7 ms·

Spain begins disciplinary proceedings against site for violating Cookie Law

79 points by martinml 13y ago

martinml 13y ago
Sorry for submitting a Google Translate link. It's not doing a perfect job on a legal text but I didn't find any source in English. This is a blogpost of the lawyer taking this case, and the client name is unknown yet. Here's my summary of some facts (IANAL!): - The cookies being investigated are from Google Analytics, Google Maps, YouTube, Adsense and WordPress. - The website was setting the cookies in the browser and then showing a popup warning the user that the site used cookies and that if they didn't want them they could delete them. - The AEPD is a governmental organization which watches over personal data and privacy infringements. If a company infringes your rights as a citizen, you submit a complaint to the AEPD, and they can investigate and fine if necessary. - The AEPD states that the fine is imposed because the website should not set any cookies until the user had accepted the warning. - The Spanish law being used here is RD 12/2012, which was created using the 2009/136/CE EU Directive as its framework. - The fine is still not final. They can still present allegations.
- potatolicious 13y ago
  This is interesting. Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? My initial reaction is that this seems fair. The fine is substantial, but not deadly to an enterprise, so it would serve as a warning without being catastrophic for them. I'm not a EU citizen - but presumably the EU's rather strict laws re: cookies derives from privacy and a desire not to be tracked at all. A user who has accepted Google cookies from other sites need not submit to the same tracking cookie on your site - but even if you delete the cookie aftewards, presumably Google Analytics has already captured the visit. And there is, as far as I know, no way to remove that event from Google Analytics.
  - martinml 13y ago
    > Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? This is a very liberal translation of the relevant part of the law[0]: "Those who provide services will be allowed to use storage devices in remote computers, provided that the owners have given their consentment AFTER [my emphasis] they have been informed clearly and completely about the utilization of the private data". [0]: http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.html#a22 http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.h..., article 22.2.
    - mistercow 13y ago
      That sounds like technically the consent has to come after being informed, not the storage.
      - DerpObvious 13y ago
        But they may only use the storage once consent has been given, which can only happen after a warning has been issued. The two clauses seem to indicate that consent must be before storage, and warning before consent, hence there must be a warning /before/ the storage on the remote machine.
        potatolicious 13y ago
        In either case, storing the cookie before consent, in the Google context, seems to run directly counter to the intent and spirit of the law. I'm not big on technicalities. Normally I would put this in the "not a big deal" bucket, but in this case the specific cookies do not belong to the website itself. This means that you cannot retroactively "untrack" a user once they refuse your warning. If this was just the website's own cookie, and if the cookie could be deleted and all tracking data would vanish from the site's own backend, then I'd be inclined to give it a pass.
      - gcb0 13y ago
        "provided" means a condition. so in parsed order: 1. informed. 2. consent. 3. storage.
- ealexhudson 13y ago
  This is one of the most stupid and anti-user laws on the books. Worse, it's probably the only law I've ever seen have an instant and devastating effect on the UX of a swathe of websites. Hopefully they are going to start suing people regularly (unlike the inaction being taken in the UK) so that business wakes up to this stupid law and finally gets it repealed, the sooner the better.
  - deleted 13y ago
    [deleted]
  - kintamanimatt 13y ago
    Can it really be repealed by the Spanish government if they're required to enact such a law as a result of an EU Directive? They could take the UK's approach of turning a blind eye, but I tend to feel it's wrong for a country to pick and choose which laws to enforce.
    - walshemj 13y ago
      Well this is the EU and countrys ignore or adjust EU directives to suit all the time - Spains implementation of TUPE is a total FY to the eu has no relation to the Spirit of the Directive. Italy also does this a lot remember the you tube fiasco where they ignored EU law.
    - sergiosgc 13y ago
      The EU is a set of treaties between sovereign states. The Parliament in each state supercedes the EU bodies (commission and parliament namely). So, yes they can repeal the law. It violates the treaty, and they'll be fined, but that's about it.
