Slashdot Mirror
64 Complaints Received On UK Cookie Law
judgecorp writes "Privacy watchdog, the Information Commissioner's Office, has already received 64 complaints under the UK's Cookie Law, which requires sites to get permission to track users with cookies. The law only came into effect on Saturday, and many sites do not expect to comply soon. To make life more complicated, the ICO has updated its advice, apparently allowing 'implied consent' instead of actually making a user click a box to give permission for cookies."
"Implied Consent" is nothing more than a way to skirt responsibility of law. If THEY can do it, then so can we.
They've actually received several million complaints, but only had a 6 bit counter.
to see this fabulous girl naked. And to accept cookies from our 100 affiliate analytics firms
How does one opt out of cookies without using a cookie to remember it?
I bet all 64 complaints were made by web developers against the .gov.uk sites that are non compliant.
I just visited a link on the dailyrecord.co.uk and received some kind of cookie notice. The notice appeared as a pop up in the bottom right corner (the last place an english speaker will scan to) with text in pale grey. The notice was clearly designed to be difficult to notice. Even though I saw it pop up right away, I didn't have a chance to read the text or see which link to use to opt out before the notice disappeared. It was clear from the first sentence that if I did nothing I was consenting to be tracked.
I guess the law, which clearly had good intentions, has been eviscerated so that now the websites can just briefly display a hard to notice blob of text, remove it before you have a chance to read it, and continue tracking you with impunity.
The law was causing havoc for retailers and given that there was no clear guidance on how to handle this, we have a host of implementations, from the BBC which embodies the spirit of the law as it was originally written, to the Financial Times and BT which are using weasel ways (bottom of page, fades out straight away), to Google (which has essentially ignored the guidance).
The ICO, faced with overwhelming discontent from large retailers and retail associations, caved and has essentially ensured the status quo. By allowing implied consent, you can essentially pretend the law does not exist, and the minimum amount of work for a retailer is to include a page buried in the site map, telling you how to turn off cookies entirely in IE.
The law as it was written is actually the problem here. The intention of the law was to restrict the harvesting of user data, be it for behavioural advertising, or for more nefarious reasons.
However, the law was written far too broadly (surprise, surprise), and covered every method a site has of interacting with a browser, which lead to massive confusion about how to handle session cookies, shopping carts, etc.
If the ICO wants to do this properly, amend the law so that it covers the original intentions of stopping third party cookies tracking people round the internet, clarify that first party cookies are fine for handling website functionality[1], and then use their powers to punish the people who break the rules.
[1] Yes, I know there is a way of still using first party cookies as a third party operator and continue to happily track people, but that would fall under "breaking the rules" and get slapped...
Full Disclosure : I worked on our implementation of this law as an integrator for many large multinational retailers.