4 ms·

Someone correct me if I'm entirely wrong, but I thought the point of the law was to stop third-party cookies being used to track users. That is, if you want to

by tow21 15y ago

Someone correct me if I'm entirely wrong, but I thought the point of the law was to stop third-party cookies being used to track users. That is, if you want to track your users - that's fine, use as many cookies as you like and don't ask anyone's permission. But it's your job to do the tracking, you can't outsource it to Google.

Silhouette 15y ago
> Someone correct me if I'm entirely wrong I'm afraid you are indeed entirely wrong. The rules are not specific to third party cookies. There are some very tight exemptions for cookies or similar technologies where their use is genuinely necessary to provide a requested service, such as for remembering that someone is logged in or the contents of a shopping cart. Anything outside that scope, including using the same cookies for tracking/advertising purposes, is against the rules without explicit user consent.
- tow21 15y ago
  Thanks. After reading the ICO's guidance, so it seems. I was, in fact entirely wrong. As someone elsethread pointed out, if this is taken seriously, people will just start browser fingerprinting. That at least means that the information is stored server-side rather than client-side, which the new directive seems particularly concerned about.
spjwebster 15y ago
The spirit of these regulations was undoubtedly to inhibit the practice of cross-site tracking using third party cookies or cookie-like technology. However, neither the EU directive nor the laws that implement it make a distinction between first and third-party cookies. They only distinguish between those that are "strictly necessary" (which I take to mean cookies that if you block them would prevent the site from functioning at all) and those that are not. Tracking within your own website for analytical purposes doesn't fall under the functional interpretation of "strictly necessary"; your site continues to function just fine if the Google Analytics beacon isn't fired, or can't distinguish between a first-time visitor and a repeat visitor or follow a particular user through the site. I have heard people argue that analytics are operationally strictly necessary; that we need some insight into the behaviour of site visitors in order to operate an online business effectively. There may be something in that interpretation, but I'm a lowly web architect, not a lawyer. As such, I would be wary of accepting this more lenient interpretation without significant input from someone more schooled in the laws of our land (or any land, for that matter) than I.

by tow21 15y ago

Silhouette 15y ago

> Someone correct me if I'm entirely wrong I'm afraid you are indeed entirely wrong. The rules are not specific to third party cookies. There are some very tight exemptions for cookies or similar technologies where their use is genuinely necessary to provide a requested service, such as for remembering that someone is logged in or the contents of a shopping cart. Anything outside that scope, including using the same cookies for tracking/advertising purposes, is against the rules without explicit user consent.

tow21 15y ago
Thanks. After reading the ICO's guidance, so it seems. I was, in fact entirely wrong. As someone elsethread pointed out, if this is taken seriously, people will just start browser fingerprinting. That at least means that the information is stored server-side rather than client-side, which the new directive seems particularly concerned about.

spjwebster 15y ago

The spirit of these regulations was undoubtedly to inhibit the practice of cross-site tracking using third party cookies or cookie-like technology. However, neither the EU directive nor the laws that implement it make a distinction between first and third-party cookies. They only distinguish between those that are "strictly necessary" (which I take to mean cookies that if you block them would prevent the site from functioning at all) and those that are not. Tracking within your own website for analytical purposes doesn't fall under the functional interpretation of "strictly necessary"; your site continues to function just fine if the Google Analytics beacon isn't fired, or can't distinguish between a first-time visitor and a repeat visitor or follow a particular user through the site. I have heard people argue that analytics are operationally strictly necessary; that we need some insight into the behaviour of site visitors in order to operate an online business effectively. There may be something in that interpretation, but I'm a lowly web architect, not a lawyer. As such, I would be wary of accepting this more lenient interpretation without significant input from someone more schooled in the laws of our land (or any land, for that matter) than I.