      - kintamanimatt 13y ago
        Can Spain even afford such a fine?
        sergiosgc 13y ago
- albertoperdomo 13y ago
  Please also note that according to the post if the sites are hosted in third party platforms like Facebook, Tumblr, that install tracking cookies the owner of the site can still be sued, even if it's without his control. In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This is just Spanish law at it's best (I'm Spanish, too)
  - DerpObvious 13y ago
    > In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This just says that they're responsible for the effects of the services they contract, in addition to acts they undertake directly. Should a person building a bridge get out of the liability because they contracted out parts of the work? No. Neither should the operator of a website because they opted to use services provided from a third party for part (or all) of their web services.
  - icebraining 13y ago
    If you bought on an online store, an it used an insecure third-party payment provider which leaked your CC number all over the web, would you say the same?
- txutxu 13y ago
  A bit of fun about all this: The local government site of my spanish country, uses even javascript to record your mouse clicks in US (and cookies without advise, of course), pixel based tracking in case you block javascript, and more on the same line... And it has been said in their "opengob" sessions two years ago... and you know what? the local gov does not have any proceeding about their faults. The same than we have known grabbers (with proceedings that always finish the same), as politics and monarchy, which in turn, control the lawyers and the public security we pay (in the figurative sense of the word). It's not nice to be Spanish these days. A Spanish (writing from other country).
scrrr 13y ago
Is there an open source JavaScript snippet somewhere that I can put on my page and it shows a pop up prompting users to accept cookies?
- stingraycharles 13y ago
  There are several, with http://www.civicuk.com/cookie-law/index http://www.civicuk.com/cookie-law/index and http://silktide.com/cookieconsent http://silktide.com/cookieconsent being the most popular afaik.
- ealexhudson 13y ago
  If your server sends cookies automatically, it would fall foul of this Spanish implementation of the law (supposedly). Implied consent does not cover simply giving the users information, and some of the cookies being argued over are third-party too. There's no third-party snippet you can drop in and "fix" this for Google Analytics (for example).
- vicentereig 13y ago
  You actually need to avoid cookies getting stored until users give their consent to do so. Probably something like the rack-policy Ruby gem linked below will help making sure there is no cookies at all. https://github.com/peter-murach/rack-policy#rack-policy https://github.com/peter-murach/rack-policy#rack-policy I ignore if there are similar libraries for other platforms.
terhechte 13y ago
Is this message only required on commercial sites? Or do I need to display the cookie UI whenever I have any kind of html on the web that uses Google analytics (i.e. cookies)?
notatoad 13y ago
Has there been any work done at all to standardize this process and allow users to opt-in to cookies at a browser level, so that we can all stop seeing this stupid warning? would that even be allowed under the law? i tried to download a firefox extension called "cookiesOK", but it doesn't seem to work in most cases.
- ensmotko 13y ago
  The problem is that every site owner displays a slightly different popup. A few of my friends were trying to build a chrome extension[1], but they soon figured out they are going to need custom Javascript for every site in Slovenia (and others of course, but they were focusing on Slovenia) and they abandoned the project. Personally I believe EU should target browsers not site owners for this. At least by doing so we would get a standardized UI and the ability to opt-in or out. [1] https://chrome.google.com/webstore/detail/peeshkot/idfkeeahcifaocjonphgjmpmmfonahle?hl=en https://chrome.google.com/webstore/detail/peeshkot/idfkeeahc...
  - AJ007 13y ago
    One would assume that the act of visiting a web site, from a personally identifiable IP address, using a web browser that accepts cookies is an act of consent to receive those cookies. The behavior is both expected, avoidable, and blockable. This approach -- either by law, or by some "do not track" flag broadcast to web sites is the equivalent of walking through a busy city with hundred dollar bills hanging out of your pocket, with a sign hanging around your neck requesting that no one takes your money -- all when a simple wallet in your pocket would be adequate. There are serious privacy issues when it comes to the internet and tracking. The "solutions" we've seen targeting cookies in both the US & EU would be laughable if they did not threaten to add considerable legal obligations over even the most casual of web site owners.
