New EU Net Rules Set To Make Cookies Crumble 290
NickstaDB writes "From the BBC article: 'From 25 May, European laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies." These files are widely used to help users navigate faster around sites they visit regularly. Businesses are being urged to sort out how they get consent so they can keep on using cookies.'"
They will just bury it (Score:4, Insightful)
They will just bury such "consent" in the EULA, privacy policy, terms and conditions, legal notices, and other such crud that no one reads.
Re:They will just bury it (Score:5, Insightful)
Data protection legislation in the EU requires that explicit consent is given. That means clear, unambiguous, and upfront consent. You can't hide it in a blizzard of tick boxes or EULAs. Defaulting options to give consent won't work either.
Big business might try tor rely on a "permissive environment" of weak national regulators but the EU commission takes these things seriously. After stunts like data loss and Phorm they're wise to the tricks. Any wiseguy is just going to get their ass handed to them.
Re: (Score:2)
Re:Yes (Score:2)
Do you have to click yes to all 12 trackers to "authorize the page to load"?
"Sorry, you didn't agree to all 12 trackers, so therefore we can't afford to give you the page."
Re: (Score:2)
Re: (Score:3)
Fabulous. At least I now:
a) know you are wanting to load 12 trackers
b) can decide whether you site is soooo critical to me I'm willing to load them.
The answer to b is "unlikely" - great thing about the web, if you're doing it someone else probably is as well. I'll go there.
Re: (Score:2)
Surely the "remember me" tickbox next a login form just needs to be changed to "remember me with a cookie" and most sensible uses for cookies are covered (considering that the regulation has an exception for shopping cart contents).
Re: (Score:2)
Will the single checkbox apply to all twelve tracking sites which attached to the page?
Re:They will just bury it (Score:4, Insightful)
Real world situation: "It asked me something." "What did ask what?" "Dunno, I just clicked OK."
Come on. 80% of the malware in the world is installed exactly after "gathering explicit consent from Web users".
Re: (Score:2)
They will just bury such "consent" in the EULA, privacy policy, terms and conditions, legal notices, and other such crud that no one reads.
Actually that's not even that important, because right now pretty much no member state cares for the fact that it should put this into local legislature.
Britain is the first state to actually implement the directive, all others are lagging hopelessly behind and still want further discussion with the EU about the details. With the ad-lobbyists heads firmly stuck to their backsides they will probably delay it until IP6 comes along or some other loophole (flashcookies...) is left in the directive/laws...
Allowing cookies = consent? (Score:3)
Some are arguing that allowing cookies in the browser is basically equivalent to giving your consent. Time will tell how this all plays out, but it's safe to say that people get bored of clicking "allow" really quickly.
Do browsers even ask if you want to allow cookies these days? I guess not? 10 years ago you did have to explicitly allow them (either globally or on a per-site basis) but I guess they are allowed by default these days? Can't remember seeing a cookie prompt in a long time.
Re: (Score:2)
Some are arguing that allowing cookies in the browser is basically equivalent to giving your consent.
That sounds to me like implicit consent, while the EU requires explicit consent. Though I suppose asking permission once per site is enough - not every single visit. And after receiving such explicit permission the site may store a cookie on your computer indicating that they have that permission already.
Re: (Score:3, Insightful)
Some are arguing that allowing cookies in the browser is basically equivalent to giving your consent.
That sounds to me like implicit consent, while the EU requires explicit consent. Though I suppose asking permission once per site is enough - not every single visit. And after receiving such explicit permission the site may store a cookie on your computer indicating that they have that permission already.
Well, earlier today, I pasted this in my address bar:
javascript:void(document.cookie = "reminder=Don't forget:\n\tCover page for TPS report.");
Just now I pasted this in my address bar:
javascript: alert( document.cookie );
(Not a moment too soon -- I almost sent that report with the old cover sheet.)
That message was sent to every website I visited today. I know damn well they don't have my explicit permission to read the cookie headers that my browser sends them -- Especially not when they contain
Re: (Score:3)
I go with a whitelist approach. My browser is set to deny all cookies except those specifically allowed.
