EU Cookie Law - A Free Solution

Great job there Panda! That's a great idea of yours!

Simple. Clean. Not too obtrusive.

And solves the issue we all face in the next month.

Super idea and it gets round that pathetic law (which most of us are burying our heads and ignoring)

Kim

Well you cant hide from it for ever come the 26th... And at least this way its a free non intrucive way to place it on the site.

Do you know if Amazon affiliate sites require this popup or does it only apply for cookies which are set on your site?

As far as I'm aware its required on any site that uses cookies. If the site is hosted by Amazon I'm sure they will be required to do something about it, but you also need the visitors concent and tell them why and what (as far as im aware anyway)

Bed time reading here

Cookies Regulations and the New EU Cookie Law - ICO

Great share , waiting for 26th , right on by birthday

Direct from the ICO this morning, I asked about making alerts and promts when it comes to affiliate markting and networks

Thank you for your recent enquiry to the Information Commissioner’s Office (ICO) here in Wales. In your email, you ask for advice on whether customers using your website will need to ‘opt in’ in order to accept the cookie which you describe.

The ICO advises on and enforces the Privacy and Electronic Communication Regulations (PECR), which cover the use of cookies and similar technologies for storing information, and accessing information stored, on a user’s equipment such as their computer or mobile.

As you may be aware, the amendments to PECR prescribe that those setting cookies must obtain the consent of the users to store cookies on their device except where the storage or access to information stored on a user’s terminal equipment is ‘strictly necessary’ for a service requested by the user.

It is important to note that we can only provide general guidance, such as our Guidance on our new cookies regulations, so as not to prejudice our position as the independent regulator of PECR. The ICO is unable to advise whether the cookie you refer to is ‘strictly necessary’, as each organisation must arrive at their own policies on ensuring their compliance based on their own detailed knowledge of their own business and the cookies they use. Page 8 of the above guidance provides more information about the exception of cookies deemed as ‘strictly necessary’.

And a section from the PDF They sent me and I've added said pdf download link

Third party cookies
Some websites allow third parties to set cookies on a user’s device. If your website displays content from a third party (eg from an advertising network or a streaming video service) this third party may read and write their own cookies or similar technologies onto “your” users’ devices. Obviously, the process of getting consent for these cookies is more complex and our view is that everyone has a part to play in making sure that the user is aware of what is being collected and by whom. There are a number of initiatives that seek to ensure that users are given more and better information about how their information might be used. These will no doubt adapt to achieve compliance with the new rule but we would advise anyone whose website allows or uses third party cookies to make sure that they are doing everything they can to get the right information to users and that they are allowing users to make informed choices about what is stored on their device.
This is one of the most challenging areas in which to achieve compliance with the rules. The Information Commissioner continues to work with industry and other European data protection authorities to assist in addressing complexities and finding the right answers.

PDF DIAGRAM

In many cases a combination of solutions will be appropriate and different solutions will work in different contexts. In some cases a website may use a combination of factors to satisfy themselves an individual has consented, for example, the user has used an updated version of a browser that clearly allowed and prompted them to make appropriate choices about cookies, there is clear information about cookies prominently displayed on the webpage and the cookies being set are first party analytical cookies with a low level of intrusiveness.

http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/~/media/documents/library/Privacy_and_electronic/Practical_application/guidance_on_the_new_cookies_regulations.ashx



**

The bit in red I found interesting so as long as you have a decent policy and opt in its down to you on how far you take the letter of the cookie law...

If anyone wants a decent cookie policy ill have one written up soon

Does this still apply if you are from the UK, but you have a .com site hosted in the US????
I have a few Amazon affliate sites that are .com and .net and all hosted in the US.

First time I ever heard of it. Lol.
I am really behind in terms of UK/EU internet news.

Basically, if your site targets any EU State in ANY WAY then you have to ask for their permission.

The same law does not apply to the US so if your visitors are all from countries outside of the EU then you're all good.

It's not about where they're hosted or the TLD. It's who they're targeted at and where the customers/visitors are from?