    - icebraining 13y ago
      Expected? By whom? Technologists like us, yes, but not many of the general public. Walking around with $100s is a false analogy; accepting tracking cookies is completely invisible to the user. Furthermore, even if one does walk with $100s, theft is still illegal.
ripberge 13y ago
Yikes. I'm generally in favor of web privacy, but with unemployment numbers like theirs, that seems like the last thing Spain needs right now.
- albertoperdomo 13y ago
  I'm from Spain and I've been running a webdev shop for 6 years now. Things are getting worse here and the government if anything is actually just making things more difficult for everyone. I agree with those trying to protect their privacy but for the sake of practicality they should look for a pragmatic approach. BTW, making individuals and companies responsible for tracking cookies installed by third party platforms like Facebook, Tumblr, etc. because of this law doesn't really help us being more competitive either [sarcasm sign].
  - lingben 13y ago
    can you please explain a little bit more about this cookie law? the only one I heard about was the UK cookie law and it was abandoned months ago. which websites does it apply to? websites hosted in Spain? websites of commercial businesses operating in Spain? any website with an address in Spain?
    - paradoja 13y ago
      I'm not him, but I can try to answer you. It applies to any businesses, professionals with a web page, and anyone who offers a service as long as they a) are located in Spain, b) target their services to the Spanish market or c) if they have a (permanent or regular) workplace or facilities in Spain. (It's a translation from Spanish legalese, so probably the language is muddled, sorry.)
      - lingben 13y ago
        thanks. so by condition b that includes almost anyone on the internet!
vklj 13y ago
Actually, most warning implementations punish those users that disable cookies in their browsers by forcing them to see the obnoxious warning every time they visit the site. This is arguably worse than the previous situation.
- mindstab 13y ago
  ... This isn't some "punishment" this is how the internet works. If you opt out of being tracked and cookies... how would that be remembered? That is really a sign it's working. This is part of why this is such an amazingly defective law
  - pgeorgi 13y ago
    Some pages (eg. all that use the consent.truste.com script) use localStorage to store the decision. That way the decision remains client-side and can still be persistent by hiding the question via javascript.
    - notok22 13y ago
      This law applies to any kind of "data" stored on the client, so using localStorage to store the user's answer would be breaking the law. http://www.cookiepedia.co.uk/eu-cookie-law http://www.cookiepedia.co.uk/eu-cookie-law
      - pgeorgi 13y ago
        I don't remember the specifics. They could add a checkbox "store this decision locally", which would allow storing this single information - and localStorage is the best place to put it (unlike cookies).
lifeisstillgood 13y ago
I am surprised - isn't this what we want? Instead of secrecy, governments warn everyone they are being tracked online. And we moan about it. It wrecks the UI, it is annoying. Folks - this is the Snowden debate, but without the security services. Yes they should have got into the RFC / IEEE debates (which are fast becoming laws of their own), yes they should be doing it better. Yes they should stop monitoring everyone. But they are at least starting the debate. And not on an obscure tech forum, or in dusty volumes of proceedings, but right there, in everyone's face. And until we find a way to make privacy and surveillance and technology triggers in every politician's Skinner box, then its probably the best start we can get.
- bobsy 13y ago
  I agree that the one good thing this law has done is start a debate. On the downside it is negatively affecting how you interact with websites. Often before I can even determine if I am on the right website I get a pop up message before I can continue. Recently I was on a shopping site and I clicked no to the cookies thinking it would only stop tracking cookies. Was surprised when my cart wouldn't save. It is silly that this breaks the site's basic functionality. If anything browser vendors should be doing more. I do not think this can be done via legislation though. I also think prosecuting websites is silly. If these cookies are so toxic the companies running the services should be showing messages. For example. Analytics. Why is it that I need to "opt in" to this on every site with a pop up? Why can't I just click YES and be done with it when it comes to this service? You could then have non-tracking cookies essential to the running of the service exempt from this law.