The way I identified which ones to allow is by turning cookies on to 'accept all except third party', using the web as normal for a few days, then observing which cookies had been written. After filtering out the obvious ones that I didn't need, I added the rest to the whitelist. These are all from sites that I have to log into obviously, so I have [*.]slashdot.org, mail.google.com, etc.
Only downside is i
Re: (Score:3)
I prefer to have cookies on but cleared when the browser is closed, with a whitelist of ones I want to keep. That way all sites work normally but their tracking cookies get deleted every time I close the browser, and I can stay logged in to sites I whitelist. It is a nice trade-off between privacy protection and ease of use, and as an added bonus it probably screws up a lot of tracking systems because they see me as a "new victim" every day.
Mozilla already lets you set that (Score:2)
You can set Mozilla to always ask, always accept, always reject, do one of those except for exceptions, accept for session only, remember your choices or not remember them, etc. At this point I don't know what the default it :-)
Tracking =/= cookie use (Score:5, Informative)
Re: (Score:2)
The problem is that a lot of sites include cookies for third parties without permission or any explanation. I regularly get requests for facebook to set a cookie for me. I'm not sure why most of those sites would do such a thing.
But in general I've found very little help on sites explaining to me why various javascript or cookies are requesting to be loaded by my browser. And really it makes it tough for me to figure out what ones are really necessary and which ones might not be.
Re: (Score:2)
The norwegian wording of it does not make any exceptions. Translated back to english, its:
Storage of information in the user's communication equipment or gaining access to such information data is not allowed.
Such storage or access can still happen if the user has been informed by the data controller under the norwegian Data Protection Act and has given his consent.
There have been some screaming about it in the technical press, but the rest of the country doesn't understand what the fuss is about (as usual)
Re: (Score:2)
The articles state that only shopping baskets are explicitly exempt, and that login, session management or anything else is not.
I don't believe it says that at all. From what I can see the article says:
Specifically excluded by the directive are cookies that log what people have put in online shopping baskets.
And it implies that all other types of cookies require explicit user consent (or at least have their contents and usage explained).
Given that cookies should be short and sweet, and used for things like storing Session IDs, it sounds rather odd that the directive encourages storing shopping basket data in them.
It's unfortunate that Flash Cookies and HTML5 Data Stores aren't mentioned - they are already replacing cookies in some context
Wrong Solution (Score:3)
The web browser, whichever one it is, that the user has decided to use should make the decision about whether or not to ask the users permission to set a cookie. Website are not doing anything malicious by setting cookies, they are simply asking the client browser to keep a bit of information and return it on subsequent visits. The web browser can ignore the request, ask the user for permission first, or silently accept it.
Many browsers can be configured to operate in either of those three modes. Effort would be better spent educating users... or better yet... just let it go already it isn't a big deal.
Re: (Score:2, Informative)
Some cookies are used to remember login details, others are used to track your behaviour. You can't tell your browser to allow one type and block the other because your browser can't tell which one is which. That's what this law is about.
Re: (Score:2)
The old Mozilla suit made it very easy to set cookies acceptance to "visited site only". No third-party cookies. So if I visit say slashdot.org I only accept cookies from slashdot.org and not from say adnetwork.com who happens to put an ad on that page. I like that option. Cookies have their use, keeping you logged in for example - often needed even within a single session - or storing certain personal preferences, yet ad networks have no business in tracking me.
Later Firefox only had an all-or-nothing opt
Re:Wrong Solution (Score:4, Informative)
Find a FF extension called "Cookie Monster" and then revel in th granular control you have once again :)
Re: (Score:2)
Later Firefox only had an all-or-nothing option when it came to cookies: accept all, or block all (with option for exceptions).
Firefox may still have it but it's buried; now in FF 3.6.15 I can not even find a cookies setting in the preferences at all! The only way I can find to get to the cookies configuration is via about:config. I may miss something but it certainly is not very obvious.
Not true. Firefox 3.6.15 speaking here: Edit/Preferences/Privacy: Unset the checkbox on "accept third party cookies", and set "Keep Until" to "I close Firefox". No harder than it was before. Also it is not a setting I frequently change so from the UI point of view I do not want a button or two-click access to it.
Re: (Score:2)
The option you mention is not there in my Firefox installation (this may be a Ubuntu "fix"?). Only stuff about history and location bar, and an option to manually delete individual cookies.
