4 ms·

EU approves new law requiring users approve all cookies.

26 points by varikin 17y ago

jncraton 17y ago
So they want web developers to create an opt-out option on each web site? That's completely redundant. The people who don't care are going to ignore the option (or click ok on the popups if it comes to that), and the people who do care probably already have their browsers asking them whether or not to store cookies from a given site.
- jacquesm 17y ago
  Why would you let common sense get in the way of a perfectly useless piece of legislation... They're so hopelessly behind with this stuff it is amazing.
pierrefar 17y ago
When a user opts out, how do you remember they did opt-out? Using a cookie?
- roc 17y ago
  The new legislation does offer an exception for when a cookie is "strictly necessary" Apparently.
coderdude 17y ago
"Cookies, small programs that can be used to track Web movements, ..." And the masses stay ignorant.
- RiderOfGiraffes 17y ago
  Indeed, and part of the job of an exceptionally good developer is to avoid having the masses have to know about things they shouldn't need to know about. Don't laugh at people's ignorance when the whole point of User Interface/Experience Design is to ensure that people don't have to know how things work. EDIT: coverdude in his/her reply to my comment makes an important point that I missed - it's not the masses being laughed at, it's the "journalist." Yes, point taken, the author really, really ought to know better.
  - coderdude 17y ago
    I laugh at this author's ignorance because cookies have been small innocuous pieces of text for the last decade and a half. No one could have clued this guy in? He writes for the Wall Street Journal for Pete's sake.
- kp812 17y ago
  If I didn't know how cookies worked, based on that statement I'd be against them and for the law automatically.
- jrockway 17y ago
  But of course, this is exactly what Google Analytics is.
RiderOfGiraffes 17y ago
See also http://news.ycombinator.com/item?id=931596 http://news.ycombinator.com/item?id=931596 where there is already much discussion
- varikin 17y ago
  Thanks. I looked for a post on this already and didn't find it.
  - RiderOfGiraffes 17y ago
    No problem - I remember things like this and knew the search terms. Then http://searchyc.com/ http://searchyc.com/ is your friend.
aarongough 17y ago
I hate to say it but doesn't this make print advertising all of a sudden far more relevant again? Is there any possibility that this was helped along by gentle lobbying from the newspaper industry?
- thwarted 17y ago
  Well, it at least puts on-line advertising on the same footing as print advertising, analytics wise. No more highly targeted advertising, no more avoiding showing the same ad to the same user multiple times, no more being able to tell who looked at your ad or why or where they came from, no more being able to determine how qualified ad traffic is. So really, it's a significant step backward.
TimMontague 17y ago
Another good article, with excerpts from the actual law is here: http://www.out-law.com/page-10021 http://www.out-law.com/page-10021
- fun2have 17y ago
  The article is in fact wrong. See my comment above....
jonknee 17y ago
Browsers already approve all cookies based on the user's wishes. A website can only send you a cookie and hope you send it back--it's completely up to the user if they want to return the cookie. Not to mention you'll have to set a cookie when someone says they don't want any cookies. What a mess.
- kd5bjo 17y ago
  "Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user's consent to processing may be expressed by using the appropriate settings of a browser or other application." Looks like there won't be much of a change for HTTP cookies, as browsers already do this.
  - gloob 17y ago
    Why do we need a law to tell us that browsers are allowed to do what they already do, out of curiosity? Or is this just politicians doing their thing?
- Silhouette 17y ago
  The fact that I keep seeing this argument in geek forums today is an excellent argument for the new rule. Hint 1: Search for "Flash cookie". Hint 2: The wording in the new rule doesn't control specifically the kind of HTTP cookies you're talking about, it's more general.
  - jonknee 17y ago
    While it would be great if Adobe would work with browser makers to have Flash honor HTTP cookie settings, you can certainly tell Flash to ask you if you'd like to store data.
    - Silhouette 17y ago
      > you can certainly tell Flash to ask you if you'd like to store data. Sure you can, if you know where to find the setting, but how many people do? If the answer to that question is not "almost all of them" or more, then any argument based on implied consent is defeated before it even starts.
bumblebird 17y ago
This is why unelected officials shouldn't try to make laws about things they have absolutely no idea about.
- oconnor0 17y ago
  That applies to elected officials, for that matter.
pg 17y ago
This is only one step removed from the story of the Tennessee legislature passing a law declaring that pi = 3. On the other hand, that never happened.
- akeefer 17y ago
  No such law was ever passed, but Indiana did come close back in 1897, apparently: http://www.straightdope.com/columns/read/805/did-a-state-legislature-once-pass-a-law-saying-pi-equals-3 http://www.straightdope.com/columns/read/805/did-a-state-leg... Apparently the trend of legislators voting for things that sounded good but that they didn't understand in the least has remained in changed for at least the past 112 years.
cool-RR 17y ago
I think the title is misleading, it sounds like users are now required to accept all cookies.
Luc 17y ago
Don't mistake the journalist's writeup with the actual law, and perhaps think about restraining your knee-jerk 'EU is awful' and 'bureaucrats are clueless'. Privacy laws in the EU are much stricter than in the US, and a good thing too. I've been reading the same kind of comments about the Microsoft anti-trust decision, and when I looked into it I got a good appreciation for the thinking behind it. But it took some more effort than just jumping to conclusions about stupid officials in their ivory towers.
- theoneill 17y ago
  http://www.out-law.com/page-10510 http://www.out-law.com/page-10510
jmhgtfrwfgv 17y ago
Blame BT (British Telecom) They introduced an ad service called phorm (without asking anyones permission) it tracked all your online activity and then removed the regular ads from pages its ISP served and replaced them with ads that would be interesting to you based on your browsing history. It got into trouble when it removed ads for charities and placed porn ads in childrens sites. Because it worked at the ISP level, clearing your history or cookies had no effect. They then introduced a cookie to allow you to opt out and claimed that by deleting this cookie you had volunteered to opt in! The Eu investigation ruled that it broke wiretap laws but the UK refused to prosecute (BT is privatized but is almost a monopoly and has strong links to government)
fun2have 17y ago
The article is wrong. The actual new law states :- Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user's consent to processing may be expressed by using the appropriate settings of a browser or other application.
jrockway 17y ago
Wow, people here seem really upset about this. I personally think it's great. Disabling cookies in my browser is like throwing the baby out with the bathwater. In addition to not being tracked by ads, I can't manage my bank account online or log into Hacker News. Not fair. This law makes it a requirement for me to be able to opt out of ad tracking, but still be able to log into websites ("essential purposes"). This should not impact ad revenue either; the content site simply says "by proceeding past this page, you consent to being tracked across the entire Internet by our advertisers and anyone they feel like selling your browsing habits to". Then the user can choose between privacy and your content. Most will choose the content, judging from grocery store "preferred customer" programs, and so on. It's important that regular users be able to easily opt out of cross-site tracking like Google Analytics; as many people would be outraged by the data it collects, if only they knew such a thing was possible. Now they know, because you have to tell them what you're doing. I think that's a good thing.
chacha102 17y ago
So, in order for Google to get the consent to place cookies on systems, it just simply displays an ad in place of a banner ad saying: "Click here to opt-out of cookie tracking" and in smaller letters "By visiting another page with ads from Google, you consent to allowing Google to place cookies on your system" Yay. That takes like 2 cents out of Google budget. That takes care of that stupid bill. PS: The "Technically necessary" can be applied to anything. For Banner Ads to work, you can argue that it is necessary to use cookies.
mcantor 17y ago
Couldn't this law have been obsoleted simply by telling people about the "Allow cookies for these specific sites" settings in browsers?
- chacha102 17y ago
  You could argue that. Technically the user consents to cookies simply by allowing cookies to be placed in the browser.