- prof_hobart 13y ago
  It's not the Snowden debate, not by a long distance. Some cookies (like ad trackers) can be annoying/slightly disturbing, but even before the cookie law they were pretty obviously there and in most cases pretty easily opted out of already if you knew what you were doing. I don't remember seeing the "opt out of NSA surveillance" option anywhere in my browser or email client.
- albertoperdomo 13y ago
  The problem is that there is no debate about how to deal this in pragmatic terms. Instead, they are just issuing fines on businesses that are probably already having a hard time keeping themselves alive. The whole situation would be completely different it this would have been discussed in practical terms. They could have matured possible technical solutions for this and also made sure that big third party providers (Facebook, Tumblr, etc.) that host websites for EU businesses comply with this regulation, rather than making the business owner responsible. If you get a fine of €30K I bet you wouldn't call that a debate, correct?
devx 13y ago
Does this impact only sites hosted in EU? Or with a domain from an EU country?
- albertoperdomo 13y ago
  The actual implementation of the laws depend on the countries, but they are based on the same EU directive. AFAIK this applies to companies registered in those countries, or with an office there or targeting the market in those countries. So, to make things more difficult, the German law implementation might be different from the Spanis implementation. If you are targeting both markets, you'd need to pay close attention to both.
ogig 13y ago
Mentioned in the article: Spanish business using Facebook pages could be non compliant to this law. Same with others using wordpress, blogger, tumblr and so on since tracking cookies are been installed without a previous user acceptance. Also note that the business is liable for this, not the hosting service provider. I wonder how far hosting provider definition goes. If twitter is used in a company marketing strats, is it liable for the cookies installed by twitter? I don't see it different from the facebook pages cited example. The only practical option given this is to stop using those providers.
Kiro 13y ago
So if I'm outside of Spain I don't need to care about this?
- camus 13y ago
  if you are doing business anywhere in Europe you should.
  - Kiro 13y ago
    Care to elaborate? I thought the Cookie Law was dead.
nolanl 13y ago
The last place I worked was a Swiss organization that built web sites for the European Commission. Dealing with the EU cookies directive was an amazing waste of brain cells for everyone on the team. For instance, were we allowed to ignore it because we were Swiss (non-EU)? If not, which version of the law were we required to comply with? For instance, the UK implementation of the law says that you can assume "implied" consent if the user ignores your popup altogether. However, the Dutch version of the law is much stricter - the user must click "I accept" before you can save any cookies. And the French version of the law allows for lots of exceptions, e.g. for setting the user's preferred language. Plus, we needed a cookie just to store whether or not the user clicked "yes" or "no," so in effect we were forced to break the law no matter what we did. (The only alternative would be to show the "no" users the popup every time they came back to the site, since we were supposed to forget that they had even clicked "no"...) So all in all, it was a huge mess. In the end we just copy-pasted a JQuery plugin from GitHub and chose the strictest setting. Now our site is uglier, it's more confusing to users, and we still have to cross our fingers that we didn't miss a corner case in Bulgaria or something.
- gcb0 13y ago
  > Plus, we needed a cookie just to store whether or not the user clicked "yes" or "no," so in effect we were forced to break the law no matter what we did. this means you didnt' waste too much brain cells after all. if user clicks no, you either show it everytime, or set a session cookie, which is not supposed to be saved on disk per the specs. if the browser decide to save it on disk, it's their problem. But if you set a no cookie. then it's the typical governemnt contractor. Going the extra mile to bill for the law, but completely ignoring the law purpose and benefits.
joyinsky 13y ago
Don't the have anyhing more important to do? like, e.g.(creating the 6M jobs they desesperately need)
Uchikoma 13y ago
How does one store that a user opted out of cookies?
adcuz 13y ago
This is a shambles.
smoyer 13y ago
My web-sites will say - "This site uses cookies ... If you agree, please leave."

