6 ms·

Sorry for submitting a Google Translate link. It's not doing a perfect job on a legal text but I didn't find any source in English. This is a blogpost of the la

Sorry for submitting a Google Translate link. It's not doing a perfect job on a legal text but I didn't find any source in English. This is a blogpost of the lawyer taking this case, and the client name is unknown yet. Here's my summary of some facts (IANAL!): - The cookies being investigated are from Google Analytics, Google Maps, YouTube, Adsense and WordPress. - The website was setting the cookies in the browser and then showing a popup warning the user that the site used cookies and that if they didn't want them they could delete them. - The AEPD is a governmental organization which watches over personal data and privacy infringements. If a company infringes your rights as a citizen, you submit a complaint to the AEPD, and they can investigate and fine if necessary. - The AEPD states that the fine is imposed because the website should not set any cookies until the user had accepted the warning. - The Spanish law being used here is RD 12/2012, which was created using the 2009/136/CE EU Directive as its framework. - The fine is still not final. They can still present allegations.

potatolicious 13y ago
This is interesting. Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? My initial reaction is that this seems fair. The fine is substantial, but not deadly to an enterprise, so it would serve as a warning without being catastrophic for them. I'm not a EU citizen - but presumably the EU's rather strict laws re: cookies derives from privacy and a desire not to be tracked at all. A user who has accepted Google cookies from other sites need not submit to the same tracking cookie on your site - but even if you delete the cookie aftewards, presumably Google Analytics has already captured the visit. And there is, as far as I know, no way to remove that event from Google Analytics.
- martinml 13y ago
  > Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? This is a very liberal translation of the relevant part of the law[0]: "Those who provide services will be allowed to use storage devices in remote computers, provided that the owners have given their consentment AFTER [my emphasis] they have been informed clearly and completely about the utilization of the private data". [0]: http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.html#a22 http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.h..., article 22.2.
  - mistercow 13y ago
    That sounds like technically the consent has to come after being informed, not the storage.
    - DerpObvious 13y ago
      But they may only use the storage once consent has been given, which can only happen after a warning has been issued. The two clauses seem to indicate that consent must be before storage, and warning before consent, hence there must be a warning /before/ the storage on the remote machine.
      - potatolicious 13y ago
        In either case, storing the cookie before consent, in the Google context, seems to run directly counter to the intent and spirit of the law. I'm not big on technicalities. Normally I would put this in the "not a big deal" bucket, but in this case the specific cookies do not belong to the website itself. This means that you cannot retroactively "untrack" a user once they refuse your warning. If this was just the website's own cookie, and if the cookie could be deleted and all tracking data would vanish from the site's own backend, then I'd be inclined to give it a pass.
    - gcb0 13y ago
      "provided" means a condition. so in parsed order: 1. informed. 2. consent. 3. storage.
      - mistercow 13y ago
        "Provided that" as a condition does not imply any temporal order (in English at least).
        martinml 13y ago
        Don't rely too much in my bad translation :)
ealexhudson 13y ago
This is one of the most stupid and anti-user laws on the books. Worse, it's probably the only law I've ever seen have an instant and devastating effect on the UX of a swathe of websites. Hopefully they are going to start suing people regularly (unlike the inaction being taken in the UK) so that business wakes up to this stupid law and finally gets it repealed, the sooner the better.
- deleted 13y ago
  [deleted]
- kintamanimatt 13y ago
  Can it really be repealed by the Spanish government if they're required to enact such a law as a result of an EU Directive? They could take the UK's approach of turning a blind eye, but I tend to feel it's wrong for a country to pick and choose which laws to enforce.
  - walshemj 13y ago
    Well this is the EU and countrys ignore or adjust EU directives to suit all the time - Spains implementation of TUPE is a total FY to the eu has no relation to the Spirit of the Directive. Italy also does this a lot remember the you tube fiasco where they ignored EU law.
  - sergiosgc 13y ago
    The EU is a set of treaties between sovereign states. The Parliament in each state supercedes the EU bodies (commission and parliament namely). So, yes they can repeal the law. It violates the treaty, and they'll be fined, but that's about it.
    - kintamanimatt 13y ago
      Can Spain even afford such a fine?
      - sergiosgc 13y ago
albertoperdomo 13y ago
Please also note that according to the post if the sites are hosted in third party platforms like Facebook, Tumblr, that install tracking cookies the owner of the site can still be sued, even if it's without his control. In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This is just Spanish law at it's best (I'm Spanish, too)
- DerpObvious 13y ago
  > In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This just says that they're responsible for the effects of the services they contract, in addition to acts they undertake directly. Should a person building a bridge get out of the liability because they contracted out parts of the work? No. Neither should the operator of a website because they opted to use services provided from a third party for part (or all) of their web services.
- icebraining 13y ago
  If you bought on an online store, an it used an insecure third-party payment provider which leaked your CC number all over the web, would you say the same?
txutxu 13y ago
A bit of fun about all this: The local government site of my spanish country, uses even javascript to record your mouse clicks in US (and cookies without advise, of course), pixel based tracking in case you block javascript, and more on the same line... And it has been said in their "opengob" sessions two years ago... and you know what? the local gov does not have any proceeding about their faults. The same than we have known grabbers (with proceedings that always finish the same), as politics and monarchy, which in turn, control the lawyers and the public security we pay (in the figurative sense of the word). It's not nice to be Spanish these days. A Spanish (writing from other country).

