4 ms·

So this law was passed without any technical solutions in place what so ever? It seems they completely ignored the tech community on this. http://www.bbc.co.uk

So this law was passed without any technical solutions in place what so ever? It seems they completely ignored the tech community on this. http://www.bbc.co.uk/news/technology-13541250 http://www.bbc.co.uk/news/technology-13541250

chalst 15y ago
I think it was not so much that the community was ignored, but that the law was passed under unusual circumstances: usually the lobbyists inform the legislators, who defer to industry on the specifics. Here the lobbyists mostly hated the legislation, but legislators were more responsive to privacy activists because of widespread public concern. So the law is a triumph of democracy over technocracy. And I think that's reflected in the legislation. The principles are OK, but the detail does not match up with practice. Hence the law is some way from being something workable. It is well worth reading the ICO report: http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf http://www.ico.gov.uk/for_organisations/privacy_and_electron...
- yuhong 15y ago
  Yea, I think the problem here is lack of technical competence of legislators.
- extension 15y ago
  Ah, judging by that report, the law really seems quite reasonable. Basically, if the user explicitly requests some functionality, like creating an account or saving a preference, and you need a cookie to do that, you don't have to ask permission to set it. If you want to do anything else with the cookie, you have to get informed consent and the practical way to do that is by making it part of the request e.g. adding an explanation and checkbox to the signup or preferences page. Naturally, the more you want to do with the cookie, the more you have to explain to the user. So effectively, you get to track users in exchange for their engagement with your site, and you have to (gasp) tell them exactly how you are tracking them.
extension 15y ago
The solution is: a) stop using analytics and ads that set cookies or b) put an annoying dialog on your site. I have to do some more research before I decide for sure where I stand on this issue, but I strongly suspect that the tech community is indulging in a little entitlement here. As important as cookie tracking is to web developers, the vast majority of voting citizens do not believe they are deriving any value from it and do believe that it is a potential threat to their privacy. These beliefs seem reasonable to me. It may be a financial blow to web businesses but I don't think it hurts any of the things that make the web valuable to people at large. This is the kind of democracy that people scream for here: listening to citizens and citizens only. It kind of sucks when you are the corporate special interest being trampled on.
- ehutch79 15y ago
  actually, it hurts consumers, alot. without cookies, we won't have google analytics, or any of the major analytics packages. we therefore wouldn't know about things like screen resolutions, etc. so we'd have to design to the lowest common denominator possible, because we wouldnt know that only 1% of visitors have 800x600 screens now. we also wouldnt be able to track conversion goals, which you seem to think is some kind of profiteering, but it's not just for ecommerce checkouts used in tutorials. for example i can use it to find out where people are hitting snags adding events to a community events calendar which i wouldnt consider a corporate special interest at all. and what do we do about frameworks that automatically set a session cookie? they arn't just used on corporate websites. also, i think you'll find that most corporate special interests try to minimize the numer of cookies set anyway, because when you compound a few bytes of cookies saved over a million visits, it's a large savings on bandwidth bills. not so much for cheaply developed local sites for non-profits and community groups.
  - Isofarro 15y ago
    > we won't have google analytics, or any of the major analytics packages. weblogs analytics packages have been around since the beginning of the Web. > we therefore wouldn't know about things like screen resolutions, etc. You don't need cookies to record browser capabilities. A smidgen of JavaScript and an endpoint of some sort, and you are there. > so we'd have to design to the lowest common denominator possible, because we wouldnt know that only 1% of visitors have 800x600 screens now. This is a hysterial overreaction. Or think about concepts like Media Queries, and Responsive Design. (You can haterz the name, but the principle is useful and appropriate). > we also wouldnt be able to track conversion goals, Don't your conversion goals have completion pages? Are you not able to add meta information to your links that record this information? Third party tools mostly require JavaScript anyway, so there's nothing impossible there. > and what do we do about frameworks that automatically set a session cookie? Don't store information in the corresponding server-side session that isn't essential to providing a service. > think you'll find that most corporate special interests try to minimize the numer of cookies set anyway My anecdotal evidence differs from yours. I find the use of random third party analytics and ad tracking tools, plus on page cookies mean they set loads of cookies. Winnowing that down to a small number, like one per type/duration would help. Corporate interests in the UK don't care about saving bytes.