IF your website serves anyone one in the EU then it makes no difference you must still comply so if your a US based business and if 2% of your sales comes from EU visitors you need to comply they are really strickt on that.

Hardly anyone knows about it, and its worse no top stores have taken any action yet and nor is there anything in main stream media...

Thanks, pandadoodle, for the script.

What about if my visitors click to accept cookies, go away, then come back again the next day. Will they still have to click to accept each and every page?

From my understanding of it and whats in that pdf it does say you must comply or at least show you have to some degree just having a cookie policy should be enough to cover out of EU countries.

Once they accept no pop up comes back, unless they delete the cookie! So once a user agrees it will not be shown again.

I got an update coming out within the next day which covers the wording of the script and adding some extra functions that are now required, based on further research.

IF you get trouble applying the script I will do my best to help, we do have a wordpress version coming very soon! Bundled with a scripted cookie policy

Update is now out


Simple EU Cookie Law Permission Prompt - Panda Doodle

Looks good, though still very annoying to have to do this :/ Though I'm sure this is just like any other policy. Though unlikely to be caught out or anything happen, if you're the unlucky one they decide to make an example of, you're screwed lol.

Will be interesting to see what the Sainsbury's, Tesco's, Amazon and other major online retailers over here do. They all set cookies, they all have huge traffic volumes and it will be a major inconvenience for all their customers to click-on any check-box to agree to cookies.

Good thread. Thanks.

Yeah I've been waiting for Amazon, eBuyer, eBay etc to do something but not seen nothing as of yet. Only site I've only really seen something done is BT

from what I know, EU council (or w/e) passed laws are more like guidelines that eventually every country SHOULD make a law based on those guidelines. Atm it seems to only affect the UK because as far as I know its the only country that has actually created a law and implemented it.

And also if u were to follow british telecom's example, you can just set the cookies to be accepted and issue a small warning saying "cookies are set to accept all, if u wish to change that click here" etc...

Can i use this for blogspot and how

Mike, as with so many things European, the EU sets the fuzzy-minded law in place but the member states then have to decide how to enact it.

The UK government is, apparently, intent on applying the laws according to a rather strict interpretation of the intent of the legislation, but admit that other EU states may interpret the intent somehat differently.

This is from the UK's Information Commissioner's Office PDF report dated December 2011:

"An organisation based in the UK is likely to be subject to the requirements of the Regulations even if their website is technically hosted overseas. Organisations based outside of Europe with websites designed for the European market, or providing products or services to customers in Europe, should consider that their users in the UK and Europe will clearly expect information and choices about cookies to be provided."

So the answer to your two initial questions seems to be 'perhaps'! But if any of your visitors are from the UK, then definitely. However, I can imagine that local enforcement is likely to be extremely difficult so the idea of the UK government targeting a website owner in Greece is stretching credibility. But with governments on the warpath, who knows what can happen!

The document goes on to say:

"People say this law just isn’t practical – what happens if I do nothing and wait for it all to go away? This isn’t going away. It’s the law. The UK Regulations come from a European Directive that was passed in 2009. The requirements cannot easily be changed and cannot just be ignored. Many organisations are making a lot of effort to comply. The Information Commissioner has been clear that he will take a practical and proportionate approach to enforcing these rules where organisations are making the effort to comply."

The biggest irony in my mind is that in order to know if a visitor has accepted cookies or not, you would have to set a cookie on them. But if they opted for 'no cookies' how could you do that? The alternative is to build a database of IP addresses and their website preferences, but surely that would be an even bigger potential threat to online privacy than cookies ever were?

Martin

The BT one is really unobtrusive! A small warning box comes up in the bottom right hand corner, saying that it is assuming you have accepted. You don't even click on it, and within a few seconds it has gone.

I think we need a solution modelled on that. If a big company like BT can do that, then I think us small fish can and should.

If the visitor to our site has to find the ribbon at the top, read it, and then click the check box, before they can click on anything on our site - I think it will result in people just not bothering and going away. Especially if they are new to our site. We don't have the trust of a brand name like BT.