It's Easy! (Score:2)
The first time someone visits your website, you redirect them to a consent form and then if they opt out of being tracked, you just set a cookie showing that they've opted out so that you won't have to ask them again. See, problem solved.
(I say that tongue-in-cheek, but it would actually probably work if you set a "don't track" cookie which wasn't personal to them. Most grocery stores also offer non-tracking versions of their loyalty cards. My dad has one for Harris Teeter and his card number is all zero
Clue stick (Score:2)
Re:Clue stick (Score:5, Insightful)
I couldn't give a rat's arse how much it costs sites to comply. I'm glad somebody with sufficient authority is looking out for my privacy, because it's hard enough to do it by myself. Cookies have been a fundamental feature of the web for a long time as a way to make the web a better experience for users, but I certainly didn't ask advertisers et al to abuse this functionality for things that aren't in my interest.
Re: (Score:2)
Re: (Score:3)
I'm glad somebody with sufficient authority is looking out for my privacy, because it's hard enough to do it by myself.
Im going to assume you use internet explorer.
1) Tools --> Internet Options --> Privacy
2) Move the slider to "Block all cookies"
3) Click apply. Youre done! Cookies can never threaten your freedom again!
And that option has only been there for what....10 years now? I remember learning about that back in 2001 when people were getting all freaked out about cookies, when i was just a teenager with no technical skill. And I know that Firefox and Chrome and Opera and Lynx and Links (having used them on go
Do not set (Score:2)
Do not set any cookies if person is not registered (here is your consent). Problem solved. Actually, that would be pretty nice.
Re: (Score:2)
Under EU law you would likely be prohibited from doing some of those things without consent also.
The web is perfectly functional with a very limited set of allowed cookies and adblock set to not load most javascript or advertising.
I don't have java enabled. Flash is default blocked, flash cookies are removed on browser exit. ActiveX isn't an issue.
Most 'idiots' don't want to be tracked. The less tech savvy 'idiots' don't knwo that there are good and bad sides to cookies so they just disable them all. This w
Stupid (Score:2)
Sure, cookies can be used for shady purposes but for heaven's sake - every useful website I can think of uses the hell out of cookies. It's the only practical way to maintain UI state. Browsers already have the ability to warn per cookies. They used to come with this turned on by default, but most have stopped that now. Ever tried turning those warnings on in the past ten years? You can't possibly browse the web like that. Even a once-off per site setup is absurd. This is the result of passionate but ignora
Re: (Score:2)
"Ever tried turning those warnings on in the past ten years? You can't possibly browse the web like that."
Yup, it's crazy the number of cookies now being set/read when you visit modern sites. This is a very strong positive for the legislation though.
Me, I use "Cookie Monster" in firefox. It allows me to deny all third party cookies outright, and default-deny the rest. It has a neat little menu to allow cookies from a specific site on temporary basis (Let it set cookies until the browser is restarted), allow
Re: (Score:3)
Browsers already have the ability to warn per cookies. You can't possibly browse the web like that. Even a once-off per site setup is absurd.
For you. For me, it's a vital functionality, and one of reasons I don't touch Chrome with a ten foot pole.
Of course, I use once-off, with Cookie Monster to be able to alter the decision later as the built-in UI takes a couple minutes (!) to alter it.
Most third-party bastards get onto my DNS-do-not-resolve list, too. Just blocking their cookie does hardly anything, they can use your IP and headers to get almost as much info. To the contrary, being warned about a new cookie is good since I know there's scu
Compromise. (Score:2)
How about a browser option of 'accept all cookies - but delete them once the session is over'?
The tracking companies get their cookies accepted and privacy is maintained. Everyone is happy. Kind of.
Re: (Score:2)
They should build the "Cookie Monster" addon into FF by default, with a sensible set of defaults (like auto-deny third party cookies).
That would cover it.
Re: (Score:2)
Cookie Monster is damn nice, it just lacks one thing: the ability to let permanent cookies stay if you allow the site to do so. Currently, you need to go to that site again and login/set up/etc once more.
I guess it's a problem in Firefox core -- if set to session cookies by default, it probably overwrites the cookie's expiration so Cookie Monster can't restore it
Re: (Score:2, Informative)
Already exists in Firefox ! Accept cookies from sites ... Keep until: I close Firefox
Re: (Score:2)
You mean like Firefox's Private Browsing mode?
