Please kill this cookie monster to save Europe's websites
Crummy cookie cutting law really takes the biscuit
Opinion Visit any website and there's a good chance that it will send a cookie to your computer. But unless that cookie is essential, its delivery could become illegal under a strange new plan that has, very quietly, won EU support.
Under plans endorsed by the European Commission, the Council of Ministers and the European Parliament, we would have a choice: stop using Google Analytics or ask visitors for permission to send that cookie when they visit. Like an over-enthusiastic greeter, the latter approach requires us to welcome even casual passers-by with a "Hi, how are you today?" and an invitation to wear a visitor's badge.
Most websites use Google Analytics (including the site of the UK's privacy chief, at ico.gov.uk) or a similar traffic analysis tool, and that is just one use that sites make of cookies. We’re all subject to this requirement for prior consent – or so it seems. The trouble is, we don't know what the law really means. Nobody does, because the proposed law is ambiguous. (See the relevant sections or full text.)
This simple approach to cookie compliance is under threat.
The new law says that cookies can be delivered to a user's computer only if that user "has given his/her consent, having been provided with clear and comprehensive information" unless it is "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."
So if I'm shopping at Amazon.co.uk and I put a book in my shopping basket, Amazon can use a cookie to remember which book I want when I proceed to the checkout. That is a cookie that's essential to the service I've explicitly requested. But if Amazon wants to use a cookie for another purpose, e.g. to monitor shopping basket abandonment, it needs my consent.
This sounds bad, but a recital to the new law sounds like an escape clause. In any Directive, recitals are listed before the formal 'Articles'. They provide an introduction to the new law, sharing the lawmakers' rationale for the provisions that follow. Curiously, the cookie recital includes a suggestion that conflicts with the main Article.
The new cookie recital says: "The user's will to accept processing may be expressed by way of using the appropriate settings of a browser or other application."
Most browsers have a default setting that allows cookies. Most people never change that (and many don't know that the setting exists). So a court might reasonably question how consent can be implied from a default setting. If no question is asked, silence does not convey consent.
Sponsored: Global DDoS threat landscape report