3 ms·
The UK Information Commissioner's report on the coming legislation: http://www.ico.gov.uk/~/media/documents/library/Privacy_and_electronic/Practical_applicatio
by chalst 15y ago
The UK Information Commissioner's report on the coming legislation:
http://www.ico.gov.uk/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf http://www.ico.gov.uk/~/media/documents/library/Privacy_and_...
There is no requirement to ask for permission to issue cookies if the cookies are "strictly necessary" for the task, such as for logging into a user account or using a one-click -style purchase. I have the impression that it will principally affect user-tracking systems like Google Analytics and those used in targeted advertising.
Something about the law is unclear to me: the ICO's summary of the law seems only to apply if you store state about the cookie. If you insert Google's javascript to issue an Analytics cookie, doesn't that make it Google's problem, since they are storing the data about the cookie? Which would be kind of harsh, since they have no control of the web page's behaviour. But the ICO report talks of there being site owner's responsibility if they cause the data gathering to happen, which suggests that is the problem of the Analytics javascript embedder.
- Jaderberg 15y agoThats a good find. However "strictly necessary" is pretty vague. Tracking your own users on your site to optimise it for them would potentially be out of the question. Though if you sign up you could implicitly allow it with terms and conditions. Still doesn't help with anonymous users...
- chalst 15y agoI'm still reading the ICO report. It does talk at some length about what kind of measures are needed to comply with the coming legislation, and emphasises that the rule is about privacy protection, and that uses of cookies that don't build up a picture of users aren't what it targets. The legislation does look bad for startups whose business plan revolves around accumulating data on users or selling targeted ads, but the ICO report looks pretty aware of how cookies are used in practice and not at all the "ignorant intervention" that the article describes.
- chalst 15y ago"Implicitly allow it with terms and conditions" The ICO report says that is fine, provided that it is (i) sufficiently informative and (ii) you provide an update to existing users about the change in terms. I'm wondering about the following: what if I wrote a bit of Javascript serving up a picture of a pile of cookies during normal use, which can be clicked on to to call up a pop-up window describing how my site makes use of customer-tracking software with a dialog allowing the user to switch to untracked mode. Untracked mode could be implemented by issuing -you guessed it- a cookie, but one which is only used to check that the user opts out, and so is "strictly necessary" for this approach. It's sailing close to the wind: there's no positive act of consent; but by making it easy to see the state of privacy and change it, it is arguably more privacy-friendly than a T&C. I'm tempted to try it on my site and get feedback. The ICO report also talks about use of browser settings to govern privacy.
- dave1010uk 15y agoPage 4, section "What will happen to me if I don’t do anything?": > In light of this if the ICO were to receive a complaint about a website, we would expect an organisation's response to set out how they have considered the points above and that they have a realistic plan to achieve compliance. So basically compliance isn't required, just a plan to achieve compliance. "Our realistic plan is to implement an invasive po-pup sometime within the next 3 centuries."
- chalst 15y agoI interpreted that as describing their response to the first raising of a complaint, not a limit on the measures ultimately available to them.