Re: (Score:3)
How about a browser option of 'accept all cookies - but delete them once the session is over'? The tracking companies get their cookies accepted and privacy is maintained. Everyone is happy. Kind of.
Done: Open Firefox > Tools > Start Private Browsing.
This is the "mode" which you seek.
The bullshit legislation won't matter. There are hundreds of hacks to store user state without cookies. All of the data can be stored server side, and if just one identifying piece of information correlates two user profiles (say, usage pattern, or time of day + IP address) then your data is being mined.
Stop private browsing, go to a different website, the ads on that website link the current time of day
Ghostery for FF (Score:3, Interesting)
Oh so important anti-virus scanners! (Score:2)
Re: (Score:2)
Could you explain why cookies are 'absolutely needed'? Or provide a link? I can see how cookies are useful, but I don't see how they are vital.
Re: (Score:2)
It's so they can tell it's the computer in the living room and not the computer in the bedroom. Or if you like an office analogy, it's so Sue in accounting doesn't get the same Facebook page as Ted in IT.
Technically speaking, the only information visible to the servers on the internet is the IP/MAC
Re: (Score:2)
Coolhand2120, you've hit the nail precisely on the head.
I remember back when anti-virus apps first started to whine about cookies, I was like, "what? do these guys have ANY CLUE how the web works?". I eventually came to the conclusion that they did, but that they were benefiting from the appearance that they were stopping all this "evil" stuff.
Cookies are an absolutely essential way to maintain state across multiple visits from a given user on a web site. As always, XKCD is on-the-ball ... http://www.xkcd. [xkcd.com]
Re:Oh so important anti-virus scanners! (Score:4, Interesting)
Well I agree with you that a cookie may not physically harm you; and that they are very useful tools for web site programming.
Yet the primary problem with cookies is the third-party cookies that ad networks place on your computer. So this ad network can track which web sites you visit. This has no use for you as end user; it only servers to give the ad network more information about you. They can see you visit slashdot, they can see you visit certain lolcat related sites, they see you visit amazon, they follow you whenever you hit a web site where their ads (and cookies) are served. And that is the problem they most likely want to tackle as that is where privacy is an issue.
Re: (Score:3)
Consider this submission (Score:2)
NickstaDB writes
"From the CNN article: 'From 25 May, US laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies". These files are widely used to help users navigate faster around sites they visit regularly. Businesses are being urged to sort out how they get consent so they can keep on using cookies.'"
And then consider how different the reactions and comments would be.
Not my job. (Score:2)
I have a perfect solution! Rather than continuing to use magical cookies which can follow you around and tell everyone where you've been, I'm going to re-implement a cookie-like thing which cannot possibly do anything you don't want!
Here's how it will work: When you go to my website, I will send your browser a "brownie". The "brownie" will just be a short text string.
Then, if you want me to track you, simply inform your browser that you would like to send back the "brownie". whenever you connect to my serve
Re:Thanks EU (Score:4, Insightful)
Great - what the internet needs is more regulation.
Thanks EU.
I think that's exactly what America needs: more EU regulation. We'll just host their sites over here, because we don't have to comply with their stupid laws.
Re:Thanks EU (Score:5, Interesting)
IPv6 will give almost everybody practically static addresses, the ultimate undeleteable cookie. So the EU regulation will be futile very soon.
Re: (Score:2)
IPv6 will give almost every computer practically static addresses
What if multiple people share the same computer?
Re:Thanks EU (Score:5, Informative)
What if multiple people share the same computer?
The kids get to see pornography advertisments because you browser for porn last night. Fun for the whole family!
Re: (Score:3)
Interesting idea: Different IPv6 address per user account.
Re: (Score:2)
Re: (Score:2)
Every process on a system already runs under a user account. Even the process that displays the login prompt. Shouldn't be a problem!
Re: (Score:3)
Re: (Score:2)
In my experience with ADSL and cable you have a fixed address already. It is just not guaranteed to be fixed but a new IP every few months is fixed enough for lots of tracking purposes. Just leave your own router connected; usually DHCP will give you the current IP address upon renewal. There is no reason it would have to change to begin with.
