Europe Caught in the Cookie Jar | Hacker News Reader

Europe Caught in the Cookie Jar

blogs.wsj.com

20 pointsvoodoochilo14 comments

The articles calling this a "Europe" or "EU law" are disingenuous. The EU issued a directive. It's up to the individual countries to implement the directive. So here's what happened:

http://www.dlapiper.com/files/Uploads/Documents/DLA_Piper%20...

Quite a few countries chose an opt-out system, which appears to be workable. Quite a few (most?) countries are still debating what to do or are intentionally or unintentionally dragging their feet (this is very typical).

The UK chose an extremely strict opt-in system, which is complete bullshit and unworkable in practise.

Now, I know it's "de rigeur" for the UK to blame Europe each time something bad happens, but in this case they only have their local government to blame. So please, stop calling this a European problem and tell it like it is: it's a UK problem brought onto them by a stupid government. The sooner the people of the UK realize they have their elected officials to blame, the sooner this can get fixed.

As far as I understand it, the UK now allows an implied opt-in, so long as you make it clear to the user that cookies are being used.

Do you have a reference for that? I don't see anything like it at the ICO site.

In the latest info on Friday.

http://www.ico.gov.uk/news/blog/2012/updated-ico-advice-guid...

"Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies."

Here are some selective quotes from the document, I take it to mean: tell the user with a clear message at least once (ideally get them to click confirm but it's not a requirement):

"In some circumstances those seeking consent might consider implied consent as an option that was perhaps more practical than the explicit opt-in model... For implied consent to work there must be some action taken by the consenting individual from which their consent can be inferred... This might for example be visiting a website, moving from one page to another or clicking on a particular button... The key point, however, is that when taking this action the individual has to have a reasonable understanding that by doing so they are agreeing to cookies being set."

http://www.ico.gov.uk/for_organisations/privacy_and_electron...

On the topic of the UK blaming Europe for its problems, there is a great blog which debunks such claims in the media: http://ec.europa.eu/unitedkingdom/blog/index_en.htm

The UK has misunderstood the word "directive" for a considerable amount of time. Maybe it was a translation problem, and it should be reworded to "guidance", since the UK has a very bad habit of applying directives without due consideration. The rest of Europe leaves such directives where they should be, in a box marked, "Good but unworkable ideas. Please archive".

This is Europe's way of trying to make users read the Terms & Conditions of every website.

The intentions of the law are good, but I do not believe the approach is that smart. They could have made the companies who own the websites place cookies on the users machines only after they have actually created an account... that seems like consent to me.

Can someone explain to me why cookies are something that laws need to be written up about? What's wrong with cookies? What's wrong with paranoid people disabling cookies on their browser and then just granting access to the sites if they need to?

Cookies, are small programs which malicious websites download onto your computer without your knowledge. They can contain viruses and other malware.

They also follow you over the internet, logging every website you visit, and collecting your personal information.

I expect many people believe the above to be true, considering the massive amount of FUD that has been spread about on Cookies.

The EU privacy legislation is supposed to prevent tracking of people without their consent/knowledge. This is widely considered a worthy goal by consumers.

Fiddling with browser cookie settings is bad because it's opt-out instead of opt-in, opt-out just doesn't work since users have to be technically clueful and spend lots of time and effort on it. Compare to opt-in vs opt-out in email spam.

edit: see http://en.wikipedia.org/wiki/Data_Protection_Directive#Princ...

Do cookies track 'people'?

Recently it was determined by courts that an IP address cannot be attributed to a person (in regards to torrents). Why is it different for cookies?

The reliability standard for evidence in court cases is a bit higher than what typical cookie applications require.

We can hope this will persuade some percentage of sites to abandon cookies, even though the directive ended up pretty toothless.

Reply on news.ycombinator.com