French privacy cops snarl at websites over crap EU cookie warnings French privacy watchdog CNIL has snarled at 20 websites for failing to comply with EU cookie laws. Following a series of raids last year, the Commission Nationale de l’Informatique et des Libertés this week put the websites on notice for not giving users enough information about how their activity is being tracked. Under EU …
"This site uses cookies..." Really? NO SHIT!
The banner just gets in the way and provides no information whatsoever that is off any use. It's not the cookies from the site that are the issue, it's how the information gets uses and that's more down the the third party data-miners...err..privacy invaders. i.e. advertisers.
If the EU wants to do something useful, the need to impose laws against cross-site tracking except when allowed via explicit and informed user consent.
> It's not the cookies from the site that are the issue, it's how the information gets uses and that's more down the the third party data-miners...err..privacy invaders. i.e. advertisers.
Which, as I read the article, is precisely what the CNIL want websites to be forthcoming about.
Totally agree with you on third party cookies, btw. Especially since, when I'm giving The Register permission to set some cookies & stuff, I'm not really giving permission to App Nexus, DataPoint Media, Doubleclick, Facebook, Google, and Twitter to do so.
I'm fed up with these click-through warnings that are so ubiquitous that they amount to "This website also uses cookies". It doesn't seem to achieve anything for me - and as usual the really bad actors will hack around the letter of the law or simply ignore it. So I'd like my browser to set a "yep-I-already-know" field on all GETs.
I always understood the ruling as you have to click on a consent rather than just reading it. I see a lot of sites with 'we use cookies' banner but I ignore them on the basis that a cookie should only be installed when I allow, but more often than not the cookie is already installed.
A high % of those banners you ignore actually say something like "your continued use of this site is considered acceptance of this [cookie] policy" and then use cookies anyway.
The banner is utterly pointless, I still see it here on El'Reg, my brain treats it like ads and doesn't bring it to my conscious attention.
It's interesting to see that my small web site meets someone's legal interpretation. There was I thinking that my development time had been wasted by over-engineering it to meet the spirit, as well as the letter, of the directive.
Users are told that their details will only be stored as cookies if they put a tick in a box on a form where such action is effected. At any future point they can untick the box and their cookies will be removed.
Unfortunately it is unlikely that many of my users live in France.
I'm really pleased to see that they are doing this - the EU law is clearly written to require informed consent before dropping cookies on browsers, but clearly websites drop cookies on browsers anyway and the pop-up is just to tell you that they have done that, not to obtain positive consent first (as opposed to e.g. some kind of passive of implied consent).
As per other earlier comments, the current click-through warnings are utterly pointless and just seem to be done to provide a veneer of "You must have consented because we told you that we had done it."
If this causes websites to actually do what the law requires them to do and obtain positive consent before dropping cookies on browsers then that's great. If websites want to block access to people who don't consent then that's up to them, but the point is that they have to obtain positive consent first.
I visit a lot of websites. I have no interest in having to give my "informed" frikking consent every time I visit a new one. I'm busy.
Pointless waste of time and a classic example of the French noticing something in the world that isn't wholly about them so shitting on it so people pay them attention.
"although some of the sites have a banner informing users that cookies will be placed on their computer, none of them waited for consent before doing so."
That is indeed illegal. So is this website:
https://ico.org.uk/
That's the website of the government department in charge of enforcing the cookie law in the UK.
And they break it themselves.
You couldn't make it up....
If I remember correctly from when I read the law a long time ago, 'necessary' functional cookies were permitted, I.E. cookies that make the website work are allowed, but those that are not needed are not (i,e, Tracking cookies)
Which I read to mean, I can have a single session cookie for my website, which is the only cookie I ever use anyway...
JobServe is the only site I've seen that does it right, in that it will not set any cookies until you accept the banner. If you want to log in, etc... you have to accept the banner first. Wonder how they did that right because JobServe so many things wrong...
The Register just does what most do, which is stick up a banner and then set cookies anyway.
