EU's top court says tracking cookies require actual consent before scarfing down user data Websites may not present visitors with a pre-checked box that signals consent to the storage of HTTP cookies on their devices, according to a ruling [PDF] handed down on Tuesday by the Court of Justice of the European Union (CJEU). The decision follows from the German Federation of Consumer Organizations' challenge of German …
"You have the ulitmate freedom to click the back button, and go somewhere else. No-one forces you to visit any website."
Sorry, not good enough. Website owners may not block "general access" to the website on that basis, though they can prevent access to specific pieces of content where there is a legitimate reason to do so.
Of course that's only enforceable for EU-based sites. I find a lot of the offending sites are from big US publishers who probably consider their European audience too small to be worth bothering about, so they aren't going to spend money reconfiguring their sites just to comply with foreign laws.
So it seems, but there are still companies that assume consent by default, and require multiple clicks to opt-out (local world news websites in the UK are a good, but only one, example). There are other sites, usually ones that just have an "I Accept" footer banner, as mentioned further up by the OP) where you have to rummage around in the site's "privacy" policy to find out what cookies they place and then visit multiple websites to opt-out of that particular ad-slinger's cookies - usually by identifying yourself and asking them nicely not to track you.
The guidelines are simple: Consent must be clearly and freely given, and must be opt-in. Unfortunately there are many many websites that still think this doesn't apply to them and it'll take the administration of a few mega-fines to shift mindsets....
I have found lately that that is the case.
Some of the sites I visit on a daily basis have the usual Accept button - but in the small print above it there is a blue HERE word.
Clicking that takes me to a accept all/reject all panel.
Thankfully it does remember that I previously checked Reject all yesterday - but why does it ask me every single time to accept when I visit afresh?
But... How does it remember that I clicked Reject all yesterday?
A common ploy is to position a massive static "accept" panel blocking the content unless you tick the box - or turn the style sheet off ;-)
uBlock Origin's element zapper is very useful for dealing with those. A lot easier than using the web developer tools to give the interfering item a z-index of -1.
Not correct. The GDPR applies globally to the information of EU citizens and US based websites most certainly are in scope and liable to fines.
For which most corporations of note would have EU assets or income or failing that company officers could be arrested on visting the EU.
"Not correct. The GDPR applies globally to the information of EU citizens and US based websites most certainly are in scope and liable to fines."
True. However, considering the difficulty you folks have getting US corporations to pay their taxes, I wouldn't be overly sanguine about your ability to collect fines from them. A more effective approach would probably be to arrest corporate officers whenever they wander onto EU soil, and lock them up for 30 days or so.
"The GDPR applies globally to the information of EU citizens"
Actually it applies to data subjects in the EU, so US citizens (and other non-EU nationals) while present in Europe are also protected - insofar as anyone is actually protected. The GDPR is emerging as having very small teeth except where mega-corporations or massive data breaches are concerned. As always, de minimis non curat lex and most individuals seem to be minimal as far as this law is concerned. Here in the UK, enforcement is so poorly resourced that it not only takes some 3 months for a case officer to be assigned to a complaint, but (I would hazard) the majority of complaints by single individuals are apparently not pursued.
Of course that's only enforceable for EU-based sites. I find a lot of the offending sites are from big US publishers who probably consider their European audience too small to be worth bothering about, so they aren't going to spend money reconfiguring their sites just to comply with foreign laws.
Whilst still ripping off their American * audiences.
,
* And other, Latin Americans, say, are neither under EU protection nor signed up to North American apathy.
Actually, if you can’t accessed the website without consent, then the consent is not voluntary and doesn’t count, so all the data collected is collected illegally.
Would be nice to have a few companies operating that way being forced by a court to delete all the collected data permanently.
Wrong. That argument is basically like saying that a loan shark should be able to issue contracts with a "pound of flesh" as security, because people have the freedom to go to other loan provides if they wish. It is a complete non sequitur, and it is expressly countermanded by Article 4(11) of GDPR.
@ Charlie Clark "The cookie is required to map browser requests to the server session."
From ec.europa.eu
"...consent is not required for technical storage or access of the following cookies:
* Cookies used for the sole purpose of carrying out the transmission of a communication
* Cookies that are strictly necessary in order for the provider of an information society service explicitly required by the user to provide that service."
So, no change as I understand it. Absolutely necessary cookies, which your site simply cannot function without, can be placed without the consent of the user - though I think you still need the cookie notice.
As this ruling relates to a pre-checked box for targeted advertising cookies, which aren't essential, it falls foul of the rules.
Seems to me this ruling simply confirms the existing rules. IANAL, though...
The ruling is quite clear: consent must be explicitly given so such messages are invalid. This shouldn't really surprise any once as it has consistently been the position of the courts.
However, GDPR is currently being revised and it wouldn't surprise me if some cookies become legitimate without consent as long as there is a list of them with their purpose and lifespan. It's not as if this hard to do, though I've seen multiple, ahem, "developers" fail to provide a correct list and explantion of a website's cookies. Note, that failure to do this correctly could go beyond GDPR and enter the realms of fraud.
