It turns out that ico have gone back a bit on their 'get consent first' approach to cookies and now introduced 'implied consent'

 

You can read the updated pdf version here

 

 

From what I could gather from it, implied consent means that if someone visits or browses the pages of a website you can assume they consent to cookies being set, but only provided that there is an easy way on the site for them to opt out.

 

Who knows how long it will stay like this but at least it makes life a little easier when building a site.

Edited May 26, 201214 yr by Dizi

Back a bit? More like one step forward then 10 steps back!

 

Implied consent is good news, as that allows us to simply provide a mechanism for users to opt out (which few wiil!), rather than use fiddly optin.

 

Good find

Back a bit? More like one step forward then 10 steps back!

 

True.

 

As much as I hate to quote a 'Guardian' article I thought this sentence put it well:-

 

"the Information Commissioner's Office (ICO) has said that websites can assume that users have consented to their use of them."

 

My link

Back a bit? More like one step forward then 10 steps back!

 

 

Agreed it is a big step forward for us but I meant that the ico have backed down a bit on the whole opt-in before cookies are set to allowing it to be a clear opt-out setting instead. This is something I'm a lot more happy to fall in line with as it gives people more control without directly damaging businesses, which the opt-in would have done

With the addition of the implied consent rule, you could do as the BBC or BT do which is on first visit state that the site has set cookies and if they want to opt out give them a way to do so, then set a cookie so the message doesn't show for them again, but have something somewhere so they can go and change their opt-in/out status as they choose.

 

If just GA is being used then instead of creating a script to stop the cookies on a site, you could probably just point them to the GA opt-out page, so that they can opt-out of GA all together. This is no way legal advice but in my opinion shows the site is actively taking steps to follow the very vague guidelines on what to actually do.

Thank god someone at ICO saw sense.

Good find!

What a bunch of cretins.

 

So, now that it's the law to allow people to opt *out* of cookies instead of making them opt in, are we obligated to teach them how to disable cookies in their browser?

 

Or do they expect us to use *retches* javascript?

 

And what if the user has js disabled? Or is using lynx? In fact, doesn't lynx ask you to confirm acceptance each time a domain tries to set cookies?

 

Maybe I'll post a download link on my site. Best viewed in any version of lynx. You saw it here first, folks

I'm just gonna put a link at the bottom that says...

 

This site uses cookies!

If you don't like it either grow some or sod off

Edited May 26, 201214 yr by MikeChipshop

cookies have a bad name, and wrongly so too.

 

I wish ICO did more to inform the general user that cookies have been a staple diet of websites for years and they (generally speaking) do more good than bad.

This site uses cookies!

If you don't like it either grow some or sod off

 

he he - or if you're polite:

 

You can opt out of cookies - mind you, we'll still have to place a cookie on your system with your details so we know not to set cookies.

Trying to plant all the cookies as per usual and begging forgiveness from visitors with some form of pop-up (or slide in/down tab) is the prefered measure for many of the sites I've seen over the last few days, particulary those supported by advertising.

 

Of course the real fun begins when users start to realise that "cookies" come in several forms that their web browser does not display or have control over by default without the aid of one or more plugins.

 

Do you remember trying to remove your first 'EverCookie' ?

I'm EXTREMELY glad I found this thread today... and EXTREMELY glad the ICO have taken quite a few steps back!

 

Personally, I feel this law is completely flawed in many many ways.

However the biggest flaw ( which some of you have pointed out ) I think is..

 

If a visitor OPTS OUT ... then we still have to use a cookie to track their requests so they are not actually opting out in theory!

 

It's a catch 22 .. Ad infinitum ..

 

 

With regards to Google Analytics

------------------------------------------

I'll be totally honest, I had never heard of the "opt out" plugin (https://tools.google.com/dlpage/gaoptout) until now... which now makes me think of avoiding GA completely for my projects from now on. It means I can never trust it's information as someone may have this plugin installed.

