Slashdot Mirror
UK "No Tracking Law" Now In Effect
Fluffeh writes "The British Gov might have more cameras up on street corners than just about anywhere else in the world, but it seems that the Gov doesn't want anyone else stepping on the privacy of their folks. In what the media have dubbed the 'Cookie Law' all operators of websites in Britain must notify users of the tracking that the website does. This doesn't only cover cookies, but all forms of tracking and analytics performed on visitors. While there are potential fines up up to 500,000 pounds (Over US$750,000) for websites not following these new rules, the BBC announced that very few websites are ready, even most of its own sites aren't up to speed — and amusingly even the governments own websites aren't ready."
Been hearing this my whole life.
Be seeing you...
There sure a bunch of dumb motherfuckers in Europe. Obligatory: by reading this post, you agree to accept the embedded tracking cookie. Ha ha, dumb fucks.
This is another example of what happens when you let computer illiterate politicians have a say in technology regulations
To be fair, the ICO has proven itself utterly inept when it comes to enforcing its own regulations - I can't see them doing any better with this idiocy.
because atm, ghostery reports 10 diffrent tracking entities.
At the same time as this happens across all of Europe, they roll out INDECT and the Data Retention Directive.
How about I follow each of the MEPs around and write down on a list everyone they speak to, when they speak and where, over the course of 6 months? That would probably mark me as a terrorist.
While the British government might have implemented, the law comes from the EU.
It actually came in last year and websites were given a year grace to enable the features required.
Its that grace period which has expired, not that the law has now suddenly been introduced.
The same measures have been installed in Germany two days ago.
I think it's another stupid EU thing obligatory for all countries within the EUSSR.
The law itself is pointless as you don't have to warn if the cookie is necessary for the functionality of the website.
In other words : always needed, never need to warn.
The British Gov might have more cameras up on street corners than just about anywhere else in the world
It doesn't, though. The whole "eleventy billion cameras in the UK" thing was made up by one of the screaming right-wing tabloids a few years ago, by counting all the CCTV cameras in about a half-mile stretch of the main street of a fairly scummy part of London, and multiplying by the total length of all the roads in the UK. So, the figure is probably accurate *if* you assume that every single road in the UK has lots of off-licenses, bookmakers, cheque cashing centres, "we buy scrap gold" shops the like - but, it isn't. For the figures to be correct, you'd have to have something like one camera every 60 metres or so on *every single road* right down to farm tracks.
Most cities in the UK have no more CCTV than cities in the US - and if you think US cities don't have CCTV then I wonder what you think CCTV cameras look like...
So as a concerned UK citizen, which government department(s) should I be writing to, to request that they prosecute themselves for running an illegal website?
and nothing to do with the government. However the gov (in the form of the police) likes to trawl them for evidence. Usually the cameras are found to be not working when the police are the wrong-doers.
The whole focus of this has been towards helping people protect their 'privacy'. But look at the implementation on sites and you will know at once that there is no explicit consent. a) They have a pop-up box that allows you to opt out (disappears after 20s) b) There is a link to their 'Cookie page' c) The consent is bundled with other site functionality (i.e. ability to use FB/Twitter with marketing cookies) indirectly forcing users to accept all cookies. Companies are spending thousands of £s on a whole array of solutions since the EU directive and the UK law are still so broad. I think making the non-savvy users aware is the only way forward. At the same time people must realise that the livelihood of hundreds if not thousands of people depends on data gathered from sites.
48 hours before the law came into force, the ICO issued new guidelines at http://www.ico.gov.uk/news/blog/2012/updated-ico-advice-guidance-e-privacy-directive-eu-cookie-law.aspx which basically reads as "If the user's browser accepts cookies, then they agree to the cookies being stored". Making the whole things pretty moot. Why they waited until the "11th hour" to state the obvious is annoying...
The regulations are not actually as crazy as this story makes them out to be. Here are the latest guidance notes from ICO:
http://www.ico.gov.uk/news/blog/2011/~/media/documents/library/Privacy_and_electronic/Practical_application/guidance_on_the_new_cookies_regulations.ashx (PDF)
Page 10 has a summary table with some examples of banned (ie. explicit permission required) and OK cookies:
It's ironic having this law in the UK while you can be tracked IRL there nearly everywhere by CCTV cameras that identify your face or your car's plate number.