I've been to a couple of websites that allow you to view the cookies and disable them (wrong default!), but as there were over 100 tracking cookies on the site, it was a laborious task to go through and turn them all off! I'm guessing they are hoping most people won't look and those that do are too intimidated to take the time to disable them all.
Not always and everywhere. To zap a box isn't according the law that everybody should follow. I normally also drive in the spirit of the speed laws. But if they catch me the ticket is very real.
And that's an innocent box you mention. On the net however, some just don't give a toss and just keep doing what they are doing stuff knowingly to make sure that the only important thing, their revenue streams, are continuing. And yes, one could argue making money from activities which are not according the law are... oh dear, criminal. In comes the cookie wall. For example, try to read most Dutch newspaper/ site (here, here, here, and there are many, many more). They are all behind a cookie wall which sports only an "I accept" button. No small lettering, no hidden alternative. Just a solid cookie wall and "my way or the highway" arrogance. Like I said, standard "ignore and you get away with" behaviour... Standard Dutch behaviour...
I find Firefox's reader mode quite often makes it go away, along with a lot of other rubbish without clicking button (though sometimes kills the bits I want), alternatively deleting some nodes from the DOM using dev tools also often makes it go away but that is more effort
Under such circumstances you would be entirely justified in blocking cookies, or even sending them back altered to poison their tracking. (If enough people started doing that, they just might sit up and take notice!)
Firefox used to let you accept or reject cookies on a one-by-one basis.
As things stand, the United Kingdom will cease to be a member state of the European Union on 31st October 2019, after giving notice pursuant to Art 50 of the Treaty on the Functioning of the European Union (TFEU). UK businesses and nationals will lose their EU law rights in all 28 member states; non-UK EU businesses and nationals will lose their EU law rights in the UK; and the UK will cease to have rights or obligations arising out of the EU.
These fundamental legal changes will necessarily affect the relationship between the UK and the European Court of Justice (ECJ): the UK will lose its right to appoint judges to the ECJ or to be a party to cases before it; UK courts will have no power or duty to refer points of EU law to the ECJ for a preliminary ruling; and the EU Commission will have no power to bring proceedings against the UK for non-compliance with its obligations under the EU treaties.
The Withdrawal Bill suggests that the UK courts ‘need not [but may where appropriate] have regard to’ any ruling of the ECJ on a point of EU law, apparently including rulings relating to the period of UK membership but delivered after that date.
No, they haven't.
I know at least three ways in which that's the case, but as none of them has been discussed in the media I don't want to publicise them. Two of them would likely result in court challenges, the third appears immune even to that.
Ask me after the event - I promise to be honest about my assessment.
Who hasn't done what?
I think the government might be planning to break and subsequently challenge the law in which case, given the Supreme Court's recent judgement, it's likely to find itself subject to an injunction and likely to be held in contempt. And then there are still plans to prorogue for a Queen's speech…
The B-team has already demonstrated it doesn't have the best legal team and Bojo's declaiming that he won't comply won't help him in court either.
Pity the fools who have put their trust in these idiots.
To my knowledge, the UK parliament can (and have) force the PM to ask for an extension, but that doesn't mean that the EU will grant any extension.
If no extension is granted, it doesn't matter what laws are passed by the commons as they don't have the jurisdiction to force anything on the decision maker(s).
Couple of points on that.
VoNC where no government can be agreed defaults to election and if there is no prime minister there is no one to force to request the extension.
Civil Contingencies Act - Repeal the Benn act on grounds of potential civil unrest due to not leaving the EU.
I'm not saying either of those will happen and there are probably other options available like can he just resign? I don't know but I wouldn't put anything past that sneaky bastard.
There won't be a confidence vote until Corbyn agrees that someone else should be caretaker Prime Minister. His minders won't let him pull another December stunt.
Trying to repeal the Benn Act on any grounds would almost certainly be quashed by an injunction. The Supreme Court has asserted the primacy of Parliament and it's difficult to see even the High Court trying go against that judgement.
Bojo could resign but the fixed term act doesn't mean this will lead to a new election. Cf. resignations of Cameron and May. May eroded an already slim majority through bloody-minded attrition but Bojo just threw it away in a fit of entitled pique.
PMQs this afternoon with a decidedly C-team: Raab and Abbot
A confidence vote merely triggers an election - there's no legal requirement for Boris to resign, so his Government remains in power until the election.
(Which also means, for the person to whom you replied, that Boris would remain Prime Minister throughout that period, and subject to any applicable laws)
VoNC (or resignation) passes PMship to whomsoever can command confidence. So the new PM goes to the Queen the same day, and the request is sent the EU.
A general election is the backstop if nobody can win a VoC in 14 days. Only question is whether it's Corbyn or not.
Civil Contingencies Act, Government is immediately taken to court, loses case and is held in contempt of Parliament. Boris (and his team) may also be tried for treason, due to obviously premeditated illegal acts in direct contravention of the clear expressed will of Parliament.
Meanwhile, a VoNC has taken place and a new PM has been installed, who sends the request.