People are really wary of clicking on just anything on a new site too, for all they know it might load a virus. If the site had been hacked, it might have been used as a vulnerability to spread a virus onto everyone's machine who clicks to accept.

Another problem I can see is what happens if folks dont even know what cookies are, (not everyone does), so they just click no when asked to accept. It may well cause a lot of problems for them

Kim

BigMike there are some bits in there and on other documents online (i posted the pdf above) but yes depending on what you read and where you read it they use the term EU when refering to the UK which is a tad annoying considering France has their own policey in place (or at least thats what I have been informed)

The problem with it is there are no set guidlines everyone has some kind of interpriation of it (including myself) depending on who you speak to at the ICO and who replies to your emails answers change or no answer can be give despite the fact they are ones who are going to try an enforce it - the entire thing is a joke.

I'll gather all the data I found on the subject and post up in one full swoop.

As for intergrating the code you just need to put the script within your header and wrap any your tracking code as stated on the github, (if you click FROK On guithub) there is some Q&As on there.

The one thing I do find interesting is depending on what your site does as long as you have a cookie policy and no promt you could get away from any fine or legal problems as you have "tried" to comply as best you can as it seems up for interpriation from person to person.

As emailed to me this week (i think this is posted above)

The ICO advises on and enforces the Privacy and Electronic Communication Regulations (PECR), which cover the use of cookies and similar technologies for storing information, and accessing information stored, on a user’s equipment such as their computer or mobile.

As you may be aware, the amendments to PECR prescribe that those setting cookies must obtain the consent of the users to store cookies on their device except where the storage or access to information stored on a user’s terminal equipment is ‘strictly necessary’ for a service requested by the user.

It is important to note that we can only provide general guidance, such as our Guidance on our new cookies regulations, so as not to prejudice our position as the independent regulator of PECR. The ICO is unable to advise whether the cookie you refer to is ‘strictly necessary’, as each organisation must arrive at their own policies on ensuring their compliance based on their own detailed knowledge of their own business and the cookies they use. Page 8 of the above guidance provides more information about the exception of cookies deemed as ‘strictly necessary’.



EDIT

I just seen Martin posted the big about the section I read in regards to serving UK and EU but as far as im aware all you need to do is place in a cookie policy explaining what your doing with them and how they will be used.

BIG Mike, all I'm gonna say is that Pandadoodle has put this up for FREE for us to use.

It's up to you really to find out how the law is being implemented in Greece.

In the UK, Pandadoodle has contacted the ICO to find out exactly how the law works. Are you expecting him to go round to the necessary government departments of every EU state to find out what they're doing about the EU Cookie Law (which is what it is called).

Maybe you should pull your finger out and find out for yourself instead of expecting someone else, like Pandadoodle, to do all the work for you.

I have a question regarding the law, though. Is it possible to use IP tracking to bypass this? It does say "Cookie Law" after all.

I understand this would be a huge change but this could make a huge impact on affiliate sales, I think.

Its all still wait and see, in terms of IM if your using a cookie that tracks your user then an opt is in required as it could be determained that the information you gathered could be used for targeted advertising. If your not using that style of cookie for IM then a simple line or two in your terms or cookie policy would do for now or until anything changes...

Just ignore this law unless you're a big brand. I used to work for a government department. The left hand has no idea what the right is doing. Anyone who got sued for this would easily get off on a technicality.

My Asian competitors are laughing at this asshat legislation.

Ok well considering your based in Greece and the information I recived concering UK laws direct from the poeple in charge have clearly put me in the wrong considering it can all be found online.

I can only go on what I been told by the people in charge from time spent on the phone and email, as I have stated earlier depending on who you talk to you get different versions and diffirent opinions.

I've not once come here and pulled opinion out of thin air and gone oh this is the law. I can only go on what information has been passed to me, the developer and from comments and threads I have read on the subject.

