Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Analytics Illegal in UK after 26 May? Crazy

h30565.www3.hp.com

Post reply on HN
Print view View original

31–40 of 104 posts

Re: Web Analytics Illegal in UK after 26 May? Crazy

#31

Post by wardenclyffe »

icebraining wrote: post #11
jgrahamc wrote: post #7

If you read right to the end of the actual guidance from the ICO it says: --- We only use analytical cookies – if nobody consents that will seriously restrict the amount of information we can get to improve and develop our website The Regulations do not distinguish between cookies used for analytical activities and those used for other purposes. We do not consider analytical cookies fall within the ‘strictly necessar…

Frankly, their policy seems sensible and I'm having an hard time giving a fuck about the webmasters (is this still used?). If you want to track, do it properly with a package installed on your own server. stop subjecting your users to Google's All-Seeing Eye just because using their Analytics is easier for you.

I am currently a webmaster (and I don't know if that's still used either, doesn't feel like it), and this is going to be a huge pain in the arse. The main reason it is a pain is the vagueness of the legislation, nobody has any idea what they can and can't do.

Sure we can follow the ICO and put a pop-up on the site asking to accept cookies or not (which if you select 'not' ironically creates a cookie), but as other people have pointed out that's laughable (for a huge number of reasons) and would push online trade away from uk sites. Easiest option for me would be to shift hosting outside the EU, take the SEO location hit and get back to work as usual (EDIT: it appears I am a little behind on the legislation as last time I read it hosting overseas was a loophole, looks like I need to refresh things).

Alternatively if I could dispense with cookies and shift tracking upstream to a CDN that would also save me the problem and at that point I should be getting even more data such as IP addresses.

Users need to take control of their browsing and privacy, they need to be aware of what they are giving away when they join a site or go online in general. Currently they are clueless and that is what needs to stop, force a prompt for all cookies regardless of country, evens the playing field and make people think for a change (if you're a chrome user "Edit this cookie" is an invaluable plugin for monitoring and removing what each site is placing on your machine).

It's also a bit rich saying that tracking cookies are bad whilst trying to pass a law attempting to track almost all communication:

https://www.eff.org/deeplinks/2012/04/uk-government-proposes...

Re: Web Analytics Illegal in UK after 26 May? Crazy

#32

Post by mwexler »

uggedal wrote: post #19
synx508 wrote: post #17

Earlier quoted context omitted.

This isn't about third party cookies, it's about cookies period - with the exceptions listed in the article. If you use your own analytics package, the chances are it will use cookies, so user permission will still be required. Log parsing isn't sufficient to get user-based statistics.

You can get user-based statistics without cookies with: (new Image()).src="http://your.tld/track.png?ua=" + encodeURIComponent(navigator.userAgent); and then parse your logs. Update: this is just an example, as ars notes the user agent is sent as a HTTP header. But screen resolution etc is not.

Look, there are tons of data available in the browser, see http://panopticlick.eff.org/ for a good example. But they are non-stable for reasons outside of the user's control. So, if a user wants to kill her cookies every day, cool, they can. They can't randomly change their useragent+screen-resolution on a daily basis with the same ease. In addition, UA changes outside of user's control (a browser update pushed on them, for example) and that breaks tracking they may want.

So, no, these workarounds are not the right answer; we need mechanisms that let users control their data and let them choose to share it. It's up to us as product makers to give them a good reason.

Re: Web Analytics Illegal in UK after 26 May? Crazy

#34

Post by mryan »

icebraining wrote: post #26
sparknlaunch12 wrote: post #12

Wouldn't this be easier if browser companies blocked all cookies by default. Users wanting cookies turn of blocker? A lot less browsers than websites?

Possibly, but how is the ICO supposed to regular browser vendors?

The exactly same way there are attempting to regulate website owners - by passing a nonsense law that will do nothing to solve any real privacy concerns.

The ICO has the power to force browser vendors with a UK presence to implement this at the browser level. I wonder why they didn't? Short-sightedness? Or perhaps they knew that Google/Mozilla/Microsoft are more capable of presenting a unified front to fight this, compared to however many thousands of web developers are affected.