Re: (Score:2)
Remind me to generate a new IPv6 address for every hour of the day...
Re:Thanks EU (Score:5, Informative)
IPv6 will give almost everybody practically static addresses, the ultimate undeleteable cookie. So the EU regulation will be futile very soon.
That problem has been solved by RFC 4941, otherwise known as the Privacy Extensions [ietf.org]. Most OSes support it, though I believe some don't enable it by default. IIRC the iPhone is one of the devices that doesn't support it, but that should be fixable once IPv6 becomes more widespread.
Re: (Score:3)
now I might missunderstand that rfc, but it seems totally useless.
You can only get a different address within the subnet your provider assigns to you, so companies will simply maintain a table of which ISPs use which size of subnet, and ignore the corresponding variable part of the address.
Presto, unique ID per household again
Re: (Score:3)
Re: (Score:2)
Ah, just re-read, GPP said 'routers'. Agreed, having the router doing some sort of random address translation would be insanity. What if the client picked a new random address every, say, week? day? hour? minute?
Re: (Score:2)
Hosts your sites as you like, but companies doing business in the EU will still need to comply or it will become expensive for them. Perhaps advertisers in this situation won't want to pay per click if they're not doing business in the EU any way, which will affect US hosted sites too. Also, the US courts have set plenty of precedent by feeling free to take legal action outside their own jurisprudence
Re: (Score:3, Informative)
Re: (Score:2)
Haha - I was think about both, and in this case the difference between jurisprudence in both places. Jurisdiction is indeed what I meant. It's been a long day...
Re: (Score:2)
Great - what the internet needs is more regulation.
Thanks EU.
I think that's exactly what America needs: more EU regulation. We'll just host their sites over here, because we don't have to comply with their stupid laws.
Or Sealandia or Naru or Libya or Russia.
Which of course simply undermines your own homegrown industry and once based outside the country other exploits are now feasible.
The way we deal with this for physical goods is tariffs. e.g. your country has no OSHA laws, or pays to low a minimum wage then we may slap a tarrif to equalize the playing field and protect the home industry.
This of course eventually leads to protectionist tariffs.
Re:Thanks EU (Score:5, Insightful)
Re:Thanks EU (Score:5, Interesting)
You got modded flamebait but in reality you've understated the situation quite significantly. When the feds come to bust a private host for something they usually take everything in the room that is even plugged into the same power line and all the networking hardware out to the wall, then they leave it up to the owners of the hardware to litigate for return of their property.
Re: (Score:2)
This isn't limited to 'the feds' - most police around the world behave the same way. Oh, and it doesn't even have to be plugged in... :(
Old monitors standing idle in the corner - confiscated.
MP3-player in the kids bedroom - confiscated.
Ancient 5.25" floppy disks - confiscated.
Standard household power-strips and cables - confiscated.
The list goes on and on and doesn't make sense. Quite obviously, it's all about harassment and nothing else.
Re: (Score:3)
I think that's exactly what America needs: more EU regulation.
Actually, it probably is.
The Europeans take their privacy laws very seriously and, unlike the USA, they enforce the shit out of them.
The USA has a lot of laws, but enforcement is hit or miss, especially when it comes to consumer protection.
Re: (Score:3)
Ironically, the BBC have a follow-up article [bbc.co.uk], the first paragraph of which reads:
Re: (Score:2)
I think that's exactly what America needs: more EU regulation. We'll just host their sites over here, because we don't have to comply with their stupid laws.
Doesn't matter where the site is hosted -- this is about data collection. Even if the site is hosted in the US, it would be illegal for an EU company to download the data from their US servers in order to perform any kind of analysis. If the site is designed in the EU, it would be illegal for the EU designers to set it up to track visitors without consent. If the site is designed in the US, it would be illegal for the EU owning company to request the US designers to set it up to track visitors without co
Re: (Score:2)
Great - what the internet needs is more regulation.
How dare those cheese eaters interfere with companies' God-given right to spy on us?
Re: (Score:3)
I think we need a car analogy before we start.
