Presentation on theme: "New Cookie Directives: What’s Crumbling? Presented by Mike Knight."— Presentation transcript:
New Cookie Directives: What’s Crumbling? Presented by Mike Knight
Housekeeping Audio/Video Questions – Use Quitegood.com/feedback.php Or use panel on RHS At the end – see where to download notes
Recap From Last Time Recap from Last Time Disclaimer What Are Cookies? Google What Are They For? Who Uses Them? Basic Cookie Security. Cookie Law – The Changes Interpretation Problems With It What To Do About It My Interpretation Resources Recap
Disclaimer I Ain’t A Lawyer! – This is Just My Opinion
What Are Cookies? [cont] Tab-separated columns are: Domain, Path, Secure(?), Expires, Name, Value www.httrack.com / FALSE 1999999999 foo bar www.secure.com /folder TRUE 1999999999 SSID xxx1234 www.example.com /abc/def FALSE 1999999999 Margaret Classical
Common Uses For Cookies. Shopping Carts Secure Logins User Preferences eg Languages, Accessibility, Remember Popups Name, Previously Visited... Web Analytics : New/Repeat, Clickpath Source, TOS, Browser, GEO(IP), KeyPhrase... e.g. Google Analytics, Omniture, Clicktracks, StatCounter... Used By People Like: Amazon, Ebay, LinkedIn, BBC,.... Even Us!
Cookie Security In themselves, they’re just text. Can’t be “Run” like a.exe Can be used as a form of spyware though by tracking sites Most browsers have built in privacy settings that provide differing levels of cookie acceptance, expiration time, and disposal after a user has visited a particular site. Cookies Transmit <> browser > website, if an attacker or unauthorized person gets in between the data transmission, the sensitive cookie information can be intercepted. Behavioral Software “Mouse Tracking...???” A bad programmer could store sensitive information, unencrypted. The United States government has set strict rules on setting cookies in 2000 after it was disclosed that the White House drug policy office used cookies to track computer users viewing its online anti-drug advertising.United Statesdrug policy office
Currently, Users Can (Via Browser Settings) 1.accept all cookies 2.accept all but third-party cookies 3.block all cookies
The Change in EU Law An amendment to the Privacy and Electronic Communications Directive known as the EU Cookie Directive came into effect on 25 May 2011 that requires website owners to be transparent with website visitors about how cookies are used. The Emphasis is on the user, not the website owner. It was deferred for a Year... Now What?
“Blurb” : Rather than the "Opt out" option for website visitors, websites will need to specifically gain the consent of their visitor and they must "Opt In" to be able to store cookies on their computer or other devices.This is expected to be difficult to manage and enforcement will more than likely be done subtlely and with encouragement rather than with the threat of fines and penaltys. What does the new law say? The new requirement is essentially that cookies can only be placed on machines where the user or subscriber has given their consent. 6 (1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met. (2) The requirements are that the subscriber or user of that terminal equipment-- (a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and (b) has given his or her consent. (3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient for the purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use. “(3A) For the purposes of paragraph (2), consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent. (4) Paragraph (1) shall not apply to the technical storage of, or access to, information-- (a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user. In Short ; essential Cookies are OK : eg Shopping cart Non-Essential Cookies are NOT OK, without Prior Consent
Problems With It. Well intentioned, but... It will annoy and confuse users. It will annoy and confuse owners. Everyone is now a law breaker... The law is different in every EU state. It puts EU businesses at a disadvantage. It’s a Real Mess!
Will it Affect Conversion Rate? Yes- Definitely. (At least Short term) Other Contentious Issues : Employer’s v Employees Preferences Once Set; Who Used a (shared) machine last? What about Existing Cookies in Existence That Are Set? Who Defines “Strictly Necessary”? What Are the Penalties?
What To Do http://mklink.com/privacy.php BBC Says : HOW WILL BBC WORLDWIDE COMPLY WITH THE LAW CHANGE? “The government's view is that there should be a phased approach to the implementation of these changes. Over the summer, we will be working on developing the best methods for obtaining your consent. In the meantime, you can control cookies by setting your device to notify you when a cookie is issued, or not to receive cookies at any time. We will ensure that we continue to provide you with clear and comprehensive information about the cookies we use, so that you can make informed decisions.” Cop Out!
FAQ’s Are Businesses Outside UK, affected? Yes, if they have operations in the EU. If your business falls under the jurisdiction of the EU then it is subject to this law. The regulators who enforce it are based in the member states of the EU. So if your organisation is – say - located solely in the US, but sells to EU customers, we don't foresee this causing problems for you. (Source Silktide) Can we just host our website outside of the EU? No. If your organisation falls under the jurisdiction of the EU, it doesn't matter where your website is hosted. It will be your organisation that is prosecuted, not your hosting provider. (Source Silktide)
FAQ’s What does "strictly necessary" mean? So if cookies are set for a service the user did not specifically request, they're not allowed. And if the service they did request didn't need those cookies, they're not allowed. Analytics, behavioural advertising and conversion tracking therefore seem clearly excluded. Login, adding items to a basket and most user preferences appear to be allowed.
FAQ’s Who is responsible for 3rd party cookies? The website the user is visiting, at least for now. EG Facebook “Like”; Google Analytics
Resources I “Borrowed Heavily from...” www.silktide.comwww.silktide.com Analytics Company http://www.ico.gov.ukhttp://www.ico.gov.uk (PDF to Download - Good For other stuff ) http://wordpress.org/extend/plugins/cookiecert-eu-cookie-directive/ http://wordpress.org/extend/plugins/cookiecert-eu-cookie-directive/ Wordpress Plugin Econsultancy.com – Good Old favourite!