79 points by martinml 13y ago

Sorry for submitting a Google Translate link. It's not doing a perfect job on a legal text but I didn't find any source in English. This is a blogpost of the lawyer taking this case, and the client name is unknown yet. Here's my summary of some facts (IANAL!): - The cookies being investigated are from Google Analytics, Google Maps, YouTube, Adsense and WordPress. - The website was setting the cookies in the browser and then showing a popup warning the user that the site used cookies and that if they didn't want them they could delete them. - The AEPD is a governmental organization which watches over personal data and privacy infringements. If a company infringes your rights as a citizen, you submit a complaint to the AEPD, and they can investigate and fine if necessary. - The AEPD states that the fine is imposed because the website should not set any cookies until the user had accepted the warning. - The Spanish law being used here is RD 12/2012, which was created using the 2009/136/CE EU Directive as its framework. - The fine is still not final. They can still present allegations.

potatolicious 13y ago
This is interesting. Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? My initial reaction is that this seems fair. The fine is substantial, but not deadly to an enterprise, so it would serve as a warning without being catastrophic for them. I'm not a EU citizen - but presumably the EU's rather strict laws re: cookies derives from privacy and a desire not to be tracked at all. A user who has accepted Google cookies from other sites need not submit to the same tracking cookie on your site - but even if you delete the cookie aftewards, presumably Google Analytics has already captured the visit. And there is, as far as I know, no way to remove that event from Google Analytics.
- martinml 13y ago
  > Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? This is a very liberal translation of the relevant part of the law[0]: "Those who provide services will be allowed to use storage devices in remote computers, provided that the owners have given their consentment AFTER [my emphasis] they have been informed clearly and completely about the utilization of the private data". [0]: http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.html#a22 http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.h..., article 22.2.
  - mistercow 13y ago
    That sounds like technically the consent has to come after being informed, not the storage.
    - DerpObvious 13y ago
      But they may only use the storage once consent has been given, which can only happen after a warning has been issued. The two clauses seem to indicate that consent must be before storage, and warning before consent, hence there must be a warning /before/ the storage on the remote machine.
      - potatolicious 13y ago
        In either case, storing the cookie before consent, in the Google context, seems to run directly counter to the intent and spirit of the law. I'm not big on technicalities. Normally I would put this in the "not a big deal" bucket, but in this case the specific cookies do not belong to the website itself. This means that you cannot retroactively "untrack" a user once they refuse your warning. If this was just the website's own cookie, and if the cookie could be deleted and all tracking data would vanish from the site's own backend, then I'd be inclined to give it a pass.
    - gcb0 13y ago
      "provided" means a condition. so in parsed order: 1. informed. 2. consent. 3. storage.
ealexhudson 13y ago
This is one of the most stupid and anti-user laws on the books. Worse, it's probably the only law I've ever seen have an instant and devastating effect on the UX of a swathe of websites. Hopefully they are going to start suing people regularly (unlike the inaction being taken in the UK) so that business wakes up to this stupid law and finally gets it repealed, the sooner the better.
- deleted 13y ago
  [deleted]
- kintamanimatt 13y ago
  Can it really be repealed by the Spanish government if they're required to enact such a law as a result of an EU Directive? They could take the UK's approach of turning a blind eye, but I tend to feel it's wrong for a country to pick and choose which laws to enforce.
  - walshemj 13y ago
    Well this is the EU and countrys ignore or adjust EU directives to suit all the time - Spains implementation of TUPE is a total FY to the eu has no relation to the Spirit of the Directive. Italy also does this a lot remember the you tube fiasco where they ignored EU law.
  - sergiosgc 13y ago
    The EU is a set of treaties between sovereign states. The Parliament in each state supercedes the EU bodies (commission and parliament namely). So, yes they can repeal the law. It violates the treaty, and they'll be fined, but that's about it.
    - kintamanimatt 13y ago
      Can Spain even afford such a fine?
      - sergiosgc 13y ago
albertoperdomo 13y ago
Please also note that according to the post if the sites are hosted in third party platforms like Facebook, Tumblr, that install tracking cookies the owner of the site can still be sued, even if it's without his control. In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This is just Spanish law at it's best (I'm Spanish, too)
- DerpObvious 13y ago
  > In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This just says that they're responsible for the effects of the services they contract, in addition to acts they undertake directly. Should a person building a bridge get out of the liability because they contracted out parts of the work? No. Neither should the operator of a website because they opted to use services provided from a third party for part (or all) of their web services.
- icebraining 13y ago
  If you bought on an online store, an it used an insecure third-party payment provider which leaked your CC number all over the web, would you say the same?
txutxu 13y ago
A bit of fun about all this: The local government site of my spanish country, uses even javascript to record your mouse clicks in US (and cookies without advise, of course), pixel based tracking in case you block javascript, and more on the same line... And it has been said in their "opengob" sessions two years ago... and you know what? the local gov does not have any proceeding about their faults. The same than we have known grabbers (with proceedings that always finish the same), as politics and monarchy, which in turn, control the lawyers and the public security we pay (in the figurative sense of the word). It's not nice to be Spanish these days. A Spanish (writing from other country).