You go to a retail store and park your car outside, and while you are in the store, the retail store goes and places a GPS tracker to the underside of your car. You are unaware of this tracker, and the retail store starts tracking your exact movements. They want to know which competitors you visit, for how long and how frequently, they may also find you go to a gym every day, or figure out where you work. To remove the tracker, you will have to look under your c
Re: (Score:2)
TFA mentions "explicit consent" is needed. Burying stuff in some legal notices will be considered implicit consent at best. So at least from the face of it every site will have to ask for it. TFA specifically mentions more use of pop-up windows... interesting... are there still people without pop-up blockers then?
Re: (Score:2)
Yes, especially since the site now has no way of knowing whether or not it has previously asked for permission unless the answer was yes. Meaning that if you say yes then that's the last you hear of it, but if you say no, then it'll ask you for permission every time you visit the site.
My main concern is that there's not really any information given about why a lot of these sites are setting cookies for facebook and random other sites.
Re: (Score:2)
Make it harder for people to track other people for financial gain?
Sure.
Protecting the privacy of EU citizens seems more important to me than your transient concerns about having to do a bit more work.
Re:EU = make things harder (Score:5, Informative)
Sorry, you are looking at it from the wrong direction. The difference between the US and the EU is that the EU (or by extension the state governments that form it) are protecting their citizens from violations of privacy by corporations. You see, over here, we actually care about privacy and our governments do actually help to protect it. Done properly and where needed, regulation is a Good Thing(tm). Corporate Fascism hasn't yet fully taken over here in the EU as it has in the US.
All you have to do is look at areas such as telecommunications: The EU's mobile phone operators and ISP's provide FAR better service, better prices and a LOT more competition in this area than in the US. I live in a small country of only 5.2 million, and I can choose from literally dozens of mobile phone operators and I have multiple ISP's to choose from with very competitive offerings. I can shop for the best price and/or service. I am not limited to one or two major monopolistic operators or ISP's like in some parts of the US.
Just like the 2-party political system, which is a joke, you guys over in the States need to get over your long-held belief that regulation is bad. Regulation in the EU generally *protects* the consumer and their privacy and prevents monopolistic business practices. In the US, practically everyone believes in the invisible hand of the free market. The problem is the invisible hand is stealing from consumers pockets and stuffing the pockets of corporations. The invisible hand is NOT working in YOUR favor, it's working in favor of the corporations.
Now before a troll comes along and says I do not know what I am talking about, I am an American living abroad in the EU, for more than 10 years. I have lived and worked in both places and I have worked for both American and EU based companies. I can assure you, the EU way really is better and I cannot really consider living and working in the US anymore. It is a major downgrade on practically every metric.
Back to the original topic: tracking cookies. This regulation is in response to companies who abuse users by tracking them using cookies. This is unwanted behavior. Cookies were not originally intended for this use and since companies have been abusing cookies (and by extension the consumers/users), it calls for regulation since companies in the free market cannot be held responsible for acting responsibly. Companies will only do what they can to increase profits and/or market share unless forced to do something else. Regulating cookies for tracking behavior is needed and I do not have a problem with this. It protects me as a consumer since it is widely known to be abused. This is precisely why regulation is sometimes needed.
You may be willing to allow corporations to perform uncontrolled data mining of your online habits but I prefer to have control over that information since the information is open to abuse. There is no legitimate justification for corporations to collect this information other than to use it for their benefit. They are certainly not collecting it to help you as a consumer.
Re: (Score:3)
You may be willing to allow corporations to perform uncontrolled data mining of your online habits but I prefer to have control over that information since the information is open to abuse. There is no legitimate justification for corporations to collect this information other than to use it for their benefit. They are certainly not collecting it to help you as a consumer.
This move won't give you that. In fact it does the exact opposite. Corporations are going to force you to sign EULA that includes allowing them to track you for EVERYTHING. Think of Google requiring login (no anonymous searches). The first thing you're going to have to do no matter what URL you type in, is log in.
Re:EU = make things harder (Score:5, Insightful)
Google requiring log-in = people start using bing (have they renamed it again yet?) / yahoo / altavista.
Really... this is what would happen.
I have seen plenty of people who, when encountering a log-in / register window, they just close the web-page and do something else. Come, to think of it, all sites requiring log-ins, would be a huge boost for productivity.
Re: (Score:3)
Hahaha, that's pretty funny. Just exactly how many sites do you know that moved behind a registration wall and gained readership?
