Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ICO.gov (click on continue without agreeing to cookies)

ico.gov.uk

Post reply on HN
Print view View original

21–30 of 56 posts

Re: ICO.gov (click on continue without agreeing to cookies)

#21

Post by andersju »

benjash wrote: post #10

I really want to know what there jurisdiction and who this effecting. Does this apply to all EU traffic? OR does this only apply to websites hosted within the EU? OR does only apply to EU companies? Plus how on earth do they plan to enforce this?

Unfortunately this is not just a UK thing. Every EU country is forced to do this.

A similar law was passed in Sweden just the other week and will come into effect on July 1, despite heavy criticism from pretty much everyone.

So how could they pass such a law? It's from an EU directive, more specifically 2009/136/EC [1]. A directive is something that every member state is _required_ to implement into national law, whether they like it or not. AFAIK every member state is supposed to have implemented this by now. Sigh.

[1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...

Re: ICO.gov (click on continue without agreeing to cookies)

#22

Post by yaix »

Argh!

99% of people have no clue what a "cookie" is used for and just hear that it is "evil" and such. At the same time, these same people have no problem exhibiting themselves of Facebook or tracking their positions on Foursquare.

@gov: Just make something like this (http://www.networkadvertising.org/ > "Conumer opt-out") legally binding for tracking networks (not for individual web sites!) and the whole "Cookie" paranoia is solved.

Re: ICO.gov (click on continue without agreeing to cookies)

#23

Post by amouat »

xedarius wrote: post #17

This is exactly why we are currently cutting back on bloated Government departments in the UK. I can see this being repealed in 12 months, it's a ridiculous, unenforceable law.

To be fair, I think it's based on a European directive that all European countries will need to enforce sooner or later (unless it gets changed).

Re: ICO.gov (click on continue without agreeing to cookies)

#24

Post by gurraman »

The Internet is a really big part of our current society; the concern of a lot of people. You'd expect that the advisory board of decision-makers of such important things would consist of the smartest and most knowledgable persons available - the persons who invented the web, the persons who are making it work and who are taking it forward.

I haven't done any research. Does anyone know who gives these guys advice?

Re: ICO.gov (click on continue without agreeing to cookies)

#26

Post by jschuur »

Couldn't a site just declare a single session ID as essential, and store everything else server side? Or is the problem that you usually don't keep server side session data indefinitely? I suppose you couldn't use client side JavaScript on your cookies in that case either.

Does this apply to HTML5 localstorage too?

Re: ICO.gov (click on continue without agreeing to cookies)

#27

Post by Silhouette »

From the linked page:

> Currently our website contains one cookie that we do not use, but is essential for part of the site to operate. At present we have left this in place across the site, as we’re unable to remove it from one part of the site without affecting another. This session cookie is set on a user’s arrival to the site - at which time they’re informed that the cookie has been set - and is deleted when a user leaves the site.

I'm fairly sure the advice from the ICO that I read earlier was quite blunt about cookies that were not strictly necessary: you can't set them without consent just for your own convenience.

There is a silly box at the top of their page that asks you to accept cookies and tells you off if you click "Continue" without doing so, which seems entirely contrary to the principle of this new law to me, before you even get to this mysterious cookie they apparently set anyway.

Re: ICO.gov (click on continue without agreeing to cookies)

#28

Post by spjwebster »

benjash wrote: post #11
patrickaljord wrote: post #6

That's the same site that paid £585 for their favicon http://news.ycombinator.com/item?id=2175321

I think that says it all. Clueless.

I take it you didn't read the comments on that post then? The ones that explained why the upfront cost of £585 is not at all unreasonable.

Re: ICO.gov (click on continue without agreeing to cookies)

#29

Post by spjwebster »

Silhouette wrote: post #27

From the linked page: > Currently our website contains one cookie that we do not use, but is essential for part of the site to operate. At present we have left this in place across the site, as we’re unable to remove it from one part of the site without affecting another. This session cookie is set on a user’s arrival to the site - at which time they’re informed that the cookie has been set - and is deleted when a us…

The important bit is "but is essential for part of the site to operate." To me, that clearly falls under the "strictly necessary" banner, albeit that it probably shouldn't be set until you enter the part of the site that requires it.

Government IT moves at a glacial pace, and just like everyone else they're still trying to figure out how this stuff should work. That's why they've deferred enforcement for a year.

Re: ICO.gov (click on continue without agreeing to cookies)

#30

Post by spjwebster »

yaix wrote: post #22

Argh! 99% of people have no clue what a "cookie" is used for and just hear that it is "evil" and such. At the same time, these same people have no problem exhibiting themselves of Facebook or tracking their positions on Foursquare. @gov: Just make something like this ( http://www.networkadvertising.org/ > "Conumer opt-out") legally binding for tracking networks (not for individual web sites!) and the whole "Cookie" p…

The previous implementation of the law was opt-out. It didn't work, because most users were completely unaware they were being tracked.

The real saviour will likely come in the shape of browser support for Do Not Track [1]. While it's not fine-grained enough to be used as the sole mechanism for gaining user consent for all non-essential cookies, it at least covers the 3rd party tracking cookies that were the motivation behind this law change. Note that DNT specifies that the default MUST NOT be opt-in:

> A user agent MAY adopt NO-EXPRESSED-PREFERENCE or OPT-OUT by default. It MUST NOT transmit OPT-IN without explicit user consent.

[1] http://tools.ietf.org/html/draft-mayer-do-not-track-00

Post reply on HN