5 ms·

As far as I recall, the EU cookie law is a bit more global than that: a website needs to get permission/consent whenever it wants to store/retrieve information

by slau 9y ago

As far as I recall, the EU cookie law is a bit more global than that: a website needs to get permission/consent whenever it wants to store/retrieve information from the visitor's browser---this isn't just limited to tracking. This means that every single website hosted in Europe/targeted at a European audience need to request the authorisation to use the user's browser storage. A number of websites formulate this as "By continuing to use this website, you agree that we will access your cookies," accompanied with a "Dismiss" button, but that's not really what the spirit of the law is. DNT didn't change anything to this, as it was meant for a completely different use. I'd even say using DNT for this is a complete hack, which sort of misses the point of both the cookie law and DNT. You are, however, completely right that it is stupid beyond ridicule that you technically can't store the fact that a user doesn't want cookies on the browser. Edit: paragraph formatting.

detaro 9y ago
Not all information, only those that are not strictly necessary to provide the service (so e.g. a basic session cookie created once a user logs in or starts using the shopping cart, ... should not require consent)
- slau 9y ago
  Interesting, wasn't aware of that distinction. As it turns out, there's quite a few exceptions[1]. Thanks for correcting me! [1]: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_2 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...
Eldarrion 9y ago
> You are, however, completely right that it is stupid beyond ridicule that you technically can't store the fact that a user doesn't want cookies on the browser. Yes you can, it's pretty simple to do. Add a timestamped entry into your database to not show that notification to the IP address the user comes from, then run a script every minute that clears out entries older than an hour. Granted, if you go back to the website an hour later, it would still pop up the request to access cookies but it certainly beats having it pop up on every page load.

by slau 9y ago

detaro 9y ago

Not all information, only those that are not strictly necessary to provide the service (so e.g. a basic session cookie created once a user logs in or starts using the shopping cart, ... should not require consent)

slau 9y ago
Interesting, wasn't aware of that distinction. As it turns out, there's quite a few exceptions[1]. Thanks for correcting me! [1]: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_2 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...

Eldarrion 9y ago

> You are, however, completely right that it is stupid beyond ridicule that you technically can't store the fact that a user doesn't want cookies on the browser. Yes you can, it's pretty simple to do. Add a timestamped entry into your database to not show that notification to the IP address the user comes from, then run a script every minute that clears out entries older than an hour. Granted, if you go back to the website an hour later, it would still pop up the request to access cookies but it certainly beats having it pop up on every page load.