Feeds

You can break EU cookie rules ... if your site breaks without cookies

It's the way the cookie crumbles when you split hairs

Providing a secure and efficient Helpdesk

Website operators can only take advantage of an exemption from new cookie laws if site users specifically request a service or function and that service would not work without the serving of the cookie, EU data protection regulators have warned.

After changes to the EU Privacy and Electronic Communications (e-Privacy) Directive that came into force in the UK last year, site operators must obtain user consent to place cookies in users' browsers. There is an exception, though, for services where a cookie is 'strictly necessary' for the operation of the site, such as tracking a shopper's choices to allow them to pay for goods at a checkout stage of an online process.

The Article 29 Working Party has published an opinion which says that sites can only make use of this exception if a user has specifically requested the service or functionality for which a cookie is 'strictly necessary and the service or functionality would not work if a cookie was not served'.

The Working Party said (12-page/151KB PDF) that cookies should only be considered as fulfilling the 'strictly necessary' criteria if an "information society service" is "explicitly requested" by a user who has taken "a positive action ... for a service with a clearly defined perimeter" and where that service would "not work" without it.

"There has to be a clear link between the strict necessity of a cookie and the delivery of the service explicitly requested by the user for the exemption to apply," it said.

The Working Party added that cookies served for the purposes of delivering "specific functionality" within websites will also not be considered 'strictly necessary' unless "the functionality will not be available" without the cookie and the user has "explicitly requested" the functionality from the website.

Technology law expert Luke Scanlon of Pinsent Masons, the law firm behind Out-Law.com, said that some of the detail provided by the Working Party on when website operators can serve cookies without users' consent would be helpful to businesses but that some questions remain unanswered.

"In relation to the 'strictly necessary' exception, the Article 29 Working Party has used as plain a language as possible," he said. "Cookies are only strictly necessary if the service to which they relate would not work without them."

"Put another way, it appears that the Article 29 Working Party is saying that for all services that can work 'at all' without cookies, the service provider must obtain consent before placing any cookies in relation to that service. What about where this would result in significant wasted time and costs in order for a service to operate without a cookie? Does this mean that developers must find expensive or difficult to implement workarounds whenever it is conceivably possible that a service can work without a cookie? This would seem to be an unreasonable expectation to place on business," Scanlon said.

The Article 29 Working Party is a committee made up of representatives from each of the EU national data protection authorities.

Websites can track user behaviour during individual visits to sites (session cookies) or over multiple visits (persistent cookies) and serve one or a number of different purposes (multipurpose cookies). They can also be served by the websites themselves (first-party cookies) or on behalf of other internet firms, such as advertising networks that use (third-party) cookies to track users' online activity in order to serve them with targeted ads they consider more relevant to those users.

Cookies can also be used by social networks to track user interaction with 'plug-ins', such as Facebook's 'like' button, on other website platforms. Websites sometimes use flash cookies to store information that helps to play back video or audio content, while other cookies can be used to authenticate user passwords to content hidden on websites.

Websites also sometimes use cookies that remember users' preferences on sites, such as how information is displayed or the language it is displayed in. Websites also often use first-party data analytics cookies to measure visitor numbers and those individuals' interaction with their sites.

Under the e-Privacy Directive a further exception to the consent requirement exists where the cookies is used "for the sole purpose of carrying out the transmission of a communication over an electronic communications network."

The Working Party said that in order to qualify under this consent exemption, cookies must be pivotal to the transmission of the communication and that transmission "must not be possible without the use of the cookie."

"Simply using a cookie to assist, speed up or regulate the transmission of a communication over an electronic communications network is not sufficient," it added.

The Article 29 Working Party said that only 'load balancing session cookies', that allow for the processing of web server requests to be spread over a number of computers instead of just one, would definitely not require consent in order to be served on the basis of the 'transmission' exemption.

Security for virtualized datacentres

More from The Register

next story
Wanna keep your data for 1,000 YEARS? No? Hard luck, HDS wants you to anyway
Combine Blu-ray and M-DISC and you get this monster
US boffins demo 'twisted radio' mux
OAM takes wireless signals to 32 Gbps
Apple flops out 2FA for iCloud in bid to stop future nude selfie leaks
Millions of 4chan users howl with laughter as Cupertino slams stable door
No biggie: EMC's XtremIO firmware upgrade 'will wipe data'
But it'll have no impact and will be seamless, we're told
Students playing with impressive racks? Yes, it's cluster comp time
The most comprehensive coverage the world has ever seen. Ever
Run little spreadsheet, run! IBM's Watson is coming to gobble you up
Big Blue's big super's big appetite for big data in big clouds for big analytics
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.