scrrr 13y ago

Is there an open source JavaScript snippet somewhere that I can put on my page and it shows a pop up prompting users to accept cookies?

stingraycharles 13y ago
There are several, with http://www.civicuk.com/cookie-law/index http://www.civicuk.com/cookie-law/index and http://silktide.com/cookieconsent http://silktide.com/cookieconsent being the most popular afaik.
ealexhudson 13y ago
If your server sends cookies automatically, it would fall foul of this Spanish implementation of the law (supposedly). Implied consent does not cover simply giving the users information, and some of the cookies being argued over are third-party too. There's no third-party snippet you can drop in and "fix" this for Google Analytics (for example).
vicentereig 13y ago
You actually need to avoid cookies getting stored until users give their consent to do so. Probably something like the rack-policy Ruby gem linked below will help making sure there is no cookies at all. https://github.com/peter-murach/rack-policy#rack-policy https://github.com/peter-murach/rack-policy#rack-policy I ignore if there are similar libraries for other platforms.

terhechte 13y ago

Is this message only required on commercial sites? Or do I need to display the cookie UI whenever I have any kind of html on the web that uses Google analytics (i.e. cookies)?

notatoad 13y ago

Has there been any work done at all to standardize this process and allow users to opt-in to cookies at a browser level, so that we can all stop seeing this stupid warning? would that even be allowed under the law? i tried to download a firefox extension called "cookiesOK", but it doesn't seem to work in most cases.

ensmotko 13y ago
The problem is that every site owner displays a slightly different popup. A few of my friends were trying to build a chrome extension[1], but they soon figured out they are going to need custom Javascript for every site in Slovenia (and others of course, but they were focusing on Slovenia) and they abandoned the project. Personally I believe EU should target browsers not site owners for this. At least by doing so we would get a standardized UI and the ability to opt-in or out. [1] https://chrome.google.com/webstore/detail/peeshkot/idfkeeahcifaocjonphgjmpmmfonahle?hl=en https://chrome.google.com/webstore/detail/peeshkot/idfkeeahc...
- AJ007 13y ago
  One would assume that the act of visiting a web site, from a personally identifiable IP address, using a web browser that accepts cookies is an act of consent to receive those cookies. The behavior is both expected, avoidable, and blockable. This approach -- either by law, or by some "do not track" flag broadcast to web sites is the equivalent of walking through a busy city with hundred dollar bills hanging out of your pocket, with a sign hanging around your neck requesting that no one takes your money -- all when a simple wallet in your pocket would be adequate. There are serious privacy issues when it comes to the internet and tracking. The "solutions" we've seen targeting cookies in both the US & EU would be laughable if they did not threaten to add considerable legal obligations over even the most casual of web site owners.
  - icebraining 13y ago
    Expected? By whom? Technologists like us, yes, but not many of the general public. Walking around with $100s is a false analogy; accepting tracking cookies is completely invisible to the user. Furthermore, even if one does walk with $100s, theft is still illegal.