You kinda need to sign in to a jobs site - so JobServe can behave this way.
We used to have a much longer message / acceptance - but it was too intrusive for mobile. So along with most UK publishers we eased up on the message side. We are confident that we are complying with the law and equally confident that readers who don't want cookie know how to wipe them after each session.
"too intrusive for mobile" and "we trust our users yada yadda" is just marketspeak for "we can't be arsed".Let's forget we're on a tech site and pretend you don't know any better; one good way to comply with the law would be:
-check for the REGACCEPTCOOKIES cookie; if present, proceed without any banner or warning;
-if absent, present the user with a tick-box (in any form: dedicated page, another bit of JS crap, whatever). If box is ticked, set REGACCEPTCOOKIES cookie (and then some);
-if box is not ticked, present the user with whatever you feel you can do without setting cookies. Heh, that may even be a blank page with "tick the box, dummy" in the center; not nice, but legal.
-job done
Intrusive? Maybe on the first connection. Much less intrusive than the current solution in the long run though.
I'm sure there are other ways you can think of.
You can browse JobServe without signing in or accepting cookies. You can apply for jobs without signing in but you do need to accept cookies to though, but not until that point.
The use case for El Reg is similar, you could not use any cookies until someone actually posts and to do that they would need to accept cookies and sign in, but not until that point.
But advertising being what it it is...
Do you have to be compliant with just the UK's law or other EU states' laws too because their residents access your site and what El Reg does isn't in compliance with their law? I'm pretty sure you'd get a fine for your trouble from the French and Spanish data protection authorities.
Still, there are always Flash cookies and LocalStorage data if you want to get round the letter of the law.
This post has been deleted by its author
> Still, there are always Flash cookies and LocalStorage data if you want to get round the letter of the law.
It would really help if you actually knew the law before giving advice.
Directive 2002/58/EC talks about "information stored in a user's terminal equipment", and the accompanying guidelines make explicit reference to both the two technologies you have mentioned as well as a bunch of others.
> We are confident that we are complying with the law
So how about all those third party cookies, some from companies I didn't even know existed (DataPoint Media, App Nexus) and the rest from companies I do no business with (Facebook, Twitter, Doubleclick, ...), and which I never got a chance to accept or decline?
The thing is, those advertisers just dump the cookies anyway, *not* helping you in the process as there is no need for cookies, local storage, and stuff to either display advertising or get paid for clicks, and completely disregarding the wishes of your users (which is questionable whether you're obtaining any form of informed consent as required by the law).
Also, being confident "that readers who don't want cookie know how to wipe them" would hardly pass muster, as the law does not make users responsible for wiping cookies, much less requires them to be knowledgeable in those arts.
In short, Drew, your comment is utter bullshit.
"Amazon utilise des cookies. En savoir plus" is all you get from amazon.fr
Amazon does even tell you you could disable them (and how).
Full law here: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
They even provide tempate and some kits (http://webtools.ec.europa.eu/cookie-consent/documentation/)
"If you continue to browse this website, you are allowing all third-party services"
Things are bad enough without you making things up (or is it bad translation?). The French version crudely reads "by browsing this site you allow 3rd-party cookies as needed for video presentations", with a box labelled "OK, accept all" (in green) and another labelled "tune to your needs" (in gray). The "tune" link allows you to opt out of the 3rd-party cookie setting, which are from DaylyMotion and YouTube (explicitly stated, individually tunable).
On my cursory check 10 s ago no cookie was set at all (I did not check the "OK, accept all" button, obviously).
I'd say they're pretty much following their own rules, unless I missed something.
@ Pierre - it would be useful if you actually visited the link given.
1. Can you please define "continue to browse"? The message, which is not a bad translation from French but is given IN ENGLISH exactly as written, implies that by using the CNIL website, you are giving consent to third party services. It is better than some in that you can personalise the cookies, but does it work? I set DailyMotion to Deny then followed a link from CNIL to a DailyMotion video (tutoriel pour les achats en ligne) and ten session cookies were set by DailyMotion, plus an LSO (persistent Flash cookie) from static1.dmcdn.net containing video player settings and a session ID. So much for CNIL's Deny option.
