Web Analytics Illegal in UK after 26 May? Crazy

However, what about the other direction? Suppose your company comes to their attention through some other means, and they start investigating. At some point, you could find yourself answering questions under oath. It's conceivable the questioner might go on a fishing expedition, and ask "Have you ever posted on HN under the alias Johnny Flash?" (he might ask that at every company he investigates).

Then you've got the annoying choice between telling the truth and making your company's case for accidental violation much worse, or lying under oath which, if that is discovered, could bring serious penalties.

Just because said stalking is automated, used for commercial purposes and has been renamed with cool souding euphemisms doesn't suddenly make it acceptable. Neither is the fact that it currently happens on such a large scale that it affects virtually every website.

These laws aren't crazy, they are a gradual return to sanity. The EU isn't crazy either. The directive sets the baseline for what is and what isn't allowed in principle, allows for plenty of wiggle room and the way it is actually implemented and enforced will be a gradually process.

All this over the top ranting without showing any self-reflection or attempt at self-regulation is exactly why this is now forced upon us from above in the first place. The EU and various government en consumer organisations have repeatedly called for the industry to keep itself in check.

Instead, the industry has gone completely mental under the motto "we do it because we can", and as a result we now have a commercial surveillance network that surpasses anything any totalitarian government could have ever dreamed of. And which on top of that blatantly violates already existing privacy laws.

Congrats. Well done. We've awoken the beast of government regulation, and we only have ourselves to blame. You can't keep pissing all over consumers and civil rights without it resulting in some kind of backlash.

That is a grey area at best.

For one thing, a cookie that has a dual purpose, controlling both logging in and analytics, appears to give up any exemption on the grounds of strict necessity that a cookie used only for logging in would be granted. You would probably be required to provide all kinds of explicit information about your use of the cookie to anyone before allowing them to log in and setting that cookie, adding at least one extra step to your sign-up process (or making use of a single sign-in service much less convenient for your visitors).

For another thing, that still restricts your analytics to cases where someone is already logged in or otherwise actively using your site. Often the more interesting things to know relate to visitors to your site who are not (yet) so active: what are your best traffic sources/keywords, where do new people come into your site and where do they go next, and where do they give up if they don't convert?