Where sites have actually implemented this new directive, the implementations often suck just as much as the law, which is not particularly surprising given how poorly it's worded. If you have cookies disabled through your default browser policies the end result on many sites where is a permanantly visible prompt to "Click here to read and accept our cookie policy". Yep, that's right. You have to enable cookies to let them set a cookie that says they will not use cookies to track you.
I'm fairly sure that some of these sites realise that you could set a cookie, immediately try to read it back and if that fails assume cookies are blocked skipping the display of the prompt, and either way you remove the cookie. But no, this law is so poorly written it's not totally clear whether even this would be a breach of the legislation or not and clarification has still not been provided, so as usual for the EU the intention might be good, but the implementation leaves a hell of a lot to be desired. In this case, I can see a number of people are going to end up re-enabling cookies just to get rid of the prompts and end up getting tracked by all those sites who don't implement the law because they are outside the EU's jurisdiction and/or just don't care - completely the opposite of the desired effect.
UNIX? They're not even circumcised! Savages!
gave a flying fuck
It's an opt-out which is mandated. The situation is the same as before, only now the website have to be a little more obvious about what they're doing than they were before.
Other countries, such as the Netherlands, have mandated opt-in. There an actual change is happening.
So corporations (who are really only interested in selling you more or better products) can't watch or track users accessing their own websites, but the UK government (who are in control of the police, the military, health care, social security, education) get to snoop on ALL of its citizens' communications in real-time and without oversight or due suspicion? Madness. In the long term, know who I'd prefer watching my behavior.
I don't live in the UK, but if I did, I'd be signing this: http://epetitions.direct.gov.uk/petitions/32400 . Doesn't the UK listen to its intellectuals any more? It's unbelievable that Orwell and Huxley have been defeated by the impotent argument of "if you've got nothing to hide, you've got nothing to fear".
I've seen UK based sites start to implement this, but there's no chance that Facebook, Google etc will follow suit - so if the tracking actually does have monetary value, we've just guaranteed that only non-European companies can benefit from it. Woohoo.
Sigs are so 1990s. No way would I be seen dead with one.
What does this mean, if anything, for UK owned sites hosted outside of the Queen's reach?
--- b2b.mallaidh.org | www.mallaidh.org | www.kidsalive.org/article/kahlil-pfaff/
On page 3 of http://www.ico.gov.uk/news/blog/2011/~/media/documents/library/Privacy_and_electronic/Practical_application/guidance_on_the_new_cookies_regulations.ashx it states that 37% of users don't know how to manage cookies. So, we've got implied consent where 37% of users don't know how to give consent.
This new law is fucking ludicrus, I generally block all cookies except certain websites, and one of the UK websites I visit has put a pink banner at the top warning about the cookie crap saying I will only see it once, but it relies on cookies to tell wether the banner has already been displayed, meaning it's ALWAYS there because I've blocked cookies on that site.
Who the fuck came up with the idea of using cookies to warn you about the use of cookies?
To do something right, you often have to roll up your sleeves and get busy.
FTA, " amusingly even the governments own websites aren't ready." I'd be in favor of an Eat-Your-Own-Dogfood law that stipulates that a) laws that apply to private businesses also apply to the government, and b) no law need be implemented by the private sector until implemented by the government.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
Normally these people are kept in warm environments with soft lighting so they can't hurt themselves and cannot be released into the environment because of the damage they would do. But when times are difficult Ministers are looking for good ideas and they get presented with the loony schemes. Inexperienced Ministers - and the current lot are almost all very inexperienced indeed - may get taken in, and so these schemes see the daylight.
Mrs. Thatcher, long may she rot, at least realised that the privatisation of streets and the railways were loony ideas too far. The next Government was inexperienced enough to fall for rail privatisation (unfortunately writing about at least one of the proponents of this here could result in a libel suit).
I do sometimes wonder if, in fact, a number of our Eastern European immigrants are former Stasi members under fake passports who are running the Home Office. But that might be unfair to the Stasi.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
Creating laws specific to the technology at hand seems like a complete nonsense to me. Today we use cookies in plain text headers of HTTP. Who knows what's going to be used as a standard in the future! If they use something else other than cookies, then it's OK to be tracked according to this law?