2. You will notice that the message and personalisation options go away when you navigate around the site. This is because CNIL creates session cookies in the form of _pk_id.#.#### and _pk_ses.#.#### (where # is a number), these seem to grow as you visit the site, switch languages, etc. I have three pairs at the moment. There is also a cookie called "tartaucitron" (ho ho) which records the so-called preferences for DailyMotion and YouTube.
3. Yes, they are session based, but it seems that there is too much going on to be anything other than CNIL tracking your behaviour on the site.
4. This only happens if you have JavaScript enabled (ie, not using NoScript etc). That you saw the message means that you had the cookies set. It happens sometime as the page is loading when it calls http://piwik.cnil.fr/piwik.php, and it appears to pass if you have realplayer, wma, director, flash, Java, gears, your display resolution, plus how many milliseconds it took to fetch the page body; and the reply is a 1x1 image, plus cookies. All of this without obtaining your consent.
Maybe if you took as long looking at the site as writing your reply, you might have noticed this.
> Stop it.
> It's inhumane!
Easy enough: All that needs to happen is sites actually stop using cookies, etc., willy-nilly.
The biggest website that I've been responsible for, with a few thousand visitors per day, 50% of which were paid subscribers, never used a single cookie or other persistent storage technology, and was highly praised for its usability and responsiveness.
This was well before the so-called cookie law came into effect. Once it did go into effect I realised there was nothing we needed to do because we did not store any info on the user's computers, so the user experience was not degraded *and* it took us literally zero work to comply.
If we could do it, why others can't?
NB: Google Analytics & similar are overrated. We got all the info we needed from our access logs, which was more than sufficient to get a useful demographic profile of our visitors without being intrusive.
This post has been deleted by its author
Re load balancing cookies - this is not a problem. From the web site, http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm, mentioned above by xyzw:-
However, some cookies are exempt from this requirement. Consent is not required if the cookie is:
used for the sole purpose of carrying out the transmission of a communication, and
strictly necessary in order for the provider of an information society service explicitly required by the user to provide that service.
Cookies clearly exempt from consent according to the EU advisory body on data protection- WP29pdf include:
user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases
authentication cookies, to identify the user once he has logged in, for the duration of a session
user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration
multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session
load‑balancing cookies, for the duration of session
user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)
third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.
Most websites track every search, article read, linked with other sites you view, every geo-located IP etc.
Most phone apps track every click.
Most big shopping arcades track people using their wifi MAC.
This is all used not only so that they can 'optimise the experience' but to sell to advertisers.
And all this without our consent. There is virtually no push back to companies that track us.
How about some options in your browser, rather like iphone "this app wants to use your location"? It would say "this site wants to track you and sell it to advertisers". Of course you can say No, and sites have the same choice as with ad blocker - either let you continue anyhow (and lose a bit of revenue) or refuse to let you use the site.
Whilst a good chunk of the web & phone apps are funded by tracking & ads (google apps, media), all the rest (government, shops, wikipedia) we should have a choice to not have them track us too, because currently it is so god damned easy for companies to do it.
I remember in Netscape Communicator you could get it to pop up an accept/deny dialog box for every new cookie set by the server while the page was loading (stopping the load while the dialog was displayed, naturally). It was fairly intolerable then, now it would probably be called a denial of service.
> How about some options in your browser, rather like iphone "this app wants to use your location"? It would say "this site wants to track you and sell it to advertisers".
There was some effort years ago, but it died a death long ago (perhaps because some of the usual sponsors of this sort of work felt threatened by it?)
This was it:
Does anyone by any chance have the source IP ranges of the CNIL?
They seem to be pining for websites with more popups and deliberately intrusive and obstructive messages. I'm sure many, many website operators could find it in their hearts to make an exception and give these chaps exactly what they're asking for :)
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