ripberge 13y ago

Yikes. I'm generally in favor of web privacy, but with unemployment numbers like theirs, that seems like the last thing Spain needs right now.

albertoperdomo 13y ago
I'm from Spain and I've been running a webdev shop for 6 years now. Things are getting worse here and the government if anything is actually just making things more difficult for everyone. I agree with those trying to protect their privacy but for the sake of practicality they should look for a pragmatic approach. BTW, making individuals and companies responsible for tracking cookies installed by third party platforms like Facebook, Tumblr, etc. because of this law doesn't really help us being more competitive either [sarcasm sign].
- lingben 13y ago
  can you please explain a little bit more about this cookie law? the only one I heard about was the UK cookie law and it was abandoned months ago. which websites does it apply to? websites hosted in Spain? websites of commercial businesses operating in Spain? any website with an address in Spain?
  - paradoja 13y ago
    I'm not him, but I can try to answer you. It applies to any businesses, professionals with a web page, and anyone who offers a service as long as they a) are located in Spain, b) target their services to the Spanish market or c) if they have a (permanent or regular) workplace or facilities in Spain. (It's a translation from Spanish legalese, so probably the language is muddled, sorry.)
    - lingben 13y ago
      thanks. so by condition b that includes almost anyone on the internet!

vklj 13y ago

Actually, most warning implementations punish those users that disable cookies in their browsers by forcing them to see the obnoxious warning every time they visit the site. This is arguably worse than the previous situation.

mindstab 13y ago
... This isn't some "punishment" this is how the internet works. If you opt out of being tracked and cookies... how would that be remembered? That is really a sign it's working. This is part of why this is such an amazingly defective law
- pgeorgi 13y ago
  Some pages (eg. all that use the consent.truste.com script) use localStorage to store the decision. That way the decision remains client-side and can still be persistent by hiding the question via javascript.
  - notok22 13y ago
    This law applies to any kind of "data" stored on the client, so using localStorage to store the user's answer would be breaking the law. http://www.cookiepedia.co.uk/eu-cookie-law http://www.cookiepedia.co.uk/eu-cookie-law
    - pgeorgi 13y ago
      I don't remember the specifics. They could add a checkbox "store this decision locally", which would allow storing this single information - and localStorage is the best place to put it (unlike cookies).

lifeisstillgood 13y ago

I am surprised - isn't this what we want? Instead of secrecy, governments warn everyone they are being tracked online. And we moan about it. It wrecks the UI, it is annoying. Folks - this is the Snowden debate, but without the security services. Yes they should have got into the RFC / IEEE debates (which are fast becoming laws of their own), yes they should be doing it better. Yes they should stop monitoring everyone. But they are at least starting the debate. And not on an obscure tech forum, or in dusty volumes of proceedings, but right there, in everyone's face. And until we find a way to make privacy and surveillance and technology triggers in every politician's Skinner box, then its probably the best start we can get.