Regardless of having a cookie script for tracking monitoring uses or some cookie policy (for the use of stats) most sites are still tied under the law regardless if they need the user to opt in or not as they have to state what scripts or stats your using and what cookies are being placed. That is true.

Its not just the UK

Swedish Government’s cookie opt-in banner has severe impact on their Google Analytics data collection « University Usability

Where can I see in what countries this rule will be applied?

anyone have or seen something that would do the same as the BT example?......very unobtrusive and professional.

I mean really, Im sorry but this just does not make any sense. Their millions of website owners who will NOT update their website, who are not on the Warrior forums like us everyday and know about this law.

Im 100% sure, 99,9999% of the people here dont know about this law in the Netherlands and even more, know how to apply it.

Their really wont be ANY police at my house for it, EVEN MORE the local police does not even know about it.

Nice mod pandadoodle - but it doesn't ask for "Prior" consent for the user? When I went on your website I still find cookies in my browser even though I haven't given consent? Looking for a mod that does if anyone knows of a cheap one or free!

Try this one, Cookie Law Compliance Solution | Cookie Control by Civic also available as a wordpress plugin. Have it running on one of my sites.

Well, this will probably cause trouble temporarily for some of us.

People are scared of what they don't know - I remember a friend saying "Please make sure I don't get any cookies on my computer." - Well, he doesn't know what a cookie is. All he knows is that it's "bad".

Many people will equate a cookie to a virus.

However, with time they may get used to seeing this stuff all over the place and just relax about it.

But I'm sure the people in the government are just full of $h!£. They either don't know what a cookie is or they want to find a way to attack companies so they can have more control (and money).

The governments worldwide will probably want more control over the internet and this is just one of the first steps.

Just found one premium WordPress plugin for this law: EU Cookie Muncher

As I understand it can block 3rd parties cookies and could be customized.

This is the reason this assinine law is being introduced :-)

In trying to handle the rising obesity levels across Europe, some well intentioned (but stupid) politicians are trying to ban cookies.

(Sorry I couldn't resist - My understanding is that you are exempt from this if you use cookies simply as part of the shopping cart checkout proceedure).

The cookie law is becoming a big thing in Europe and polititian see a chance to get thier name in the media. You are required to ask for permission before using a cookie "against" a person online. I was not aware the cookies were so dangerous unless you get one caught in you throat... sorry a little humor.

For German I found this resently:
ARTIKEL-29-DATENSCHUTZGRUPPE
... ist die Gruppe des EU-Datenschutzbeauftragten und der Datenschutzbeauftragten der Mitgliedsstaaten
Stellungnahme zur Werbung auf Basis von Behavioural Targeting
Pressemitteilung der ARTIKEL-29-DATENSCHUTZGRUPPE
Best Practice Recommendation on Online Behavioural Advertising

Basicly they are saying Article 29 requires you to ask permission and a German party the SPD is using this as way to get in the media.

If you do business in Europe you must obey this LAW.

Thanks Panda for the great idea.

Great Job! Looking forward to seeing the wordpress plugin when its complete

Hi,
We have developed a full solution, Ebook, Audit, Banner and Policy page all in one solution.
cookie Law for multi sites we could look at something, obviously if each site needs an audit we would need to do those.

Andrew

Great tread with lots of good info.
From my point of view this is one of the "silly" laws someone who got no idea about websites and cookies implemented to protect people against the horrible and dangerous cookies Like there were some kinds of viruses waiting to attack OMG! Now people will really start to think cookies are bad!

What I`m concerned is how it will affect websites performance and statistics from Google Analytics? What they require is get visitor consent and agreement to use cookies. So when someone land on website he/she need to see a message with kind of opt-in. So when that person thinks cookie is a monster of course will reject it. Meaning Google analytics (or anything we use cookies for) will not work, right?
Does anyone knows of a really good WP plugin that will give option in backend to disable all cookies once visitor will not give consent to use it?

I`m using the Civic plugin but not sure if that is enough as to me it only disable analytics code. Not sure how to set it up for other cookies