC, clause 66.
Seems it covers login cookies.
Dilbert RSS feed
Do you actually think you're only tracked when you choose that checkbox? Ha. You don't even have to register to be tracked, especially by ad networks.
Dilbert RSS feed
Not that many people. I personally do this, as I have multiple public IP addresses with 1 internet connection. Helps me keep personal traffic separate from server traffic. I don't want to be personally blocked by IP if my server was crawling a website and they have more sensitive rules than the norm.
If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
Whether you can block it or not is irrelevant.
No, that is completely relevant. Obviously the government needs to step in because people can't be bothered to keep things they want private, private.
That's like saying that companies should be stopped from putting cameras in every street because people can't be bothered to use face-covering hats.
People shouldn't have to - this isn't people willingly submitting data without reading a ToS. You can be tracked without registering or accepting anything, especially by third-party ad networks and such.
Not to mention, it's impossible for the user to distinguish between a tracking cookie and a login or preferences cookie.
Dilbert RSS feed
That's like saying that companies should be stopped from putting cameras in every street because people can't be bothered to use face-covering hats.
Are you suggesting that it should be illegal for traffic cameras, ATM cameras, in store cameras, etc? lol.
Not to mention, it's impossible for the user to distinguish between a tracking cookie and a login or preferences cookie.
That is because they are exactly the same thing. Only difference is how they are used. I'm quite sure the EU will be incompetent enough to make both illegal.
Are you suggesting that it should be illegal for traffic cameras, ATM cameras, in store cameras, etc? lol.
No, and neither will be cookies. But in the EU such cameras are regulated. At least if the camera films the street you need a permission, and you have to make sure the data isn't cross-linked with other cameras or shared with third-parties, exactly to prevent such tracking.
That is because they are exactly the same thing. Only difference is how they are used. I'm quite sure the EU will be incompetent enough to make both illegal.
First, tracking cookies won't be illegal, sites will only need to ask for explicit permission from the user. There's a large difference. In fact, many websites already have a "remember me" checkbox for such needs.
Secondly, instead of being "quite sure", you could actually know by reading the directive, but I'll do it for you:
(...) Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. (...)
Seems to cover login cookies, as they are "strictly necessary" to give you the service you registered for.
Dilbert RSS feed
(...) Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. (...)
Seems to cover login cookies, as they are "strictly necessary" to give you the service you registered for.
Thanks for proving my point. Now just wait for the inevitable lawsuit to be put forth proving that you don't need any kind of cookie to provide said service (say, such as using a unique/encrypted seed as part of the query string in the URLS), and presto! You have exactly what I just said.
Now just wait for the inevitable lawsuit to be put forth proving that you don't need any kind of cookie to provide said service (say, such as using a unique/encrypted seed as part of the query string in the URLS), and presto! You have exactly what I just said.
First, the directive isn't law, so the specific wording is irrelevant.
Second, people don't sue over anything over here, they would complain to their national data protection commission.
Third, it's obvious that the directive isn't specifically against cookies, so the commission, knowing that a query string or any other method identify you as well as a session cookie (it's their purpose as login keeping system), would simply disregard such complaint as an identifying system - regardless of how it's implemented - is in fact required to log people in.
Dilbert RSS feed
Maybe in the US, but here in Canada we have a recycling program. Every time you buy a piece of electronic equipment, a recycling fee is added to your bill. This means that we can now take ANY electronic device to the recyclers for FREE. If you have a *large* quantity, you can even arrange for them to pick it up, for FREE! It's very similar to the oil situation, almost any gas station with a garage will take used oil for free and send it to the recyclers, because you've already paid the recycling fee when you bought it.
Except I think you're wrong. The unchanging part identifies the subnet. The changing part identifies the client.
Ignorance killed the cat. Curiosity was framed.
And, pray tell, what *is* the subnet identified ... it is the ethernet port of the router at the customer site. So you can identify that. Which home the request was made from. Is that personally identifying information ? Of course it is.
The other "changing" part, you can determine the machine's MAC address from it, so it identifies the machine uniquely.