New U.K rules for use of cookies 26 May 2011 - response from actinic pls?

[Bob McAlister]

It's not so much as what the law says, its the media.

We will be keeping an eye on this. A lot will depend on how the recommendations develop as enforcement is phased in, and how it is received by the internet-using public. There may be some push back, because if the law is strictly enforced it will make a lot of web sites less functional and/or less easy to use. It's pretty ill conceived IMO, and I suspect it will have to be toned down at some point. Whatever emerges as legal and best practise, we will follow that.

Hello, The publicity behind the new laws is more of a worry than the actual law itself. I noticed some time back, when the media gets its teeth into online security matters, sales drop substantially for a week or so, before the public pick up again and continue to surf for their wants or needs. Whilst I'll admit to being a bit ignorant of how the internet really works, it puzzles me as to why this issue has not been addressed before now. I do get peeved with Amazon for example directing their promotions at me, for my websites I do not follow-up, sell or share any customer information and wouldn't want to, so cookies are of no interest to me personally whatsoever! I understand potential customers can view most sites with the Cookies switched off in their browser, however they are unable to make a purchase unless the cookies are enabled, if this is true, why is it only the purchasing gateway that requires this setting and how do site owners know what is happening to such information required by our payment gateway?

[guccij]

Just updated to Firefox 6. Under preferences there's what looks to me to be a new tick box "Tell web sites I do not want to be tracked." Is this new? Can't check as only have laptop with.

[Duncan Rounding]

There's some limited info about this here: http://support.mozilla.com/en-US/kb/...es-tracking-me

[malbro]

Just updated to Firefox 6. Under preferences there's what looks to me to be a new tick box "Tell web sites I do not want to be tracked." Is this new? Can't check as only have laptop with.

None of the current DO NOT TRACK additions to browsers do anything to solve the requirements regarding cookies. It is a voluntary system requiring the web site to recognise the information in the header and use it to turn off tracking software of any kind. This clearly covers Ads and Google Analytics but what about the cookies we have to use as part of the actinic selling process (the cart cookie for one). It is not clear that this and other Actinic cookies are covered by the get out in the legislation, we might feel it is but in the end it will come down to those who police the legislation.

Actinic and all other ecommerce sites use cookies to hold information relevant to the sale, these cookies cannot be disabled without disabling the web site and are not really the target of the legislation they just got caught up in the over kill effect.

That said as web site operators we are in the end responsible for meeting the requirements and not the web site software suppliers, some indication from Actinic as to how they propose to help solve the problem, including handling the new information from the browsers, would help us all in dealing with a resolution. We are steadily approaching the 12 month deadline and have to be seen to be finding a solution, not only for new sites but also all the existing ones on V10, V9, V8 and earlier.

[brucet]

These are the cookies used by Actinic:

ACTINIC_CART. The shopping cart. Specifically excluded from the scope of the regulations.

ACTINIC_BUSINESS. The login digest for logged in customers.
ACTINIC_CONTACT. The 'Remember Me' details.
Provided agreement to the Terms and Conditions is enforced in the checkout (the default setup), consent for both of these is obtained before they are used.

The following are necessary for the correct functioning of the associated elements of the site. In version 11.0.2, the boilerplate Terms and Conditions are being updated to cover this.
ACTINI_REFERER. Returns the customer to the last page visited after completion of the checkout.
ACTINIC_RECENT. Records the image filename(s) for the ‘Recently Viewed Products’ list, if enabled.
CART_CONTENT. Stores the cart value and item count for the shopping cart summary.
LAST_SECTION_URL. Used by the ‘Back’ link on the Product Page, to return the visitor to the correct Section Page.

[animal dreams]

Hi Bruce,

Boilerplate Ts&Cs just doesn't cut it IMO. As you point out a number of cookies are used before getting anywhere near checkout. Just landing on the home page sets 5 cookies.

The regulations (at least the ICOs interpretation) stated that explicit permission must be obtained. New EU Cookie Law

Perhaps this is another case of British bureaucrats being over zealous but it's what we have to work with.

I believe we need some specific advice from Actinic as to how to implement this technically, i.e how to stop cookies being set if the user does not accept.

Alan

[brucet]

At the moment we are aiming to keep no more than a step ahead in this particular game, partly because we got bitten once before over legislation like this. We did a load of development to support P3P policies, but they were never widely adopted. The idea fell by the wayside, and our investment was wasted. The cookie legislation is, TBH, so patently daft that the same thing is likely to happen to it. So for the moment we will follow the market and respond to any suggestion of actual enforcement, but we are not going to lead the way.

Having said that, it's all about perception and I realise there are anxieties that we should allay if we can. As a next step I will talk to our developers and see if there is a way to disable the cookies in question without fundamentally destabilising any part of the product. It would involve some changes to the Perl scripts and some layout changes IWHT, and some loss of functionality. But we may be able to put something in the Knowledge Base for those who are concerned.

[animal dreams]

Thanks for the response Bruce.

I agree that the legislation is daft.

Unfortunately that doesn't protect the poor website owner.

As has been said previously, I don't believe they will make an example of one of the big players.

[cbarling]

The legislation exempts anything that is essential to the operation of the site. There is a strong case that all use by Actinic of cookies qualifies under this heading.

Chris

[leehack]

I'd agree largely Chris apart from on address details, Actinic does not need that info retained once a purchase has completed. When you go back to an actinic site where you have purchased before, your address details can be retained. I don't see a need for that.

This will be a storm in a teacup for me, just like PCI DSS, what are we now, 4 or 5 years on and we still have people using the java applet. Does jo public give a monkeys about this, i'm yet to hear of one I must say, how did the internet possibly manage for all these years without this rule, simple answer because it is largely irrelevant and only relevant to people who abuse these areas, who will continue to do so anyway.

Pathetic people in pathetic jobs creating pathetic rules to justify their pathetic positions (IMO).

[Mike Hughes]

As Bruce said though, the address cookie is only used with the visitors express permission (remember me) so there should be no problems there as far as the legislation is concerned. I would maybe make sure the description explains that this uses a cookie.

Mike

[Steve G Griggs]

Been keeping an eye on this saga in various online/printed publications:
The last I saw re the cookie saga was that 1st party cookies being used for shopping cart functionality would most likely be exempt, and that this was aimed more at third party use for collecting info for advertising...
Watch out Facebook?
But as with all these things I would hesitate to say that what I have said will be legal or the final outcome, but cookies in and for the shopping cart looks set to be exempt as far as I can see.

Having just posted the section above I saw this on BBC website:-

Internet company Google has gone ahead with its new privacy policy despite warnings from the EU that it might violate European law.
The change means private data collected by one Google service can be shared with its other platforms including YouTube, Gmail and Blogger.
Google said the new set-up would enable it to tailor search results better.
But data regulators in France have cast doubt on the legality of the move and launched a Europe-wide investigation.

http://www.bbc.co.uk/news/technology-17205754

There's a whole can of worms...

[Duncan Rounding]

I doubt facebook will be affected either because to see 'targetted' ads you need to be signed in - similarly for google.

[leehack]

Google Analytics was one that I thought would fall foul?

[Steve G Griggs]

Not too sure about Analytics, as far as I'm aware it's not cookie based but javascript, and it's only used for tracking visitors to your website and recording it in a private account that only has authorized password protected access.
I cant quite see how that could fall into the category of third part targeted advertising cookies (but then I'm not a crafty EU law solicitor).