Julio Henrique Morimoto juliohm@gmail.com
Unless I'm mistaken, the relevany EU document is this and the relevant paragraph is:
In other words, the directive says that when a service tracks users, it should provide clear and comprehensive information about that in as user-friendly way as possible... And specifically says that methods such as users being able to select this in browser settings are fine... and that you don't need to explicitly tell them that you track them the way they expect such a service would track them.
The directive specifically says that user choosing this kind of things in browser settings is fine. Google respects the "don't track me" thing that browsers enable. Aside from that, I'm not sure that they need to do anything else.
If you care enough to lobby the government, you care nough to be able to find out how to disable cookies on your browser. Do I have to inform users that Apache saves logs?
most folks don't say "I think ...." simply because they are not in the practice of actually thinking.
if you saw a 2 foot high neon sign on a store stating "Everything Yogurt & Salad Cafe" would you think the place had icecream??
the number one question asked when i had that job: "Y'all have Icecream???"
Any person using FTFY or editing my postings agrees to a US$50.00 charge
In Sweden, we've had this law (in Sweden called Lagen om Elektronisk Kommunikation, LEK, the Law of Electronic Communication) for almost 9 years, more specifically since 25th of July 2003. When it was introduced, neither the government nor the police met the demands set by the law, and they were immediately facetiously reported to the police for it by a number of "concerned citizens", but they weren't charged. After a couple of months they'd implemented the necessary information on their web sites. I haven't heard of anyone having problems with the law (nor of anyone actually following it except the very large web sites), so probably the case law is quite reasonable.
How on God's green Earth can the UK govt. expect to enforce this? Most (or at least many) of the sites UK citizens visit are not based in the UK. Do they expect EVERYONE to adhere to there laws and regulations in this regard? What maroons!
Nobody's really sure what they meant when they wrote it. The wording doesn't make sense. Web developers don't have the legal background to understand it, and lawyers don't have the technical background to know what it's about. If my reading of it is correct, it requires an entirely new server architecture because apache cares way too much what's going on. At work, the head of legal couldn't tell me what kind of cookies are covered either. He said to "air on the side of caution" and remove all cookies. I explained to him what that means, and he said "I think it's just for e-commerce sites anyway." I truly hope that they don't try to make an example of us. We're huge, and we do a lot of business in the UK. And we're totally un-fucking-prepared.
This signature intentionally left blank.
a little editing here?
http://www.guardian.co.uk/technology/2012/may/26/cookies-law-changed-implied-consent
My council's CCTV system is most certainly under our control and not under any central control. The police do have appropriate access to it, but with council staff (who are more directly subject to democratic accountability than the police) as gatekeepers.
We could close the system down tomorrow if we wanted to, with no need to consult any "central control". It wouldn't do us any good at the next election, of course, as the punters like the cameras and keep asking for more.
It's not even possible to run a web server that doesn't track you with some kind of analytics.
It is trivial to run a web server without tracking. I click the “Web Sharing” check box in the Sharing preference pane. Done. I am now running a web server without tracking.
Mac OS X uses Apache as its web server. So it must be possible to configure Apache not to do tracking.
* It's reasonably clear (from most guidelines) that session cookies are fine, (because they are essential to functionality). Furthermore, implict consent is given by the act of logging in,
* Long term preference cookies "remember my name and my customisations" are also OK, though it's usually good practice to notfiy the user (the T&C is sufficient for this).
* Analytics cookies (eg Google Analytics) really should be covered by the directive, but basically aren't.
* Evil (cross site advertiser tracking cookies) ought to be exterminated...but these ones can simply be consented into, without really understanding.
To be sure that you aren't being tracked, we need to make a database to contain all those who don't want to be tracked.
Just for your convenience of course (and ours as well).
Time for the brits to vote all those mental retards out of office if they can, oh wait they can't.
you don't need some govt to tell ( companies | you ) what ( they | you ) can or can not do.
NO - you, the user, need to learn how to properly setup and use your browser.
Cookie-Whitelist in Mozilla Firefox setting up a cookie whitelist in Firefox requires no add-ons. It uses default functionality present in Firefox.