6 ms·

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodically to help maintain and improve our Web Site and enforce our online service polices. ACM only uses analytical cookies and does not use any user-specific targeting cookies. > A cookie is a small file of letter and numbers that is placed on your device. Cookies are only set by ACM when you visit restricted portions of our Web Site and help us to provide you with an enhanced user experience. Raw log files are treated as confidential. So... not sure why a public portion of their website straight-up won't load without them. They're clearly not only checking/setting cookies on certain pages, otherwise they wouldn't know that my cookies were disabled.

shadowgovt 6y ago
It took some digging, but if you go to https://www.acm.org/privacy-policy https://www.acm.org/privacy-policy, the "this website uses cookies" banner at the bottom includes a selector to choose which ones are used, and "necessary" is auto-selected. Expanding the "Show details" panel along the selector shows which cookies are considered necessary, and it looks like it's part of their Cloudflare attack protection system (__cfduid), their load balancing schema (AWSALBCORS), the cookie storing the status of your cookie consent (hah, ironic) (CookieConsent). But then there are some that I wouldn't personally consider necessary, such as two Bloomberg-vended cookies that appear to mirror the consent information to Bloomberg's servers, a Swiftype tracking pixel, a YouTube cookie to estimate the user's bandwidth for optimizing video loading, and some suspiciously-opaque BACKEND and sessionState cookies. In general, it's unfortunate their page doesn't degrade gracefully if cookies are disabled (though that's not always possible; for example, you can't assume that traffic Cloudflare can't analyze for trust is trusted... but those BACKEND and sessionState cookies being mandatory feels lazy).
that_guy_iain 6y ago
One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.
- satellite2 6y ago
  It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.
  - that_guy_iain 6y ago
    There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.
    - cdrx 6y ago
      To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.
      - that_guy_iain 6y ago
        Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower. And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand. If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/#:~:text=PECR%20are%20the%20Privacy%20and,the%20e%2Dprivacy%20Directive https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.
dheera 6y ago
Why does a site even get to know when cookies are disabled? I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.
- satellite2 6y ago
  Your system wouldn't prevent detection as a simple fixed cookie on the landing page and a redirect on a robot prohibited page, with js on this page expecting the cookie and you get yourself a detection mechanism. (Note that you could also check server side on the redirection page) I believe (but I cannot formally prove it) that it's actually impossible to prevent detection. It's a bit similar to private browsing mode (which in that case should in theory not be detectable) but has revealed to be a challenging problem.
- hansvm 6y ago
  Detection is hard (impossible for arbitrary JS) if the cookie isn't physically stored somewhere (at least in memory). That said, I think cookie auto deletion basically satisfies that use case? I personally have cookies set to wipe when I close my browser, and I close my browser fairly frequently. That's not quite as often as you're suggesting though.
DangitBobby 6y ago
Maybe they found a loophole. If you make your website stop working without what are otherwise unnecessary cookies, suddenly the cookies are essential.

shadowgovt 6y ago

It took some digging, but if you go to https://www.acm.org/privacy-policy https://www.acm.org/privacy-policy, the "this website uses cookies" banner at the bottom includes a selector to choose which ones are used, and "necessary" is auto-selected. Expanding the "Show details" panel along the selector shows which cookies are considered necessary, and it looks like it's part of their Cloudflare attack protection system (__cfduid), their load balancing schema (AWSALBCORS), the cookie storing the status of your cookie consent (hah, ironic) (CookieConsent). But then there are some that I wouldn't personally consider necessary, such as two Bloomberg-vended cookies that appear to mirror the consent information to Bloomberg's servers, a Swiftype tracking pixel, a YouTube cookie to estimate the user's bandwidth for optimizing video loading, and some suspiciously-opaque BACKEND and sessionState cookies. In general, it's unfortunate their page doesn't degrade gracefully if cookies are disabled (though that's not always possible; for example, you can't assume that traffic Cloudflare can't analyze for trust is trusted... but those BACKEND and sessionState cookies being mandatory feels lazy).

that_guy_iain 6y ago

One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.

satellite2 6y ago
It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.
- that_guy_iain 6y ago
  There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.
  - cdrx 6y ago
    To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.
    - that_guy_iain 6y ago
      Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower. And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand. If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/#:~:text=PECR%20are%20the%20Privacy%20and,the%20e%2Dprivacy%20Directive https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.

dheera 6y ago

Why does a site even get to know when cookies are disabled? I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.

satellite2 6y ago
Your system wouldn't prevent detection as a simple fixed cookie on the landing page and a redirect on a robot prohibited page, with js on this page expecting the cookie and you get yourself a detection mechanism. (Note that you could also check server side on the redirection page) I believe (but I cannot formally prove it) that it's actually impossible to prevent detection. It's a bit similar to private browsing mode (which in that case should in theory not be detectable) but has revealed to be a challenging problem.
hansvm 6y ago
Detection is hard (impossible for arbitrary JS) if the cookie isn't physically stored somewhere (at least in memory). That said, I think cookie auto deletion basically satisfies that use case? I personally have cookies set to wipe when I close my browser, and I close my browser fairly frequently. That's not quite as often as you're suggesting though.

DangitBobby 6y ago

Maybe they found a loophole. If you make your website stop working without what are otherwise unnecessary cookies, suddenly the cookies are essential.