 

In all fairness I utilise a few different analytic systems ( such as Piwik and OpenWebAnalytics ) and recently been looking at using Inspectlet.

I have always noticed slight variation on all the stat systems... but now my views on GA will not be the same

Edited May 27, 201214 yr by AlexsDesign

The most I'm going to do for my sites is a small link at the bottom of each site in the footer titled 'cookie optout' if click the visitor well get a popup explaining why cookies are used and how crucial they are to the workings of the Internet, if they still want to opt out then they'll be told they can no longer view the page and be redirected to Ggogle.

 

I've no time for the government trying to regulate what they (quite obviously) do not understand and those paranoid few desperate to opt out of cookies should either be educated or forgotten.

This is what the law requires:

a person shall not store or gain access to information stored, in the

terminal equipment of a subscriber or user

Hang on... doesn't that include the UA string?

 

Currently at work we're just putting a little note at the bottom of the page that says "as an eCommerce store we set cookies, check the privacy policy for more details" or words to that effect. I going to try and push us to create a template that says "this store uses the following cookies for it's own purposes

1. and we use the following tracking cookies - check their privacy policies for more info [link to GA privacy etc]" because that's what I

think we're meant to be doing. I guess we could store a cookie that says "I fear cookies and want nothing to do with them, God help you if I find a cookie!" and wrap our analytics around an if statement (probably server-side) that checks it, but I think we can get away with just explaining the cookies and passing the buck on cookies we don't control.

 

I'm not being funny here, but

 

Since 2003 anyone using cookies has been required to provide clear information

about those cookies.

When was the last time you heard anyone get in trouble over cookies? Apparently we've been liable for the past 9 years.

 

What I really hate about this law is that there are so many retractions and so much mis-information that I have no idea at all what is and is not allowed - and I work in the industry! What possible hope does the average user have?

I know that PDF has a handy table that sits on page 14, but doesn't that have a lot of overlap? The security cookie could be something ilke the session ID - that's fine, we don't need concent for that. But if we use that cookie for analytics (because it's about as unique an ID as anything else) that's not allowed?

Edited May 27, 201214 yr by Skateside

For the most part, doesn't the standard privacy policy suffice (the ones we've all probably already been using)

 

Here's a sample from one of mine:-

 

How we use cookies

 

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

 

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

 

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

 

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

 

If we have that on our website and a visitor continues to use the website, then we can take the stance that the visitor has consented? If not, they don't use the website. This puts the impetus back on the user of the site, in line with the latest ICO ramblings.

Edited May 27, 201214 yr by oakleaves

From what I can decipher (after three pots of coffe and skype working overtime)is that the opt in/ opt out problem has died a death but you still have to make all visitors painfully aware cookies are being used. Government sanctioned nagware is a great description!

 

Outlaw.com (Pinset-Masons Law firm) has probably the most complete implementation I've seen so far but they don't carry advertising so for them it's not that hard.

 

I think the way to approach it is rather than have a Privacy page that says..

"We was forced to tell you we use cookies"

 

Is to say ... "Hey do you want the benefits of cookies!"

http://www.bbc.co.uk/news/technology-17842925 makes for an interesting read.

 

I've modeled my own version along the lines of 'the register', the logic being they operate a similiar website funded by advertising plus being way bigger than me if the ICO starts shooting then should cop a bullet first and I'll know to duck!

One of my clients received the following email:

 

U Cookie law is here. This is what you need to know and how it affects your company.

 

The deadline has arrived, are you now breaking the law?

 

What is the Law?

 

The EU cookie law requires all websites to notify users that the site uses cookies and to seek permission from the user for certain types of cookie. It has been in UK law since May 2011 but website owners have been allowed a year's grace before the law is enforced. This grace period expired on the 26th May 2012. The fine for non-compliance is up to half a million pounds.

What is a Cookie?

