Slashdot Mirror

← Back to Stories (view on slashdot.org)

Confusion Surrounds UK Cookie Guidelines

Posted by Soulskill on from the cookie-is-for-me dept.

pbahra writes "The Information Commissioner's Office has, with just over two weeks to go, given its interpretation on what websites must do to comply with new EU regulations concerning the use of cookies. The law, which will come into force on 26 May 2011, comes from an amendment to the EU's Privacy and Electronic Communications Directive. It requires UK businesses and organizations running websites in the UK to get informed consent from visitors to their websites in order to store and retrieve information on users' computers. The most controversial area, third-party cookies, remains problematic. If a website owner allows another party to set cookies via their site (and it is a very common practice for internet advertisers) then the waters are still muddy. And embarrassingly for the Commission — it's current site would not be compliant with its new guidelines as it simply states what they do and does not seek users' consent."

5 of 143 comments (clear)

  1. There should be... by myurr · · Score: 5, Insightful

    ...a law stopping people from making laws about things they simply do not understand.

    1. Re:There should be... by Nursie · · Score: 3, Interesting

      "Correct me if I'm wrong but even when you disable cookies the browser typically still allows session cookies to be used."

      Not when you're using the Cookie Monster firefox plugin set up the way I have it set up, no. You can enable session cookies or all cookies on a per-site basis.

      Slashdot is one of the few sites that I do care about having working though, so I allow them to set what they like.

      "This new legislation also applies to temporary session cookies. Almost every site where users can log in will be using session cookies to enable this."

      Sure, and that's a valid use (IMHO). It could easily work this way though -
      User goes to front page
      Check for cookie
      If no cookie allow user to browse site
      When an action is taken that requires a cookie, present the user with the user agreement explaining about the cookie, and also a login box (if they have a login they must have previously agreed to cookies). When they login or click through then set the cookie, session or permanent depending on your agreement or preference or whatever.

      If the cookie's there from the beginning then do the usual auto-login stuff.

      A lot of people say that if they're not allowed to set an opt-out cookie, how do they know the user's opted out and how can they then use the site without a popup on every page. My answer to that would be to get them to make sure they actually need that cookie, and if they do then make it clear that the site won't work without it.

      I realise all this makes things more complicated for end users as well, which is less than ideal.

    2. Re:There should be... by Nursie · · Score: 4, Interesting

      What's not an answer to the technical problem?

      Don't set cookies without permission, if you really need a cookie then tell them they must have one to use the site. If they have previously allowed you to set one then there will be one there, or they'll have login details or whatever.

      I don't get why there's more of a problem than this.

      maybe I'm not getting it. Can you describe a situation in which this technical problem manifests itself?

  2. Helpful instructional videos from across Atlantic by syousef · · Score: 4, Funny

    Correct way to handle cookies:
    http://www.youtube.com/watch?v=OqL7jyrXhLs
    http://www.youtube.com/watch?v=rHfEmIXkWfg
    http://www.youtube.com/watch?v=Cqz9ZXUoUcE

    --
    These posts express my own personal views, not those of my employer
  3. The idea is just fine by xenobyte · · Score: 3, Interesting

    It's just next to impossible to use the law as it is.

    To me however it is very simple: A website can trivially obtain permission from the user for the site's own cookies. An advertiser needs to get opt-in consent before sending a cookie as it is unfeasible to obtain permission as you go. Basically this can be done in a simple way: A visitor to a site featuring ads from the advertiser will see nothing to requests to decide whether to accept cookies or not until this decision is made. The result is stored in a cookie which they need permission for as well. Now when sending ads the decision cookie is checked and if the answer is yes, the ads are sent with the tracking cookies, and if no, they are sent with no cookies.

    This will obviously result in a lot of people saying no to the tracking cookies but that is as it should be. Tracking someone should only be done with consent.

    --
    "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --