25 ms·
UK websites place average of 44 cookies on first visit
- Tepix 12y agoFirst thing you should do when setting up a new browser is blocking third party cookies - unless you're using Safari which blocks them by default. The number of sites that don't work with 3rd party cookies is very small - whenever I run into one I usually use an alternative site or complain.
- graystevens 12y agoThis article alone places 9 on my system, plus a small lorry loads worth from .youtube.com due to the embedded video.
- creshal 12y agoGood thing we get header compression with HTTP/2, isn't it? /s
- bartkappenburg 12y agoSelf plug: we've developed cookie-checker.com. A way to check which cookies are placed with first time visitor. ico.org.uk places 3 cookies (1 session, 2 other valid up to today and 2017): http://www.cookie-checker.com/check-cookies.php?url=ico.org.uk http://www.cookie-checker.com/check-cookies.php?url=ico.org....
- omh 12y agoWhen I visit the ICO site I also get a "civicCookieControl" cookie which you don't list. I guess that this is probably coming from javascript and your site isn't processing this?
- bartkappenburg 12y agoIt's running a headless browser with JS enabled so it should be there... not sure why it doesn't pick it up. Thanks for the mention :-)
- LunaSea 12y agoIf you are running PhantomJs, did you encounter any issues like memory leaks and socket errors ? I'd be interested in the solutions you used to solve issues like that if it's not proprietary / private.
- ZirconCode 12y agoAlso interested, I've tried similar things with watir webdriver and a xvfb/headless mode but the only real 'solutions' I've come across are time-outs. Needless to say it could've been heaps better.
- LunaSea 12y agoI didn't do much testing since PhantomJS 2.0 but I know that in the past, it was recommended to reload PhantomJS every +/- 50 pages to free the leaked memory.
- bartkappenburg 12y agoWe're running HTMLUnit [1] [1] http://htmlunit.sourceforge.net/ http://htmlunit.sourceforge.net/
- dspillett 12y agoIt could also be that the cookies handed out vary geographically, or if a page includes adverts in iframes via an ad provider network the cookies you get will depend which member of the network your request is redirected to this time.
- equil 12y agohumorously, checking the site itself seems to trip it up: http://www.cookie-checker.com/check-cookies.php?url=cookie-checker.com http://www.cookie-checker.com/check-cookies.php?url=cookie-c...
- bartkappenburg 12y agothat's a feature ;-)
- heeen 12y agoyou can keep a whitelist of allowed permament/session/temporary cookies with https://addons.mozilla.org/en-US/firefox/addon/cslite-mod/ https://addons.mozilla.org/en-US/firefox/addon/cslite-mod/
- threedaymonk 12y agoThat sounds similar to Self-Destructing Cookies[1], which I'm using. Has anyone tried both and can compare them? 1. https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/en-US/firefox/addon/self-destruct...
- harshreality 12y agoThe advantage of selfdestructingcookies is that, without any intervention, it allows cookies while the site that set them is open in a tab, but once the tab is closed the cookies are promptly deleted (configurable delay). Same with Vanilla cookie manager on Chrome, except I don't think it deletes localstorage, flash cookies, etc because of limitations of Chrome's api for extensions. I think the attitude with Chrome is that you're supposed to use Incognito windows for this purpose.
- _lce0 12y agoI've been using Self-Destructing along with BetterPrivacy[1] which handles LSO (Flash cookies) that are usually not available in the browser 1. https://nc.ddns.us/extensions.html https://nc.ddns.us/extensions.html
- aikah 12y agoor you can block third party cookies all together. That's what I do, it's a simple setting on chrome.If it breaks a website well too bad,it shouldn't.
- troels 12y agoIt seems a bit disingenuous to present numbers like that. For the lay person, it may sound scary that there as 44 cookies on a given page, but that's a completely arbitrary measure. I would think that the important thing isn't the number of cookies, but rather what which entities they are shared with and to some extend the information attached to them. First party cookie for example are not a privacy issue at all.
- Drakim 12y agoIn my opinion it is actually pretty scary. As I see it, a website should upon landing either set zero or one cookie, depending on if the website has some sort of persistent functionality (like a message to first time visitors). The other 43 cookies are, in my view, therefore unnecessary to the normal functioning of the website, and is therefore more likely being used for other purposes such as tracking and advertising.
- andrewingram 12y agoI agree that a lot of functionality can be encapsulated in a session cookie. But for some cases it might not be worth the server overhead, ie language or currency selection for unregistered users.
- Drakim 12y agoI agree that if you start using the website, setting more cookies to remember choices and such is perfectly fine. I was referring to when you first land on the website, that first page load.
- andrewingram 12y agoAh yeah, my bad. I agree.
- mrweasel 12y agoSadly I think that a lot of businesses either don't care or don't think about the cookies and tracking added to their site. In my experience it's usually the marketing department that want much, not all, of the things that end up setting cookies. It's not that it's a bad idea necessarily, but it's adding tracking upon tracking upon tracking and rarely a request to remove something. Some sales person try to sell marketing "Yet another up-sell tool" or "customer retention solution" and no one considers that the site already have five of those tools installed, 3 of which isn't actually used anymore and the last two we aren't really sure of. I think it's a scam mostly, trying to convince businesses that they're leaving profit on the floor. The providers of these tools leave real businesses jumping from one tracking/data-mining/customer-spying to another in the hope that it will boost their sales by a few percent. Do we really need to know know that much about our customer? Probably not.
- deleted 12y ago[deleted]
- Sharlin 12y ago> That it simply means never expires I'm pretty sure that's exactly his point...
- gearhart 12y agoThis article is completely incompetent. Firstly - any number of cookies from a single domain are equivalent, you can always use whatever identifier is in the cookie's data to store and retrieve an arbitrary amount of data about the user. That there are lots of them implies either that the site is using a bunch of different front end libraries / components that don't talk to one another (which is irrelevant from a privacy perspective) or that more data is being stored/cached directly in the browser rather than being retrieved from a remote server which is the opposite of a privacy issue, since it's keeping your data in your browser. Secondly - cookies are one of: "session", "expiring", "perpetual". With the first set to expire when you close the browser, the second expiring at some period between now and when your browser/cache/computer/operating system gets wiped or replaced (i.e. ~<12 months) and the third expiring at any arbitrary date after that (i.e. anything with an expiration date of more than ~12 months is the same, who cares if it's two years or ten thousand). It's horrifying that this is a study paid for with public money and fed back to the public from a source purporting to be an expert. Edit: by saying "from a single domain" I'm expressly avoiding the differentiation between first and third-party cookies - it obviously makes a difference how many third parties you share data with, which defensibly has some relationship to the number of different domains that serve third party cookies on a site.
- Nursie 12y ago>> opposite of a privacy issue, since it's keeping your data in your browser. In a way instantly accessible to the host site. Data I wasn't really consulted about. Data I might not be comfortable sharing every time you ask for it. This whole law about disclosing cookie use, which I will agree is not necessarily a good approach to the problem, does nevertheless exist because of a problem - People getting tracked, followed and profiled without their permission. Website operators and browser-makers seemed to be complicit in this. Some website operators seem to think it's their god-given right to do whatever they want in the browser on my computer...
- jonatanheyman 12y agoAs a website owner I'm free to respond with any HTTP headers I feel like like when your computer makes a request. You're free to use a browser that doesn't decide to store cookies when you get a reply with those headers.
- JamesBaxter 12y agoGot a chuckle from the article alerting me to its use of cookies. http://i.imgur.com/3PIC1af.png http://i.imgur.com/3PIC1af.png
- blfr 12y agoEvil ad networks only need a handful of cookies to track you. They could probably go without cookies entirely, just by fingerprinting the browser. They have the resources and know-how. This happens because many webmasters build frankensites by copying and pasting snippets of code to get the functionality they need. Those load a bunch of resources from all over the net and dump a jar of cookies in your lap. It's the same laziness that makes devs set expiration to 9999. The popouts, or banners, with cookie information are a pointless annoyance, not an encouraging development.
- jfindley 12y agoNot disagreeing with what you say, but browser fingerprinting is a great deal less accurate than cookie-based tracking, so the ad networks would certainly like to retain a cookie on the client machine, if they can.
- DanBC 12y agoWhen cookies were first introduced a number of sensible people had reasonable concerns about privacy. I'm not sure how we got from there to here - a sub-optimal law and not-great research (81 sites?) all while companies aggressively collect and mine data.
- JustSomeNobody 12y agoLaziness and greed. But really, it's mostly laziness. If you tell someone cookies are 100% bad because they kill kittens, people won't use them unless they want to kill kittens. If you nebulously say that they might potentially be used to kill kittens at some point in the future, nobody cares.
- Padding 12y agoI never understood why cookies receive so much attention in various privacy discussions. They are the one thing the user has full control over. Yes it takes some effort to delete them, but so does looking left and right before crossing the street.
- Nursie 12y agoPart of the problem is that the browser just mindlessly goes along with it. We've got into a situation where the vast majority of users don't know and don't want to know about any of the details of what's going on, and by default most browsers just allow them to be tracked in a variety of different ways. Website writers/maintainers quite often don't know themselves what a framework is doing, and everyone writes using the assumption that cookies are something they can just use. It sometimes looks like everyone except the end user was involved in the development of the situation.
- deleted 12y ago[deleted]