26 points by varikin 17y ago

So they want web developers to create an opt-out option on each web site? That's completely redundant. The people who don't care are going to ignore the option (or click ok on the popups if it comes to that), and the people who do care probably already have their browsers asking them whether or not to store cookies from a given site.

jacquesm 17y ago
Why would you let common sense get in the way of a perfectly useless piece of legislation... They're so hopelessly behind with this stuff it is amazing.

pierrefar 17y ago

When a user opts out, how do you remember they did opt-out? Using a cookie?

roc 17y ago
The new legislation does offer an exception for when a cookie is "strictly necessary" Apparently.

coderdude 17y ago

"Cookies, small programs that can be used to track Web movements, ..." And the masses stay ignorant.

RiderOfGiraffes 17y ago
Indeed, and part of the job of an exceptionally good developer is to avoid having the masses have to know about things they shouldn't need to know about. Don't laugh at people's ignorance when the whole point of User Interface/Experience Design is to ensure that people don't have to know how things work. EDIT: coverdude in his/her reply to my comment makes an important point that I missed - it's not the masses being laughed at, it's the "journalist." Yes, point taken, the author really, really ought to know better.
- coderdude 17y ago
  I laugh at this author's ignorance because cookies have been small innocuous pieces of text for the last decade and a half. No one could have clued this guy in? He writes for the Wall Street Journal for Pete's sake.
kp812 17y ago
If I didn't know how cookies worked, based on that statement I'd be against them and for the law automatically.
jrockway 17y ago
But of course, this is exactly what Google Analytics is.

RiderOfGiraffes 17y ago

See also http://news.ycombinator.com/item?id=931596 http://news.ycombinator.com/item?id=931596 where there is already much discussion

varikin 17y ago
Thanks. I looked for a post on this already and didn't find it.
- RiderOfGiraffes 17y ago
  No problem - I remember things like this and knew the search terms. Then http://searchyc.com/ http://searchyc.com/ is your friend.

aarongough 17y ago

I hate to say it but doesn't this make print advertising all of a sudden far more relevant again? Is there any possibility that this was helped along by gentle lobbying from the newspaper industry?

thwarted 17y ago
Well, it at least puts on-line advertising on the same footing as print advertising, analytics wise. No more highly targeted advertising, no more avoiding showing the same ad to the same user multiple times, no more being able to tell who looked at your ad or why or where they came from, no more being able to determine how qualified ad traffic is. So really, it's a significant step backward.