potatolicious 13y ago

This is interesting. Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? My initial reaction is that this seems fair. The fine is substantial, but not deadly to an enterprise, so it would serve as a warning without being catastrophic for them. I'm not a EU citizen - but presumably the EU's rather strict laws re: cookies derives from privacy and a desire not to be tracked at all. A user who has accepted Google cookies from other sites need not submit to the same tracking cookie on your site - but even if you delete the cookie aftewards, presumably Google Analytics has already captured the visit. And there is, as far as I know, no way to remove that event from Google Analytics.

martinml 13y ago
> Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case? This is a very liberal translation of the relevant part of the law[0]: "Those who provide services will be allowed to use storage devices in remote computers, provided that the owners have given their consentment AFTER [my emphasis] they have been informed clearly and completely about the utilization of the private data". [0]: http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.html#a22 http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.h..., article 22.2.
- mistercow 13y ago
  That sounds like technically the consent has to come after being informed, not the storage.
  - DerpObvious 13y ago
    But they may only use the storage once consent has been given, which can only happen after a warning has been issued. The two clauses seem to indicate that consent must be before storage, and warning before consent, hence there must be a warning /before/ the storage on the remote machine.
    - potatolicious 13y ago
      In either case, storing the cookie before consent, in the Google context, seems to run directly counter to the intent and spirit of the law. I'm not big on technicalities. Normally I would put this in the "not a big deal" bucket, but in this case the specific cookies do not belong to the website itself. This means that you cannot retroactively "untrack" a user once they refuse your warning. If this was just the website's own cookie, and if the cookie could be deleted and all tracking data would vanish from the site's own backend, then I'd be inclined to give it a pass.
  - gcb0 13y ago
    "provided" means a condition. so in parsed order: 1. informed. 2. consent. 3. storage.
    - mistercow 13y ago
      "Provided that" as a condition does not imply any temporal order (in English at least).
      - martinml 13y ago
        Don't rely too much in my bad translation :)

ealexhudson 13y ago

This is one of the most stupid and anti-user laws on the books. Worse, it's probably the only law I've ever seen have an instant and devastating effect on the UX of a swathe of websites. Hopefully they are going to start suing people regularly (unlike the inaction being taken in the UK) so that business wakes up to this stupid law and finally gets it repealed, the sooner the better.

deleted 13y ago
[deleted]
kintamanimatt 13y ago
Can it really be repealed by the Spanish government if they're required to enact such a law as a result of an EU Directive? They could take the UK's approach of turning a blind eye, but I tend to feel it's wrong for a country to pick and choose which laws to enforce.
- walshemj 13y ago
  Well this is the EU and countrys ignore or adjust EU directives to suit all the time - Spains implementation of TUPE is a total FY to the eu has no relation to the Spirit of the Directive. Italy also does this a lot remember the you tube fiasco where they ignored EU law.
- sergiosgc 13y ago
  The EU is a set of treaties between sovereign states. The Parliament in each state supercedes the EU bodies (commission and parliament namely). So, yes they can repeal the law. It violates the treaty, and they'll be fined, but that's about it.
  - kintamanimatt 13y ago
    Can Spain even afford such a fine?
    - sergiosgc 13y ago

albertoperdomo 13y ago

Please also note that according to the post if the sites are hosted in third party platforms like Facebook, Tumblr, that install tracking cookies the owner of the site can still be sued, even if it's without his control. In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This is just Spanish law at it's best (I'm Spanish, too)

DerpObvious 13y ago
> In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued. This just says that they're responsible for the effects of the services they contract, in addition to acts they undertake directly. Should a person building a bridge get out of the liability because they contracted out parts of the work? No. Neither should the operator of a website because they opted to use services provided from a third party for part (or all) of their web services.
icebraining 13y ago
If you bought on an online store, an it used an insecure third-party payment provider which leaked your CC number all over the web, would you say the same?

txutxu 13y ago

A bit of fun about all this: The local government site of my spanish country, uses even javascript to record your mouse clicks in US (and cookies without advise, of course), pixel based tracking in case you block javascript, and more on the same line... And it has been said in their "opengob" sessions two years ago... and you know what? the local gov does not have any proceeding about their faults. The same than we have known grabbers (with proceedings that always finish the same), as politics and monarchy, which in turn, control the lawyers and the public security we pay (in the figurative sense of the word). It's not nice to be Spanish these days. A Spanish (writing from other country).