Feeds

You can break EU cookie rules ... if your site breaks without cookies

It's the way the cookie crumbles when you split hairs

3 Big data security analytics techniques

Website operators can only take advantage of an exemption from new cookie laws if site users specifically request a service or function and that service would not work without the serving of the cookie, EU data protection regulators have warned.

After changes to the EU Privacy and Electronic Communications (e-Privacy) Directive that came into force in the UK last year, site operators must obtain user consent to place cookies in users' browsers. There is an exception, though, for services where a cookie is 'strictly necessary' for the operation of the site, such as tracking a shopper's choices to allow them to pay for goods at a checkout stage of an online process.

The Article 29 Working Party has published an opinion which says that sites can only make use of this exception if a user has specifically requested the service or functionality for which a cookie is 'strictly necessary and the service or functionality would not work if a cookie was not served'.

The Working Party said (12-page/151KB PDF) that cookies should only be considered as fulfilling the 'strictly necessary' criteria if an "information society service" is "explicitly requested" by a user who has taken "a positive action ... for a service with a clearly defined perimeter" and where that service would "not work" without it.

"There has to be a clear link between the strict necessity of a cookie and the delivery of the service explicitly requested by the user for the exemption to apply," it said.

The Working Party added that cookies served for the purposes of delivering "specific functionality" within websites will also not be considered 'strictly necessary' unless "the functionality will not be available" without the cookie and the user has "explicitly requested" the functionality from the website.

Technology law expert Luke Scanlon of Pinsent Masons, the law firm behind Out-Law.com, said that some of the detail provided by the Working Party on when website operators can serve cookies without users' consent would be helpful to businesses but that some questions remain unanswered.

"In relation to the 'strictly necessary' exception, the Article 29 Working Party has used as plain a language as possible," he said. "Cookies are only strictly necessary if the service to which they relate would not work without them."

"Put another way, it appears that the Article 29 Working Party is saying that for all services that can work 'at all' without cookies, the service provider must obtain consent before placing any cookies in relation to that service. What about where this would result in significant wasted time and costs in order for a service to operate without a cookie? Does this mean that developers must find expensive or difficult to implement workarounds whenever it is conceivably possible that a service can work without a cookie? This would seem to be an unreasonable expectation to place on business," Scanlon said.

The Article 29 Working Party is a committee made up of representatives from each of the EU national data protection authorities.

Websites can track user behaviour during individual visits to sites (session cookies) or over multiple visits (persistent cookies) and serve one or a number of different purposes (multipurpose cookies). They can also be served by the websites themselves (first-party cookies) or on behalf of other internet firms, such as advertising networks that use (third-party) cookies to track users' online activity in order to serve them with targeted ads they consider more relevant to those users.

Cookies can also be used by social networks to track user interaction with 'plug-ins', such as Facebook's 'like' button, on other website platforms. Websites sometimes use flash cookies to store information that helps to play back video or audio content, while other cookies can be used to authenticate user passwords to content hidden on websites.

Websites also sometimes use cookies that remember users' preferences on sites, such as how information is displayed or the language it is displayed in. Websites also often use first-party data analytics cookies to measure visitor numbers and those individuals' interaction with their sites.

Under the e-Privacy Directive a further exception to the consent requirement exists where the cookies is used "for the sole purpose of carrying out the transmission of a communication over an electronic communications network."

The Working Party said that in order to qualify under this consent exemption, cookies must be pivotal to the transmission of the communication and that transmission "must not be possible without the use of the cookie."

"Simply using a cookie to assist, speed up or regulate the transmission of a communication over an electronic communications network is not sufficient," it added.

The Article 29 Working Party said that only 'load balancing session cookies', that allow for the processing of web server requests to be spread over a number of computers instead of just one, would definitely not require consent in order to be served on the basis of the 'transmission' exemption.

SANS - Survey on application security programs

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Bored with trading oil and gold? Why not flog some CLOUD servers?
Chicago Mercantile Exchange plans cloud spot exchange
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
IT bods: How long does it take YOU to train up on new tech?
I'll leave my arrays to do the hard work, if you don't mind
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.