bobsy 13y ago
I agree that the one good thing this law has done is start a debate. On the downside it is negatively affecting how you interact with websites. Often before I can even determine if I am on the right website I get a pop up message before I can continue. Recently I was on a shopping site and I clicked no to the cookies thinking it would only stop tracking cookies. Was surprised when my cart wouldn't save. It is silly that this breaks the site's basic functionality. If anything browser vendors should be doing more. I do not think this can be done via legislation though. I also think prosecuting websites is silly. If these cookies are so toxic the companies running the services should be showing messages. For example. Analytics. Why is it that I need to "opt in" to this on every site with a pop up? Why can't I just click YES and be done with it when it comes to this service? You could then have non-tracking cookies essential to the running of the service exempt from this law.
prof_hobart 13y ago
It's not the Snowden debate, not by a long distance. Some cookies (like ad trackers) can be annoying/slightly disturbing, but even before the cookie law they were pretty obviously there and in most cases pretty easily opted out of already if you knew what you were doing. I don't remember seeing the "opt out of NSA surveillance" option anywhere in my browser or email client.
albertoperdomo 13y ago
The problem is that there is no debate about how to deal this in pragmatic terms. Instead, they are just issuing fines on businesses that are probably already having a hard time keeping themselves alive. The whole situation would be completely different it this would have been discussed in practical terms. They could have matured possible technical solutions for this and also made sure that big third party providers (Facebook, Tumblr, etc.) that host websites for EU businesses comply with this regulation, rather than making the business owner responsible. If you get a fine of €30K I bet you wouldn't call that a debate, correct?

devx 13y ago

Does this impact only sites hosted in EU? Or with a domain from an EU country?

albertoperdomo 13y ago
The actual implementation of the laws depend on the countries, but they are based on the same EU directive. AFAIK this applies to companies registered in those countries, or with an office there or targeting the market in those countries. So, to make things more difficult, the German law implementation might be different from the Spanis implementation. If you are targeting both markets, you'd need to pay close attention to both.

ogig 13y ago

Mentioned in the article: Spanish business using Facebook pages could be non compliant to this law. Same with others using wordpress, blogger, tumblr and so on since tracking cookies are been installed without a previous user acceptance. Also note that the business is liable for this, not the hosting service provider. I wonder how far hosting provider definition goes. If twitter is used in a company marketing strats, is it liable for the cookies installed by twitter? I don't see it different from the facebook pages cited example. The only practical option given this is to stop using those providers.

Kiro 13y ago

So if I'm outside of Spain I don't need to care about this?

camus 13y ago
if you are doing business anywhere in Europe you should.
- Kiro 13y ago
  Care to elaborate? I thought the Cookie Law was dead.

nolanl 13y ago

The last place I worked was a Swiss organization that built web sites for the European Commission. Dealing with the EU cookies directive was an amazing waste of brain cells for everyone on the team. For instance, were we allowed to ignore it because we were Swiss (non-EU)? If not, which version of the law were we required to comply with? For instance, the UK implementation of the law says that you can assume "implied" consent if the user ignores your popup altogether. However, the Dutch version of the law is much stricter - the user must click "I accept" before you can save any cookies. And the French version of the law allows for lots of exceptions, e.g. for setting the user's preferred language. Plus, we needed a cookie just to store whether or not the user clicked "yes" or "no," so in effect we were forced to break the law no matter what we did. (The only alternative would be to show the "no" users the popup every time they came back to the site, since we were supposed to forget that they had even clicked "no"...) So all in all, it was a huge mess. In the end we just copy-pasted a JQuery plugin from GitHub and chose the strictest setting. Now our site is uglier, it's more confusing to users, and we still have to cross our fingers that we didn't miss a corner case in Bulgaria or something.

gcb0 13y ago
> Plus, we needed a cookie just to store whether or not the user clicked "yes" or "no," so in effect we were forced to break the law no matter what we did. this means you didnt' waste too much brain cells after all. if user clicks no, you either show it everytime, or set a session cookie, which is not supposed to be saved on disk per the specs. if the browser decide to save it on disk, it's their problem. But if you set a no cookie. then it's the typical governemnt contractor. Going the extra mile to bill for the law, but completely ignoring the law purpose and benefits.

joyinsky 13y ago

Don't the have anyhing more important to do? like, e.g.(creating the 6M jobs they desesperately need)

Uchikoma 13y ago

How does one store that a user opted out of cookies?

adcuz 13y ago

This is a shambles.

smoyer 13y ago

My web-sites will say - "This site uses cookies ... If you agree, please leave."