Re: Web Analytics Illegal in UK after 26 May? Crazy

#35

Post by wardenclyffe »

mapleoin wrote: post #6

Disregarding the implementation details (which will probably evolve and adapt if this ever gets mandatory) I think it's a totally sensible thing as far as the user is concerned. I have the right to know how the information I send you is being used. If you'd like to track me, I'd rather have to opt in than opt out .

You have the ability right now, go to your settings and switch your cookie handling to "prompt me for all cookies", and tada! you are now in control.

It's a pain I admit, but such is the burden of maintaining your privacy online. Whenever I set up a computer for friends or family I always do this (as well as blocking flash and javascript as standard) and explain what it entails, because without that they cannot know what they are giving away.

Re: Web Analytics Illegal in UK after 26 May? Crazy

#36

Post by mryan »

mapleoin wrote: post #6

Disregarding the implementation details (which will probably evolve and adapt if this ever gets mandatory) I think it's a totally sensible thing as far as the user is concerned. I have the right to know how the information I send you is being used. If you'd like to track me, I'd rather have to opt in than opt out .

I believe you are in the minority - most people, even on HN, are probably comfortable (or apathetic :-) ) enough to accept the status quo.

If you are really serious about protecting your privacy online, I imagine you already have your browser configured to deny all cookies except those which you explicitly accept. The tools to solve this problem already exist - either built in to the browser, or easily available as extensions.

Re: Web Analytics Illegal in UK after 26 May? Crazy

#37

Post by vasco »

icebraining wrote: post #24
vasco wrote: post #13

Who is forcing users to go to a website? I consider a website the same as someone's house. While I'm interacting with their server its obvious they'll want to know what I'm doing. Its tracking people outside of a website's scope that should be allowed only with consent, such as facebook tracking people when they go to sites with a like button and so on

A site is much more like a shop - private property, but a public place, and therefore it has legal restrictions if you want it open to the public.

Sure, but I still need to know where you are and what you're doing in the "shop" to make sure you're not just making it crap for everyone else

Re: Web Analytics Illegal in UK after 26 May? Crazy

#38

Post by wardenclyffe »

mapleoin wrote: post #3
Nikkau wrote: post #2

Question : how do you remembers that users say no without cookie?

I think the assumption is that you don't do any tracking by default and then the first cookie you set is to allow you to set other cookies in the future. The ICO would have website owners pop up a box to new users asking them to give consent to using cookies.

The ICO would have website owners pop up a box to new users asking them to give consent to using cookies.

Which if they refuse has to create a cookie so that their selection is remembered.

(Edited for clarity)

Re: Web Analytics Illegal in UK after 26 May? Crazy

#39

Post by arctangent »

ars wrote: post #27
jamiecurle wrote: post #18

Earlier quoted context omitted.

What you're suggesting sounds like a dark pattern to me.

He's joking. But like all good jokes there's an element of truth since I suspect that's exactly what some websites will do.

He's not joking.

Take a look at what the ICO themselves do - they show a consent box at the top of every page unless and until you opt in:

http://www.ico.gov.uk/

Re: Web Analytics Illegal in UK after 26 May? Crazy

#40

Post by DanBC »

mwexler wrote: post #30
icebraining wrote: post #20

Earlier quoted context omitted.

Yes, but they also say "we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action." So in theory all cookies are the same, in practice they're not - first party analytical cookies are mostly safe.

The law is the law as it's written and then as it's reflected in court decisions. We can't choose to do what is defined as illegal just because a FAQ says "we probably won't come after you". That's a risk that many businesses can't afford to take. It's a poorly written law, and as is often the case in laws as knee-jerk reactions to tech changes, throws the baby out with the bathwater. I do think this law shows that w…

> The law is the law as it's written and then as it's reflected in court decisions.

That's true. While I'd welcome clearer law it's important to point out that it's the ICO who'll be enforcing the law, so if they say they're not going to go after people it's safe to say they won't.

If anything people want the ICO to be a bit tougher - there are plenty of actually dodgy privacy invading practices going on the the ICO seems to be powerless to stop.

> knee-jerk reactions

This law has been a long time in the making. Self-regulation would be ideal. But there are too many operators who are willing to ignore sensible privacy standards for self-regulation to be possible. Unfortunately some of those bad actors are going to ignore any laws.

Post reply on HN