chalst 15y ago

I think it was not so much that the community was ignored, but that the law was passed under unusual circumstances: usually the lobbyists inform the legislators, who defer to industry on the specifics. Here the lobbyists mostly hated the legislation, but legislators were more responsive to privacy activists because of widespread public concern. So the law is a triumph of democracy over technocracy. And I think that's reflected in the legislation. The principles are OK, but the detail does not match up with practice. Hence the law is some way from being something workable. It is well worth reading the ICO report: http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf http://www.ico.gov.uk/for_organisations/privacy_and_electron...

yuhong 15y ago
Yea, I think the problem here is lack of technical competence of legislators.
extension 15y ago
Ah, judging by that report, the law really seems quite reasonable. Basically, if the user explicitly requests some functionality, like creating an account or saving a preference, and you need a cookie to do that, you don't have to ask permission to set it. If you want to do anything else with the cookie, you have to get informed consent and the practical way to do that is by making it part of the request e.g. adding an explanation and checkbox to the signup or preferences page. Naturally, the more you want to do with the cookie, the more you have to explain to the user. So effectively, you get to track users in exchange for their engagement with your site, and you have to (gasp) tell them exactly how you are tracking them.

extension 15y ago

The solution is: a) stop using analytics and ads that set cookies or b) put an annoying dialog on your site. I have to do some more research before I decide for sure where I stand on this issue, but I strongly suspect that the tech community is indulging in a little entitlement here. As important as cookie tracking is to web developers, the vast majority of voting citizens do not believe they are deriving any value from it and do believe that it is a potential threat to their privacy. These beliefs seem reasonable to me. It may be a financial blow to web businesses but I don't think it hurts any of the things that make the web valuable to people at large. This is the kind of democracy that people scream for here: listening to citizens and citizens only. It kind of sucks when you are the corporate special interest being trampled on.

ehutch79 15y ago
actually, it hurts consumers, alot. without cookies, we won't have google analytics, or any of the major analytics packages. we therefore wouldn't know about things like screen resolutions, etc. so we'd have to design to the lowest common denominator possible, because we wouldnt know that only 1% of visitors have 800x600 screens now. we also wouldnt be able to track conversion goals, which you seem to think is some kind of profiteering, but it's not just for ecommerce checkouts used in tutorials. for example i can use it to find out where people are hitting snags adding events to a community events calendar which i wouldnt consider a corporate special interest at all. and what do we do about frameworks that automatically set a session cookie? they arn't just used on corporate websites. also, i think you'll find that most corporate special interests try to minimize the numer of cookies set anyway, because when you compound a few bytes of cookies saved over a million visits, it's a large savings on bandwidth bills. not so much for cheaply developed local sites for non-profits and community groups.
- Isofarro 15y ago
  > we won't have google analytics, or any of the major analytics packages. weblogs analytics packages have been around since the beginning of the Web. > we therefore wouldn't know about things like screen resolutions, etc. You don't need cookies to record browser capabilities. A smidgen of JavaScript and an endpoint of some sort, and you are there. > so we'd have to design to the lowest common denominator possible, because we wouldnt know that only 1% of visitors have 800x600 screens now. This is a hysterial overreaction. Or think about concepts like Media Queries, and Responsive Design. (You can haterz the name, but the principle is useful and appropriate). > we also wouldnt be able to track conversion goals, Don't your conversion goals have completion pages? Are you not able to add meta information to your links that record this information? Third party tools mostly require JavaScript anyway, so there's nothing impossible there. > and what do we do about frameworks that automatically set a session cookie? Don't store information in the corresponding server-side session that isn't essential to providing a service. > think you'll find that most corporate special interests try to minimize the numer of cookies set anyway My anecdotal evidence differs from yours. I find the use of random third party analytics and ad tracking tools, plus on page cookies mean they set loads of cookies. Winnowing that down to a small number, like one per type/duration would help. Corporate interests in the UK don't care about saving bytes.