TimMontague 17y ago

Another good article, with excerpts from the actual law is here: http://www.out-law.com/page-10021 http://www.out-law.com/page-10021

fun2have 17y ago
The article is in fact wrong. See my comment above....

jonknee 17y ago

Browsers already approve all cookies based on the user's wishes. A website can only send you a cookie and hope you send it back--it's completely up to the user if they want to return the cookie. Not to mention you'll have to set a cookie when someone says they don't want any cookies. What a mess.

kd5bjo 17y ago
"Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user's consent to processing may be expressed by using the appropriate settings of a browser or other application." Looks like there won't be much of a change for HTTP cookies, as browsers already do this.
- gloob 17y ago
  Why do we need a law to tell us that browsers are allowed to do what they already do, out of curiosity? Or is this just politicians doing their thing?
Silhouette 17y ago
The fact that I keep seeing this argument in geek forums today is an excellent argument for the new rule. Hint 1: Search for "Flash cookie". Hint 2: The wording in the new rule doesn't control specifically the kind of HTTP cookies you're talking about, it's more general.
- jonknee 17y ago
  While it would be great if Adobe would work with browser makers to have Flash honor HTTP cookie settings, you can certainly tell Flash to ask you if you'd like to store data.
  - Silhouette 17y ago
    > you can certainly tell Flash to ask you if you'd like to store data. Sure you can, if you know where to find the setting, but how many people do? If the answer to that question is not "almost all of them" or more, then any argument based on implied consent is defeated before it even starts.

bumblebird 17y ago

This is why unelected officials shouldn't try to make laws about things they have absolutely no idea about.

oconnor0 17y ago
That applies to elected officials, for that matter.

pg 17y ago

This is only one step removed from the story of the Tennessee legislature passing a law declaring that pi = 3. On the other hand, that never happened.

akeefer 17y ago
No such law was ever passed, but Indiana did come close back in 1897, apparently: http://www.straightdope.com/columns/read/805/did-a-state-legislature-once-pass-a-law-saying-pi-equals-3 http://www.straightdope.com/columns/read/805/did-a-state-leg... Apparently the trend of legislators voting for things that sounded good but that they didn't understand in the least has remained in changed for at least the past 112 years.

cool-RR 17y ago

I think the title is misleading, it sounds like users are now required to accept all cookies.

Luc 17y ago

Don't mistake the journalist's writeup with the actual law, and perhaps think about restraining your knee-jerk 'EU is awful' and 'bureaucrats are clueless'. Privacy laws in the EU are much stricter than in the US, and a good thing too. I've been reading the same kind of comments about the Microsoft anti-trust decision, and when I looked into it I got a good appreciation for the thinking behind it. But it took some more effort than just jumping to conclusions about stupid officials in their ivory towers.

theoneill 17y ago
http://www.out-law.com/page-10510 http://www.out-law.com/page-10510

jmhgtfrwfgv 17y ago

Blame BT (British Telecom) They introduced an ad service called phorm (without asking anyones permission) it tracked all your online activity and then removed the regular ads from pages its ISP served and replaced them with ads that would be interesting to you based on your browsing history. It got into trouble when it removed ads for charities and placed porn ads in childrens sites. Because it worked at the ISP level, clearing your history or cookies had no effect. They then introduced a cookie to allow you to opt out and claimed that by deleting this cookie you had volunteered to opt in! The Eu investigation ruled that it broke wiretap laws but the UK refused to prosecute (BT is privatized but is almost a monopoly and has strong links to government)

fun2have 17y ago

The article is wrong. The actual new law states :- Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user's consent to processing may be expressed by using the appropriate settings of a browser or other application.

jrockway 17y ago

Wow, people here seem really upset about this. I personally think it's great. Disabling cookies in my browser is like throwing the baby out with the bathwater. In addition to not being tracked by ads, I can't manage my bank account online or log into Hacker News. Not fair. This law makes it a requirement for me to be able to opt out of ad tracking, but still be able to log into websites ("essential purposes"). This should not impact ad revenue either; the content site simply says "by proceeding past this page, you consent to being tracked across the entire Internet by our advertisers and anyone they feel like selling your browsing habits to". Then the user can choose between privacy and your content. Most will choose the content, judging from grocery store "preferred customer" programs, and so on. It's important that regular users be able to easily opt out of cross-site tracking like Google Analytics; as many people would be outraged by the data it collects, if only they knew such a thing was possible. Now they know, because you have to tell them what you're doing. I think that's a good thing.

chacha102 17y ago

So, in order for Google to get the consent to place cookies on systems, it just simply displays an ad in place of a banner ad saying: "Click here to opt-out of cookie tracking" and in smaller letters "By visiting another page with ads from Google, you consent to allowing Google to place cookies on your system" Yay. That takes like 2 cents out of Google budget. That takes care of that stupid bill. PS: The "Technically necessary" can be applied to anything. For Banner Ads to work, you can argue that it is necessary to use cookies.

mcantor 17y ago

Couldn't this law have been obsoleted simply by telling people about the "Allow cookies for these specific sites" settings in browsers?

chacha102 17y ago
You could argue that. Technically the user consents to cookies simply by allowing cookies to be placed in the browser.