Explicit permission to be required for cookie usage

[guccij]

I think he knows more than you think Sean. He spotted that DCMS statement. Did you?

[Sean Williams]

Good Lord no! I haven't time to be reading all that stuff
C-J is always banging on about broadband in Wales and he always get's his facts wrong and clearly never speaks to those of us suffering both the UK and Welsh governments' complete inabiliy to get it sorted.
IMHO he's been tasked with covering his subject purely with the BBC Breakfast viewer in mind.
Oh. I watch that.

[neildotwilliams]

Information Commissioner's Office (ICO) advice on the new cookie legislation

Ths ICO has released some guidance on the new Cookie legislation.


http://www.ico.gov.uk/~/media/docume...egulations.pdf

[NickD]

Does this consent rule apply to every type of cookie?

The only exception to this rule is if what you are doing is ‘strictly necessary’ for a service requested by the user. This exception is a narrow one but might apply, for example, to a cookie you use to ensure that when a user of your site has chosen the goods they wish to buy and clicks the ‘add to basket’ or ‘proceed to checkout’ button, your site ‘remembers’ what they chose on a previous page. You would not need to get consent for this type of activity.

I am now much happier and have no remaining fear of council goons with clipboards. I think this closes the matter for me. I will however add some descriptive words to tell users what my site does with cookies.

[Duncan Rounding]

This really affects users of analytical and marketing tools such as Google Analytics, Re-marketing etc. These are vital tools for e-commerce and need addressing in some way if you use them. We (all Analytics users) should really be approaching Google for a response on this.

[Mike Hughes]

The guys at Safebuy have just sent me this:

We have just (!) been made aware that the Information Commissioner's Office (ICO) is making a change to the Regulations on the use of cookies on retailers' websites commencing 26 May 11. This has been required by an EU Directive. See below for summary details.

The relevant bulletin is here:
http://tinyurl.com/3nuqo9j

Bearing in mind the information below we will change Clause 7.6 of our Code of Practice from:

7.6 If “cookies” are used the consumer must be advised accordingly and given the choice of opting out.

to:

7.6 If cookies are used the consumer must be advised accordingly and required to agree to their use (‘opt in’) or known to be in agreement by their settings in the internet browser they are using. This requirement only applies the first time the consumer uses the website. Agreement may also be assumed if another program which already has consent is used to access the retailer website.

I've highlighted the bit in red which looks interesting. It explicitly states that browser settings can be taken as agreement by the user to use cookies in line with those settings.

Mike

[neildotwilliams]

I am not sure that they (EU) specifically mean cookies being enabled or not. As cookies are enabled by default I expect them to interpret this as the user not EXPLICITLY giving permission.

I 'guess' that they are referring to the Do Not Track feature which is being implemented in the latest web browsers. See here for a test:
Microsoft DNT Test Page

I think the FCO are still trying to interpret the EU rule themselves. I am trying to interpret their interpretation.

It would be very easy if cookies being enabled can be read as the user giving permission!

Anyone else have any thoughts on this?

Regards
Neil

[Chunkford]

Anyone else have any thoughts on this?

You don't want to know what my thoughts on this are. I will get banned

[neildotwilliams]

I know that feeling

Can they ban you if they can't track you?

[Mike Hughes]

Read the link for more details:

http://www.ico.gov.uk/for_organisati...gulations.ashx

It appears that the 'advice' is not to rely on browser settings at present as the cookie settings aren't specific enough yet.

So still a mess.

Mike

[Duncan Rounding]

I think at this stage it will suffice to have the standard privacy statement as well as a short statement to the effect that methods are being investigated to able to comply with the new legislation. That way no one can say you have ignored it and also aligns with the suggestion by them that you need to show that you are looking into how to implement the changes.

[completerookie]

Have you seen a bit of news on the BBC website, posted today at 1:30pm, seems they defferred the cookie issue for a year !

http://www.bbc.co.uk/news/technology-13541250

[neildotwilliams]

The ICO website has added a banner at the top allowing you to opt-in to cookies, a day before the new rules apply.

Could be another option to get around this, not sure how to do the html code though. Anyone got the know how? I can see the source on the website but I'd have to figure out how to plug it in.

On 26 May 2011, the rules about cookies on websites changed. This site uses cookies. One of the cookies we use is essential for parts of the site to operate and has already been set. You may delete and block all cookies from this site, but parts of the site will not work. To find out more about cookies on this website and how to delete cookies, see our privacy notice.

I accept cookies from this site

[Duncan Rounding]

"...and has already been set..."
This is in breach of the requirements. You should be asked prior to cookie being set.

[MeFromLondon]

My take on it is this:

1) There is an exception to the opt in as detailed in the the ICO document mentioned earlier in this thread: “The only exception to this rule is if what you are doing is ‘strictly necessary’ for a service requested by the user. This exception is a narrow one but might apply, for example, to a cookie you use to ensure that when a user of your site has chosen the goods they wish to buy and clicks the ‘add to basket’ or ‘proceed to checkout’ button, your site ‘remembers’ what they chose on a previous page. You would not need to get consent for this type of activity.”

2) Actinic uses cookies to add things to the shopping basket and to maintain the save and retrieve the shopping basket (save for later).

3) Provided my understanding of Actinics use of cookies is correct and it doesn’t use them anywhere else, then all we need to do is disable the save for later bit (and mention cookies in the privacy policy if they’re not already).

I don’t claim to know enough of how Actinic uses cookies, and we don’t use user accounts, and of course, I could be completely wrong! I'm sure I must be wrong, nothings ever that simple. I've missed something, haven't I?