6 ms·

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie c

by rdancer 10y ago

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.

nailer 10y ago
So a regular site using, say, mixpanel doesn't need to show a warning?
- com_kieffer 10y ago
  No, from my understanding cookies are allowed by default only if they are essential to the function of the site. If you only use the cookie to handle logins and sessions then you don't need the warning. I you use the cookie for tracking or analytics then you need the warning. Note that you can use your webserver logs for analytics and that doesn't require the cookie banner.
  - rdancer 10y ago
    > Note that you can use your webserver logs for analytics and that doesn't require the cookie banner In the EU, tracking user IPs actually requires consent. Even logging them does.
- kuschku 10y ago
  If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you refuse to be tracked.
  - JohnTHaller 10y ago
    Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well better be third party analytics.
    - rdancer 10y ago
      The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.
      - carlesfe 10y ago
        What do you mean with "The stupidity is 100% with the web devs and customers"? The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.
        rdancer 10y ago
        Which law? The 2002/58/EC doesn't.
        carlesfe 10y ago
        Not that one. http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32009L0136 http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:320... Complete law: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32009L0136&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... Paragraph 66 talks about cookies. A later exception was made by the EU for session cookies. Guidelines for webmasters: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_4 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se... It has a sample banner which is similar to those which most users display. Spanish official directives (with further protection because of a local law called LSSI): https://www.agpd.es/portalwebAGPD/canaldocumentacion/publicaciones/common/Guias/Guia_Cookies.pdf https://www.agpd.es/portalwebAGPD/canaldocumentacion/publica..., page 17. Also comes with a sample banner Did you really think that everyone else was wrong or didn't read the law and is programming these banners as some sort of fad?
  - carlesfe 10y ago
    That's true. The implementation differs on the country, for example in the UK it is enough to just show the annoying banner. Here in Spain you cannot set any tracking cookie (i.e. Analytics) without explicit consent. Of course, governmental websites totally break this law: http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html However, OP is right, governments spy on our webcams and analyze our traffic, and that's ok, but we need a stupid banner that overrides browser preferences to avoid all but session cookies. Duh.
  - nailer 10y ago
    Yeah that's how I understood it. Sounds like the op who said EU directive isn't interested in regular use is wrong.
- rdancer 10y ago
  If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO itself briefly used consent overlays, but does not anymore (EDIT: Aaaaand they've apparently use them again; I'll try to find the policy release where they say this is not necessary.). Cookies not used for tracking of persons never needed any consent, as they have no privacy implications. People who make their living creating cargo-cult UI designs, have predictably added cargo-cult law-compliance to their toolset. It is beyond stupid. [1] https://ico.org.uk/ https://ico.org.uk/
  - shawnz 10y ago
    I see a consent overlay on that very page.
    - rdancer 10y ago
      Thank you for pointing that out. I'll try to find the policy release where they say this is not necessary.
  - lucb1e 10y ago
    > If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. Wrong. If I disable cookies in my browser, I can't log in to websites anymore, so they need to be allowed. A whitelist would be very inconvenient. On top of that, it's not explicit allowance, it'd be implicit (i.e. opt-out instead of opt-in). I don't know if British legislation is different, but this is illegal at least in the Netherlands.
    - rdancer 10y ago
      You can enable session cookies only, even in the current UIs. Ditto for third-party cookies. Duplicating UI in a website is a solution looking for a problem. The web devs can nag the 0.01% who don't have cookies enabled, and leave the 99.99% who have them enabled alone. It has never been enforced that way to my knowledge, anywhere in the EU. Which law or court decision says that it is actually illegal?
mpeg 10y ago
And there's already been an opinion to extend 2002/58/EC to fingerprinting[0] [0]: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf http://ec.europa.eu/justice/data-protection/article-29/docum...
sleepychu 10y ago
If you consent to the way things have always been, do nothing!

by rdancer 10y ago

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.

nailer 10y ago

So a regular site using, say, mixpanel doesn't need to show a warning?

com_kieffer 10y ago
No, from my understanding cookies are allowed by default only if they are essential to the function of the site. If you only use the cookie to handle logins and sessions then you don't need the warning. I you use the cookie for tracking or analytics then you need the warning. Note that you can use your webserver logs for analytics and that doesn't require the cookie banner.
- rdancer 10y ago
  > Note that you can use your webserver logs for analytics and that doesn't require the cookie banner In the EU, tracking user IPs actually requires consent. Even logging them does.
kuschku 10y ago
If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you refuse to be tracked.
- JohnTHaller 10y ago
  Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well better be third party analytics.
  - rdancer 10y ago
    The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.
    - carlesfe 10y ago
      What do you mean with "The stupidity is 100% with the web devs and customers"? The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.
      - rdancer 10y ago
        Which law? The 2002/58/EC doesn't.
        carlesfe 10y ago
        Not that one. http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32009L0136 http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:320... Complete law: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32009L0136&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... Paragraph 66 talks about cookies. A later exception was made by the EU for session cookies. Guidelines for webmasters: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_4 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se... It has a sample banner which is similar to those which most users display. Spanish official directives (with further protection because of a local law called LSSI): https://www.agpd.es/portalwebAGPD/canaldocumentacion/publicaciones/common/Guias/Guia_Cookies.pdf https://www.agpd.es/portalwebAGPD/canaldocumentacion/publica..., page 17. Also comes with a sample banner Did you really think that everyone else was wrong or didn't read the law and is programming these banners as some sort of fad?
- carlesfe 10y ago
  That's true. The implementation differs on the country, for example in the UK it is enough to just show the annoying banner. Here in Spain you cannot set any tracking cookie (i.e. Analytics) without explicit consent. Of course, governmental websites totally break this law: http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html However, OP is right, governments spy on our webcams and analyze our traffic, and that's ok, but we need a stupid banner that overrides browser preferences to avoid all but session cookies. Duh.
- nailer 10y ago
  Yeah that's how I understood it. Sounds like the op who said EU directive isn't interested in regular use is wrong.
rdancer 10y ago
If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO itself briefly used consent overlays, but does not anymore (EDIT: Aaaaand they've apparently use them again; I'll try to find the policy release where they say this is not necessary.). Cookies not used for tracking of persons never needed any consent, as they have no privacy implications. People who make their living creating cargo-cult UI designs, have predictably added cargo-cult law-compliance to their toolset. It is beyond stupid. [1] https://ico.org.uk/ https://ico.org.uk/
- shawnz 10y ago
  I see a consent overlay on that very page.
  - rdancer 10y ago
    Thank you for pointing that out. I'll try to find the policy release where they say this is not necessary.
- lucb1e 10y ago
  > If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. Wrong. If I disable cookies in my browser, I can't log in to websites anymore, so they need to be allowed. A whitelist would be very inconvenient. On top of that, it's not explicit allowance, it'd be implicit (i.e. opt-out instead of opt-in). I don't know if British legislation is different, but this is illegal at least in the Netherlands.
  - rdancer 10y ago
    You can enable session cookies only, even in the current UIs. Ditto for third-party cookies. Duplicating UI in a website is a solution looking for a problem. The web devs can nag the 0.01% who don't have cookies enabled, and leave the 99.99% who have them enabled alone. It has never been enforced that way to my knowledge, anywhere in the EU. Which law or court decision says that it is actually illegal?

mpeg 10y ago

And there's already been an opinion to extend 2002/58/EC to fingerprinting[0] [0]: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf http://ec.europa.eu/justice/data-protection/article-29/docum...

sleepychu 10y ago

If you consent to the way things have always been, do nothing!