Slashdot Mirror
BBC Site Uses Cookies To Inform Visitors of Anti-Cookie Law
Andy Smith writes "As of 26 May 2011 web sites in the UK must get a user's permission to set cookies. If you go to the BBC's commercial TV listings site Radio Times you'll see a message telling you about the new law. Go to the site again, though, and you don't see the message. How does the site know you've already seen it? By setting a cookie of course! It doesn't ask for permission."
I guess that's what happens when law makers don't really get what's going on, and the techies tasked to implement this stuff don't really care.
Waiting for an amusing sig.
shows how stupid the cookie law is
Why is the necessary?
Also, I use no script so I never saw that "notice". Does that mean its still breaking the law.
What is this protecting me from?
Not all cookies are tracking cookies; legislators appear to have overlooked this.
The new cookie laws are only about tracking cookies, not session cookies or cookies necessary for the functioning of the website.
That cookie is not a tracking cookie, as such it isn't breaking the law. non-news.
The vast majority of techs and people in general don't think about what they're doing, so sometimes this kind of humor ensues. Sort of like that time a MS Server campaign was exposed by netcraft as being hosted on *nix.
If you follow the link in the pop-up, the BBC website explains that the changes will be phased in gradually over the Summer.
"The government's view is that there should be a phased approach to the implementation of these changes. Over the summer, we will be working on developing the best methods for obtaining your consent.
In the meantime, you can control cookies by setting your device to notify you when a cookie is issued, or not to receive cookies at any time. We will ensure that we continue to provide you with clear and comprehensive information about the cookies we use, so that you can make informed decisions."
On top of that, the law only covers tracking cookies, but the BBC is going to include all cookies in it's policy. No story here.
But there is a significant difference between a don't-show-message cookie and a we-know-everything-about-you cookie.
Privacy is terrorism.
CHUCK NORRIS doesn't need permission to set cookies in your system.
Nothing here... So... SHOOO!!!
In the UK, cookies are called biscuits.
nt
WARNING: Smartphones have side effects--most of them undocumented.
This law is an example of what happens when overly zealous do-gooders try to protect people from themselves. If you don't want cookies, turn them off.
I am the IT guy for a small European company that does business in many places, including the UK. Our website uses cookies for a couple of things, most importantly to determine which language to show the website in. We have a custom CMS/CRM written in PHP that does its job of serving the website and managing customers and their purchases very well. But it is a complex, fragile and undocumented technical nightmare that I hate diving into without absolute necessity and which I cannot afford to have re-written.
I recently learned of this directive, and I was wondering if somebody out there could explain (or point me to a resource) on what exactly I have to do to be in compliance. Are session cookies OK? If not, I have a lot of work to do to make this thing work without the $_SESSION variable. What about third-party analytics software, like Xiti or google analytics?
Is anybody else out there in this position? What are you doing about it?
Your Browser: Hey BBC, gimme a web page with the URI: http://raidotimes.com/
BBC Server: Here is the web page you requested, with cookie notification text (since you did not provide any cookie), and also a cookie.
Your Browser: Thanks! Let's see, the user settings say, "Accept Cookie" I'm permitted by the user to store this cookie.
--- Later ---
Your Browse: Hey BBC, gimme a web page [...] and also here's that cookie that you gave me which my user already gave permission for me to save and return to you via their preferences.
BBC Server: Ah, I see you provided me the cookie that if you had not given your browser permission to send me, I wouldn't be seeing right now -- I guess I won't show you that cookie info text this time.
YOU HAVE THE POWER TO DISABLE THE MOTHER FUCKING COOKIES -- USE IT AND STOP FUCKING UP OUR INTERNET WITH YOUR NOOB LAWS!
P.S. If the basic cookie settings aren't enough for you, use an existing plugin like Cookie Monster for Firefox -- More power over your god damn cookies than you could ever want. Honestly, if you don't understand it, leave it the fuck alone, before you hurt someone!
Actually the law has been deferred for a year in the EU, s there is no rush to update your websites. We might find that after a proper consultation that it's impossible to manage.
Here's the irony, providing a source link via the BBC News site: http://www.bbc.co.uk/news/technology-13541250
So I'll be like PC (http://www.adweek.com/adfreak/get-mac-security-94121) all the time, clicking Yes buttons when not needing them (while hating to see them), effectively priming me to approve one when I shouldn't.
Bert
While the EU directive is in force now, the UK was actually given a stay for a year:
http://www.bbc.co.uk/news/technology-13541250
So they can set as many cookies as they want for the next year; they just have to stop doing this sort of thing by the switchover.
.radiotimes.com LOG_ID 05/28/21
Google only goes up to 2013
.google.com PREF 05/27/13 ID= ******
See also, Radio Times recommends Internet Explorer 8
The tin foil hattery is off the charts today, even for /. standards.
My personal opinion would be that the html standards needs to be changed. One change would be to create a session header, that does not write, and is cryptographically modified after each page access. This would prevent the websites from accidently storing session data, such as the recent linkedin session problem. Also I would change this so that only one session may be stored unlike cookies.
Cookies then can be used for what they were intended, the storage of information relating to the site, such as preferences. This then can be user definable as if you want to store them, not store them, not accept them, etc.
How come I can't set my browser to detect what type of cookie it is and prompt me if a site wants to set a tracking cookie? Get that accomplished and... problem solved.
It's just cookies, who ever complained about cookies?
Maybe we could require sites to provide milk if the serve any more than a couple of cookies...
If what I just said sounded like a troll, it was probably just a failed attempt at humor.
I guess this comes from the Department of Redundancy Department.
The mind conceives, the body achieves, the spirit manifests.
Are session cookies OK?
I asked the ICO (Information Commissioner Office) exactly that question about a month ago, they have not replied in spite of a reminder. If they cannot answer a simple question like that then I have to assume that they don't know what they are talking about.