Live data from Hacker News

UK websites place average of 44 cookies on first visit

ico.org.uk

21–30 of 43 posts

Re: UK websites place average of 44 cookies on first visit

#22
post #8

Earlier quoted context omitted.

When I visit the ICO site I also get a "civicCookieControl" cookie which you don't list. I guess that this is probably coming from javascript and your site isn't processing this?

It's running a headless browser with JS enabled so it should be there... not sure why it doesn't pick it up. Thanks for the mention :-)

If you are running PhantomJs, did you encounter any issues like memory leaks and socket errors ?

I'd be interested in the solutions you used to solve issues like that if it's not proprietary / private.

Re: UK websites place average of 44 cookies on first visit

#23

This article is completely incompetent. Firstly - any number of cookies from a single domain are equivalent, you can always use whatever identifier is in the cookie's data to store and retrieve an arbitrary amount of data about the user. That there are lots of them implies either that the site is using a bunch of different front end libraries / components that don't talk to one another (which is irrelevant from a pri…

>> opposite of a privacy issue, since it's keeping your data in your browser.

In a way instantly accessible to the host site. Data I wasn't really consulted about. Data I might not be comfortable sharing every time you ask for it.

This whole law about disclosing cookie use, which I will agree is not necessarily a good approach to the problem, does nevertheless exist because of a problem - People getting tracked, followed and profiled without their permission. Website operators and browser-makers seemed to be complicit in this. Some website operators seem to think it's their god-given right to do whatever they want in the browser on my computer...

Re: UK websites place average of 44 cookies on first visit

#24

This article is completely incompetent. Firstly - any number of cookies from a single domain are equivalent, you can always use whatever identifier is in the cookie's data to store and retrieve an arbitrary amount of data about the user. That there are lots of them implies either that the site is using a bunch of different front end libraries / components that don't talk to one another (which is irrelevant from a pri…

I completely disagree with your assessment, and I don't understand why you're so offended by it.

The article is accurate and provides details of the methodology and results. Of particular note, if you look at the report, is that two thirds of cookies on UK sites are third-party ones. That's a significant number, and means the average site places 30 third-party cookies on a users machine.

Your proviso about being 'from a single domain' is pretty much irrelevant – that's not the issue at all!

Re: UK websites place average of 44 cookies on first visit

#25
post #6

It seems a bit disingenuous to present numbers like that. For the lay person, it may sound scary that there as 44 cookies on a given page, but that's a completely arbitrary measure. I would think that the important thing isn't the number of cookies, but rather what which entities they are shared with and to some extend the information attached to them. First party cookie for example are not a privacy issue at all.

The full details are right there in the the report, but I don't think that's a misleading headline number to use.

Re: UK websites place average of 44 cookies on first visit

#26
post #17

Self plug: we've developed cookie-checker.com. A way to check which cookies are placed with first time visitor. ico.org.uk places 3 cookies (1 session, 2 other valid up to today and 2017): http://www.cookie-checker.com/check-cookies.php?url=ico.org....

humorously, checking the site itself seems to trip it up: http://www.cookie-checker.com/check-cookies.php?url=cookie-c...

that's a feature ;-)

Re: UK websites place average of 44 cookies on first visit

#27
post #21

When cookies were first introduced a number of sensible people had reasonable concerns about privacy. I'm not sure how we got from there to here - a sub-optimal law and not-great research (81 sites?) all while companies aggressively collect and mine data.

Laziness and greed. But really, it's mostly laziness. If you tell someone cookies are 100% bad because they kill kittens, people won't use them unless they want to kill kittens. If you nebulously say that they might potentially be used to kill kittens at some point in the future, nobody cares.

Re: UK websites place average of 44 cookies on first visit

#28
post #12
post #6

It seems a bit disingenuous to present numbers like that. For the lay person, it may sound scary that there as 44 cookies on a given page, but that's a completely arbitrary measure. I would think that the important thing isn't the number of cookies, but rather what which entities they are shared with and to some extend the information attached to them. First party cookie for example are not a privacy issue at all.

In my opinion it is actually pretty scary. As I see it, a website should upon landing either set zero or one cookie, depending on if the website has some sort of persistent functionality (like a message to first time visitors). The other 43 cookies are, in my view, therefore unnecessary to the normal functioning of the website, and is therefore more likely being used for other purposes such as tracking and advertisin…

Sadly I think that a lot of businesses either don't care or don't think about the cookies and tracking added to their site.

In my experience it's usually the marketing department that want much, not all, of the things that end up setting cookies. It's not that it's a bad idea necessarily, but it's adding tracking upon tracking upon tracking and rarely a request to remove something. Some sales person try to sell marketing "Yet another up-sell tool" or "customer retention solution" and no one considers that the site already have five of those tools installed, 3 of which isn't actually used anymore and the last two we aren't really sure of.

I think it's a scam mostly, trying to convince businesses that they're leaving profit on the floor. The providers of these tools leave real businesses jumping from one tracking/data-mining/customer-spying to another in the hope that it will boost their sales by a few percent. Do we really need to know know that much about our customer? Probably not.

Re: UK websites place average of 44 cookies on first visit

#29

This article is completely incompetent. Firstly - any number of cookies from a single domain are equivalent, you can always use whatever identifier is in the cookie's data to store and retrieve an arbitrary amount of data about the user. That there are lots of them implies either that the site is using a bunch of different front end libraries / components that don't talk to one another (which is irrelevant from a pri…

I completely disagree with your assessment, and I don't understand why you're so offended by it. The article is accurate and provides details of the methodology and results. Of particular note, if you look at the report, is that two thirds of cookies on UK sites are third-party ones. That's a significant number, and means the average site places 30 third-party cookies on a users machine. Your proviso about being 'fro…

You're right, the study's not worthless - the "key findings" are all accurate and portray a reasonably sensible, true-to-life picture of the results, and we do need more easily-consumable, experimentally-justified content to help ensure that the public doesn't end up backing stupid laws.

That said, the article's focus on 31st December 9999 and outliving the lifespan of the user, the discussion around the number of cookies served (rather than the number of parties serving cookies, and the amount and type of data that they're storing, which is what we're really concerned about here), and the click-baity headline to both the page and the HN article take what was probably a very sensible study and pervert the reader into drawing conclusions for all the wrong reasons. Giving public funding to something that's going to place that sort of bias (which in a private news publication would be fine) between the public and science I find pretty galling.

Post reply on HN