Cookies are small bits of information that a website stores on your computer. They are usually there to make your browsing experience better or to gather information about the website user’s behaviour for the site owner. For example it allows a website to recognise if you have visited that site before or for information to be used with Google Analytics.

 

How Does it Affect Me?

If your company has a website, you will almost certainly have to make changes to your site to comply with the law.

 

How Can XXXX Help?

XXXX can run a full EU Cookie Compliance Audit on your website for just £85 plus VAT. This will include a full list of cookies your site uses and our recommendations for ensuring your site is compliant. Just click the link below and fill in your details and we will run a full audit on your website.

http://www.XXXX.co.uk/welcome/cookielaw/

I’m sure you will agree that £85 plus VAT is a small price to pay to find out what you need to do to avoid the risk of a heavy fine of up to half a million pounds!

Kind Regards

XXX

XXXX Digital Marketing

 

I AM aware of all this but do i really have to mess about and do all of this ??

 

I hate the government.

[Threads merged]

How are you guys going to handle existing clients?

 

Ultimately if companies are required by law to comply then they have little to no choice but to do so and we'll charge by the hour to implement.

How are you guys going to handle existing clients?

 

I was wondering about all the previous clients and whose responsibility it is. I'm guessing unless they have paid for ongoing maintenance then as soon as the final bill is paid the site becomes their responsibility.

 

Might be an idea to give them a heads up at least and if they would like something implemented then it's £25 per site. 20 sites that's an easy £500. The question is what to implement - an opt-in or opt-out system or simply a link explaining cookies.

I was wondering about all the previous clients and whose responsibility it is. I'm guessing unless they have paid for ongoing maintenance then as soon as the final bill is paid the site becomes their responsibility.

 

Might be an idea to give them a heads up at least and if they would like something implemented then it's £25 per site. 20 sites that's an easy £500. The question is what to implement - an opt-in or opt-out system or simply a link explaining cookies.

 

 

^^^ this.

Once the site is done and handed over, we can't be held responsible for whatever the government or the user decides to do in the future. Would be a different story if we knowingly had mislead clients.

Agree entirely, we're already working on a strategy to tackle this with a mail shot explaining the situation.

 

If they chose to ignore it, at least we've done our part!

Every site I've seen, it's a box that says if you use the site then you are accepting their use of cookies. Yet strangely, they all still have an Agree button. It's confusing - what happens if you don't click Agree, the implication is the cookies are used anyway. So why have an Agree button? Meh.

This seems to be an good easy to understand article on it: http://www.wired.co.uk/news/archive/2012-05/25/cookies-made-simple

 

What I don't understand is, won't this damage Google Analytics? People will stop putting Analytics on their site so they don't have to put an accept cookie button. Also does this mean that we have to have an accept cookie button on every page?

 

I can't understand how they will enforce this. Surely there are millions of old sites that have been forgotten about, but will have some sort of analytical package on. Are they going to fine all those people? How can they give such little notice and little awareness and expect people to make changes?

How can they give such little notice and little awareness and expect people to make changes?

 

 

Actually they've been on about this for quite a while, a few years if memory serves.

 

Any notion of fines is ridiculous and I suspect probably unenforceable until more clear guidelines are in place

 

 

Won't this damage Google Analytics?

 

It seems to me that the biggest bugbear of ICO is exactly that. I can see why to some extent, I am also sick of Google knowing what I had for breakfast and how hot I like my tea.

Edited May 29, 201214 yr by oakleaves

Actually they've been on about this for quite a while, a few years if memory serves.

 

Any notion of fines is ridiculous and I suspect probably unenforceable until more clear guidelines are in place

 

It seems to me that the biggest bugbear of ICO is exactly that. I can see why to some extent, I am also sick of Google knowing what I had for breakfast and how hot I like my tea.

 

I have just spoken to a couple of people about this. It seems their solution is to add an opt out button somewhere on their webpage, despite the new law requires them to add and opt in button. Is anyone taking this new law seriously at the moment?