Re: (Score:3)
Re: (Score:3)
EULA /= EXPLICIT CONSENT.
Guess what is required by the directive.
Re: (Score:3)
Sigh ... you know so little about what is going on outside of the USA.
In the EU you can not waive rights/privileges which you have by law by "signing" an EULA EULAs in the sense as they exist in the USA are not existing in Europe. It is illegal to put something into an EULA which is contradicting to law. Sigh, you can not give up your rights. Not e
Re: (Score:3, Interesting)
Re: (Score:3)
Now before a troll comes along and says I do not know what I am talking about, I am an American living abroad in the EU, for more than 10 years.
You don't know what you are talking about. You can't reasonably think of the EU as one homogenous unit. The tiny country you're living in sounds pretty good, but remember the EU also includes Italy and Latvia. Things that work for 5.2 million people don't always scale to 60 million or 200 million. Italy is where you can go to jail for a youtube video critical of politicians. Italy where the ties between business and government are so much more imaginably corrupt than happens in America. They don't even try
Re: (Score:3)
Well, ... or from where does your wisdom come? ;D
I assume you are either an Estonian living in Italy or an Italian living in Estonia
Anyway, the EU consist out of 27 countries. You picked Italy as a very bad example out of those
The is political and cultural in fact a very homogene area. At least as homogene as you can be if the south west in Portugal is Catholic and speaks a romanian language while the 3 Baltic nations speak their own micro languages and the north is protestantic and speaks mainly indo germa
Re: (Score:2, Informative)
How do you track consent in the first place, without cookies?
A user giving consent (or not) means that you've got to have a unique way of identifying that user. In the stateless HTTP protocol this means that you've got to have some state preserved. You can either do that with very fancy URLs (but then back buttons, bookmarks, browser history and such will not work properly) or with cookies.
Re: (Score:2)
You try to read the cookie.
If you fail then they haven't got one. You don't try to write one until you actually need one (shopping basket, account signup or login etc), at that point you ask permission with it spelled out that they can't go any further without it.
If they decline then you send them back to your front page or to google or something.
If you're a forum or something then sure, you need cookies for pretty much anything (other than random drop-in people just looking). If you're something like an on
Re: (Score:2)
Re: (Score:3)
We here in the US refer to that as the "ignition switch" and it's very effective at telling the machine not to burn fuel.
Re:Car anology (Score:4, Interesting)
Hmmm, bad car analogy. As an owner and driver, I already have control over that. Perhaps it would be more like manufacturers putting a feature or governor in your car that makes it drive past some advertising slowly, without your permission... in which in my case I'd want the EU to regulate, just like I'm happy to see them doing something about abusive companies trying to track me for their benefit rather than mine.
Re: (Score:2)
Europe today would be the same if Hitler had won. They are worse than Nazis
Wow am I out of the loop or what. They still practice genocide over there?
Re: (Score:2)
"We all know that this won't happen anyway because what website in its right mind make itself too hard to use? If it becomes a case of accept our policy or don't use our site, perhaps the EU will evolve the regulations."
Or you could say -
We all know that this won't happen anyway because what website in its right mind make itself too hard to use? If it becomes a case of accept our policy or don't use our site, perhaps websites will stop using so many damned unnecessary and unwanted cookies.
Seriously, have yo
Re: (Score:2)
Sure, they will, but there are things that can be achieved simply by blocking some cookies.
For instance - why should facebook be able to track people across every site with a "like this on facebook" button, regardless of whether they have a facebook account?
This can be worked around by switching off third party cookies (and perhaps blocking any content loaded from fb when not actually visiting FB), which IMHO aren't useful for anything BUT tracking.
I can't say it would bother me to see all the "affiliates"
Re: (Score:2)
What do they think the 'Remember Me' checkbox is for!?
Erm... exactly what this is about. This legislation means that such checkboxes are mandatory, rather than just a good idea. And they have to default to unchecked.
Re: (Score:2)
Why would I need a cookie to read things?
This is where my understanding of all the protest over this breaks down. To just read a site, what use is it to me to have a cookie?
Sure, for buying stuff, or for logging in or whatever else, I see how they're used. But for just reading a site (or loading an ad) why should I have to maintain a cookie?