New Cookie Directives: What’s Crumbling?. Presented by Mike Knight. Housekeeping. Audio/Video Questions – Use Quitegood.com/feedback.php Or use panel on RHS At the end – see where to download notes. Recap From Last Time. Recap from Last Time Disclaimer What Are Cookies? Google
Presented byMike Knight
Questions – Use Quitegood.com/feedback.php
Or use panel on RHS
At the end – see where to download notes
Recap from Last Time
DisclaimerWhat Are Cookies?
What Are They For?
Who Uses Them?
Basic Cookie Security.
Cookie Law – The Changes
Problems With It
What To Do About It
I Ain’t A Lawyer! – This is Just My Opinion
Web pages don’t have “Memory”
.txt Text Files Hosted on your Computer, created by the browser
e.g. Mike knight, added fly fishing rod to shopping basket, Date & Domain
You can Look at them, delete them etc.
Locked to a domain or even a page, with an expiry date.
Short Term or Long Term? Primary or Third Party?
Session Cookies: eg shopping basket(could use ip address and computer details?)
Persistent/Tracking Cookies : remember next time eg have the site in ChineseLocal Shared Objects : “Flash Cookies” – Outside scope.
3rd Party Cookies – e.g. Analytics, Behavioural Ads etc.
Tab-separated columns are:
Domain, Path, Secure(?), Expires, Name, Value
www.httrack.com / FALSE 1999999999 foo bar
www.secure.com /folder TRUE 1999999999 SSID xxx1234 www.example.com /abc/def FALSE 1999999999 Margaret Classical
An Example of a [3rd Party] Script that sets cookies... PPC Data!
User Preferences eg Languages, Accessibility, Remember Popups
Name, Previously Visited...
Web Analytics : New/Repeat, ClickpathSource, TOS, Browser, GEO(IP), KeyPhrase...
e.g. Google Analytics, Omniture, Clicktracks, StatCounter ...
Used By People Like:Amazon, Ebay, LinkedIn, BBC, .... Even Us!
In themselves, they’re just text. Can’t be “Run” like a .exe
Can be used as a form of spyware though by tracking sites
Most browsers have built in privacy settings that provide differing levels of cookie acceptance, expiration time, and disposal after a user has visited a particular site.
Cookies Transmit <> browser << >> website, if an attacker or unauthorized person gets in between the data transmission, the sensitive cookie information can be intercepted.
Behavioral Software “Mouse Tracking...???”
A bad programmer could store sensitive information, unencrypted.
The United States government has set strict rules on setting cookies in 2000 after it was disclosed that the White House drug policy office used cookies to track computer users viewing its online anti-drug advertising.
An amendment to the Privacy and Electronic Communications Directive known as the EU Cookie Directive came into effect on 25 May 2011 that requires website owners to be transparent with website visitors about how cookies are used.
The Emphasis is on the user, not the website owner.
It was deferred for a Year... Now What?
Rather than the "Opt out" option for website visitors, websites will need to specifically gain the consent of their visitor and they must "Opt In" to be able to store cookies on their computer or other devices.This is expected to be difficult to manage and enforcement will more than likely be done subtlely and with encouragement rather than with the threat of fines and penaltys.
What does the new law say?The new requirement is essentially that cookies can only be placed on machines where the user or subscriber has given their consent. 6 (1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met. (2) The requirements are that the subscriber or user of that terminal equipment-- (a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and (b) has given his or her consent. (3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient for the purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use. “(3A) For the purposes of paragraph (2), consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent.(4) Paragraph (1) shall not apply to the technical storage of, or access to, information-- (a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.
In Short ; essential Cookies are OK : eg Shopping cartNon-Essential Cookies are NOT OK, without Prior Consent
(At least Short term)
Other Contentious Issues :
Employer’s v Employees Preferences
Once Set; Who Used a (shared) machine last?
What about Existing Cookies in Existence That Are Set?
Who Defines “Strictly Necessary”?What Are the Penalties?
Potential Implications :Behavioral Advertising! (Google) [x2 effective]
Clicking on PPC multiple times : Strictly Necessary?
The More Intrusive – the more you need to do.
Font Size >> Type of News Feeds >> What You Bought.
So, Shopping Basket is “OK” because it’s necessary!
How do you ask "can we track you to make our advertising more effective?
BBC Says : HOW WILL BBC WORLDWIDE COMPLY WITH THE LAW CHANGE?
“The government's view is that there should be a phased approach to the implementation of these changes. Over the summer, we will be working on developing the best methods for obtaining your consent.
In the meantime, you can control cookies by setting your device to notify you when a cookie is issued, or not to receive cookies at any time. We will ensure that we continue to provide you with clear and comprehensive information about the cookies we use, so that you can make informed decisions.”
Are Businesses Outside UK, affected?
Yes, if they have operations in the EU.
If your business falls under the jurisdiction of the EU then it is subject to this law. The regulators who enforce it are based in the member states of the EU. So if your organisation is – say - located solely in the US, but sells to EU customers, we don't foresee this causing problems for you. (Source Silktide)
Can we just host our website outside of the EU?
If your organisation falls under the jurisdiction of the EU, it doesn't matter where your website is hosted. It will be your organisation that is prosecuted, not your hosting provider.(Source Silktide)
So if cookies are set for a service the user did not specifically request, they're not allowed. And if the service they did request didn't need those cookies, they're not allowed.
Analytics, behavioural advertising and conversion tracking therefore seem clearly excluded.
Login, adding items to a basket and most user preferences appear to be allowed.
Who is responsible for 3rd party cookies?
The website the user is visiting, at least for now.
EG Facebook “Like”; Google Analytics
I “Borrowed Heavily from...”
www.silktide.com Analytics Company
http://www.ico.gov.uk(PDF to Download - Good For other stuff )
Econsultancy.com – Good Old favourite!
Be Aware of It.
Keep Your Head Down.
Check What Others Are Doing Every 6 Months
Focus on Other Stuff – I Do.