[LRUG] This cookie nonsense

[Kevin Monk]

Hi LRUGers,

What are people doing about this EU cookie law?

According to the ICO guidance... http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/~/media/documents/library/Privacy_and_electronic/Practical_application/cookies_guidance_v3.ashx

"Implied consent is certainly a valid form of consent but those who seek to rely on it should not see it as an easy way out or use the term as a euphemism for “doing nothing”

An 11th hour reprieve? http://www.guardian.co.uk/technology/2012/may/26/cookies-law-changed-implied-consent

But...

"For implied consent to work there has to be some action taken by the consenting individual from which their consent can be inferred."

Or put another way - implied consent is OK as long as it's explicit. << scratches head >>

And RE: Prior consent
"It is difficult to see that a good argument could be made that agreement to an action could be obtained after the activity the agreement is needed for has already occurred. This is not the generally accepted way in which consent works in other areas, and is not what users will expect. Setting cookies before users have had the opportunity to look at the information provided about cookies, and make a choice about those cookies, is likely to lead to compliance problems. The Information Commissioner does however recognise that currently many websites set cookies as soon as a user accesses the site. This makes obtaining consent before the cookie is set difficult. Wherever possible the setting of cookies should be delayed until users have had the opportunity to understand what cookies are being used and make their choice. Where this is not possible at present websites should be able to demonstrate that they are doing as much as possible to reduce the amount of time before the user receives information about cookies and is provided with options. A key point here is ensuring that the information you provide is not just clear and comprehensive but also readily available."

Am I right in thinking that cookies are stored from the first page view? Even prior to the login. In which case, any cookie based session storage requires prior consent?

At the moment, I'm in the camp of putting an asterisk on the log in box that references a statement in the footer of the website.  Using pop-up/dialog boxes seems invasive and annoying for the user as does a large ugly message in a prominent position on the page - Exhibit A: The BBC website. Some appear to have done nothing - Exhibit B: http://www.guardian.co.uk ??

Yours dazed and confused,

Kevin.





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lrug.org/pipermail/chat-lrug.org/attachments/20120621/fe162e88/attachment-0003.html>