3 ms·

I would like to present to the court exhibit 1: The EU/ or UK "Cookie Laws" AKA "ePrivacy directive." In the months before and after its implementation there w

I would like to present to the court exhibit 1: The EU/ or UK "Cookie Laws" AKA "ePrivacy directive." In the months before and after its implementation there was a lot of discussion around the (vast) grey areas in the laws. After some months, the internet has coalesced on answers. All sites need to implement a nag screen for unknown users, in order to get "informed consent". This consent will be stored as a cookie and users should not delete cookies, or we will have to nag you next time you visit. We will also create a cottage industry of "compliance" specialists that will help you with the language of your nag screens and TCs. Websites got slightly more annoying. Two-bit consultants made some money. User privacy was not improved in any way.Legislation regulating the internet is tricky business.

oneeyedpigeon 9y ago
I've never heard a peep from anyone about the site I admin which still doesn't have one of those cookie-naggers. Hopefully, when the UK leaves the EU, the one good thing that might come out of it will be getting rid of that silly legislation.
- Symbiote 9y ago
  It would have been better if more had been required. "As you browse this site, a record of everywhere you click is sent to the following companies: Google, Facebook, MysteryAdNetwork. These companies use this information to sell targetted advertising. We use the data to inform improvements to the site."
- Freak_NL 9y ago
  If you're getting this kind of idiotic legislation in return, the net result does not appear positive.
  - oneeyedpigeon 9y ago
    Don't get me wrong: the net result is definitely not positive as far as I'm concerned!
corney91 9y ago
>All sites need to implement a nag screen for unknown users It wasn't all sites though, it was just sites that use third-party tracking and things like that, you didn't need a nag screen if the cookie was part of the functionality of the site eg a website with a login screen[1]. Everyone just copied everyone else with adding a nag screen for all sites because nobody actually read the rules. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
- rimliu 9y ago
  What you say is true only for session cookies. From the linked document: > first‑party persistent cookies DO require informed consent.
  - corney91 9y ago
    True, but the "remember me" checkbox is sufficient consent: > Persistent login cookies which store an authentication token across browser sessions are not exempted under CRITERION B. This is an important distinction because the user may not be immediately aware of the fact that closing the browser will not clear their authentication settings. They may return to the website under the assumption that they are anonymous whilst in fact they are still logged in to the service. The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case.
Reason077 9y ago
The most bonkers thing about the "EU cookie law" is that it could have been much more effectively implemented by simply requiring browser makers to get informed consent on cookies. This would have been both more effective (because rogue websites wouldn't have been able to avoid it) and less annoying for users, because consent could be given using a consistent UI for every website. Not to mention the many hours of lost/wasted productivity caused by requiring websites to implement the same dumb cookie consent UI over and over again. Much like the EU's failed air pollution rules, while there's a grain of good intent behind them, the actual implementation is just broken and pointless, and does more harm than good.
- dalbasal 9y ago
  I agree, though in that case I'm not sure the UK/EU legislature would have been needed at all. It also doesn't address the part of the problem that they were trying to address in the first place, limiting cookie use to where/when it is most essential. Realistically, you can see if informed consent is being achieved if the number of sites with ad/tracking software installed drops. "would you like us to keep tabs on you on behalf of FB's advertising platform?"

oneeyedpigeon 9y ago

I've never heard a peep from anyone about the site I admin which still doesn't have one of those cookie-naggers. Hopefully, when the UK leaves the EU, the one good thing that might come out of it will be getting rid of that silly legislation.

Symbiote 9y ago
It would have been better if more had been required. "As you browse this site, a record of everywhere you click is sent to the following companies: Google, Facebook, MysteryAdNetwork. These companies use this information to sell targetted advertising. We use the data to inform improvements to the site."
Freak_NL 9y ago
If you're getting this kind of idiotic legislation in return, the net result does not appear positive.
- oneeyedpigeon 9y ago
  Don't get me wrong: the net result is definitely not positive as far as I'm concerned!

corney91 9y ago

>All sites need to implement a nag screen for unknown users It wasn't all sites though, it was just sites that use third-party tracking and things like that, you didn't need a nag screen if the cookie was part of the functionality of the site eg a website with a login screen[1]. Everyone just copied everyone else with adding a nag screen for all sites because nobody actually read the rules. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

rimliu 9y ago
What you say is true only for session cookies. From the linked document: > first‑party persistent cookies DO require informed consent.
- corney91 9y ago
  True, but the "remember me" checkbox is sufficient consent: > Persistent login cookies which store an authentication token across browser sessions are not exempted under CRITERION B. This is an important distinction because the user may not be immediately aware of the fact that closing the browser will not clear their authentication settings. They may return to the website under the assumption that they are anonymous whilst in fact they are still logged in to the service. The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case.

Reason077 9y ago

The most bonkers thing about the "EU cookie law" is that it could have been much more effectively implemented by simply requiring browser makers to get informed consent on cookies. This would have been both more effective (because rogue websites wouldn't have been able to avoid it) and less annoying for users, because consent could be given using a consistent UI for every website. Not to mention the many hours of lost/wasted productivity caused by requiring websites to implement the same dumb cookie consent UI over and over again. Much like the EU's failed air pollution rules, while there's a grain of good intent behind them, the actual implementation is just broken and pointless, and does more harm than good.

dalbasal 9y ago
I agree, though in that case I'm not sure the UK/EU legislature would have been needed at all. It also doesn't address the part of the problem that they were trying to address in the first place, limiting cookie use to where/when it is most essential. Realistically, you can see if informed consent is being achieved if the number of sites with ad/tracking software installed drops. "would you like us to keep tabs on you on behalf of FB's advertising platform?"