Anyone using pandadoodles script?

 

http://www.pandadoodle.com/cookies/

Edited May 29, 201214 yr by oakleaves

A simple site using, say GA and a few social share icons will be absolutely fine displaying a cookie policy with clear instructions as to what cookies are, why we need them and how to block/remove them.

 

As long as, as a developer/designer, you can say and show that you have made adequate effort to inform the end user then you have done your job.

 

No need for any ugly pop-ups or the like.

A simple site using, say GA and a few social share icons will be absolutely fine displaying a cookie policy with clear instructions as to what cookies are, why we need them and how to block/remove them.

 

The problem is that GA falls outside the 'essential' bracket, so on first visit you should be asking the users to opt-in.

The problem is that GA falls outside the 'essential' bracket, so on first visit you should be asking the users to opt-in.

No No No! Lol, the legislation was changed on Thursday/Friday, "implied consent" is now acceptable. As long as you make clear descriptions how to block/disable cookies.

No No No! Lol, the legislation was changed on Thursday/Friday, "implied consent" is now acceptable. As long as you make clear descriptions how to block/disable cookies.

 

Ah, sorry my mistake. I rushed my way through this post and didn't read it properly.

 

That's a relief, but going to confuse a lot of people now. They have handled this very badly.

No No No! Lol, the legislation was changed on Thursday/Friday, "implied consent" is now acceptable. As long as you make clear descriptions how to block/disable cookies.

 

Last minute changes, gotta love 'em!

 

... but at least in this case it makes our life easier.

Just as an example of what has changed, Wiltshire Council has added a popup about cookies, see

http://www.wiltshire.gov.uk/artsheritageandlibraries/librarieshome/mobilelibraries.htm

 

I have cookies blocked except session cookies in IE9 and in Firefox I have Cookies accepted until I close Firefox, but I get the popup in both browsers, and after closing the popup and moving to another page, it comes up again - very annoying.

 

I expected to see the popup in IE9 where I have blocked cookies, but not in Firefox where I have accepted them.

 

I have a suspicion that Wiltshire has edited pages to the old cookie rule and will now have to edit them again after the relaxation of the rules.

This is an interesting article about the EU's own actions to the new cookie law:

 

http://econsultancy.com/uk/blog/10011-even-the-eu-can-t-comply-with-its-own-cookie-law?utm_medium=email&utm_source=daily_pulse

Well for most of our clients we've done a simple jquery that expands at the top of the screen with a link to the website's cookie policy and a tick button to accept the message, on accepting the header hides away for good.

 

The policy explains what a cookie is, the benefits of cookies, how to remove them if the user wishes and what the website uses them for with links to privacy policies for use cookies such as Google and Social sites.

 

From our understanding of the ruling that covers our clients as there's a clear message with an opt-in with further details outlining the use and policy of the current site.

So far I've contacted three clients to explain the new law. But they have yet to respond. So I'm guessing they don't understand it. So if that's the case neither will site visitors. It's all a bit pointless really.

I take it you guys are incorporating compliance free of charge in your current work? We have about 10 websites in progress at present and we're adding cookie compliance as part of the fee.

Pretty much. Obviously I'll charge for extra time taken but with the change in the law, the extra time is miniscule.

 

I've noticed a few sites popping up lately with the new law in mind. Check the BBC top gear site or BT's site for example.

The BBC Top Gear site is similar to what we're doing in that it doesn't suggest any form of opting out in their pop-up i.e. informed consent, further information and how to disable cookies is found thereafter.

 

The BT version is just OTT, sure it looks nice, but how many people revisit BT on a regular basis to require such functionality - surely a tiny amount? Seems over-engineered to me.

Any existing sites will be charged a flat rate to incorporate the cookie policy.

 

For current sites, I will simply create a generic page that is automatically created upon theme activation (Wordpress) so as to not incur any extra development time for sites. As Mike said, the change in the law means it is easier to comply now so the time taken is very minimal.