In any event another likely possibility is that the Queen dismisses Boris for refusing to comply with the law, and asks Parliament to recommend a new PM, who sends the request. There's been several hints that she's considering this.
The PM doesn't get to ignore the law. No matter how high you are, the law is above you.
I am afraid you are overlooking one minor detail about sending a request for another extension: it might get denied (and it seems likely the EU just might do so this time), which only leaves the nucleair option of revoking article 50 (as already mentioned in a comment below).
@AC
"Have you stopped beating your wife? See anyone can spout some bullshit accusation without evidence. Doesn’t make it true."
Oddly this has been a point made constantly by the leave groups as they are attacked over and over with accusations and investigations into perfectly legal activities. Amusing to see the same tactics being used against the attackers.
No, it's the one where they worked out a date with the EU instead of announcing something preposterous to all and sundry then flying over to Brussels only to be told it won't whatever it is won't work because [extremely obvious reason everyone knew for weeks].
@Dan 55
"No, it's the one where they worked out a date with the EU"
The deadline was back in march. Then extended to October. So they want to agree another date, is this the one where they put out? At what point do they implement brexit?
"instead of announcing something preposterous to all and sundry then flying over to Brussels only to be told it won't whatever it is won't work"
Yeah I really dont know what his plan is with this. Maybe he is serious maybe its some kind of ploy. Hard to tell with boris, he will do anything for his goal which so far has been gaining power.
"The Benn act says otherwise."
It really doesn't, it just says we have to ask for an extension if no deal can be decided. If the EU offer an extension, the government still have to then change the law regarding leaving on Oct 31st, which can be stalled and we leave with no deal anyway.
No they haven't. They passed a law saying that the PM must ask for an extension instead of no deal. Which would likely be refused and which Boris will likely just ignore.
The remoaner idiots are just making our renegotiating position weaker. The EU already went from "take it or leave it" to discussing other possible options solely due to the threat of no deal. The mainland European economy is rapidly circling the pan, and the last thing they want is to loose free access to UK markets.
The result of the referendum needs to be implemented ASAP.
By which measure? Balance of payments, we hold the upper hand. Job losses in the event of 'no deal', we lose 12,000 while the rest of the EU lose around 400,000. Intelligence and security, we spend nearly as much as the rest of the EU put together and have a strategic relationship with the US.
Raw GDP, land mass and number of people, sure, the EU is larger. I think it would be naive to think that this makes them willing to accept the UK leaving without a deal.
No, we do not. At all. Youre either lying or believing a lie.
The EU is risking a maximum of about 5% of exports, the UK is risking 46% of exports (and 54% of imports).
(Ref: Commons Briefing stats in EU/UK trade. Google it.)
Threatening "No Deal" is going to a car dealership, and saying that if they don't sell you the car you'll steal it and torch it.
The dealership has other cars, but you're going to prison.
Oh please. "UK exports to the EU were £289 billion" and "UK imports from the EU were £345 billion" (from the very source you cited).
Sounds like a massive trade deficit to me, which means that cessation of trade (which wouldn't happen) would cost the EU £56 billion of exports more than it'll cost the UK.
Which was my point.
I'm not sure of your car analogy point, I'm sorry. Nobody in the UK is threatening to steal and burn one of the EU27.
Sounds like a massive trade deficit to me, which means that cessation of trade (which wouldn't happen) would cost the EU £56 billion of exports more than it'll cost the UK.
I suggest you go and learn the difference between percentages and values.
"Threatening "No Deal" is going to a car dealership, and saying that if they don't sell you the car you'll steal it and torch it."
No, threatening "No Deal" is going to a car dealership and saying if you can't agree a price you'll walk away. A relatively strong bargaining position.
Removing "No Deal" from the table is going to a car dealership and telling them you have to leave with a car, no matter what. A very weak bargaining position.
It is clear a lot of people have never tried to negotiate anything in their life.
No, threatening "No Deal" is going to a car dealership and saying if you can't agree a price you'll walk away. A relatively strong bargaining position.
That is no problem whatsoever to the dealership, it will sell the same car about an hour later to some other, more reasonable customer. "No Deal" isn't a bargaining position, it is a gambling position without any further back-up.
It's not that kind of negotiation. The British government has certain red lines (that it's tying itself in knots over). The EU came came up with what was legally possible given those red lines. As much as the UK beats or sets up some last minute game of chicken, it won't get anything different unless it changes those red lines.
Johnson's "take it or leave it" offer is so much like no deal that it might as well be no deal. Whether or not that is the intention, who knows.
What really gets my goat are the sliders (don't know the proper name, but like old fashioned toggle switches).
OK, they often have a red and a green end, but does red really indicate that you don't want the item? (I have seen grey and red, and green and grey!)
And they are usually associated with a negated question, which compounds the issue.
e.g. "Do you want to not disable advertising?" Grey/Green
Totally agree. Just the way the options are worded sometimes has me scratching my head whether I'm turning something on/off. Very obviously designed that way as it's not difficult to ask a question about a binary 'kin answer. Rips my 'kin tits, and I'll usually just exit the site.
This cookie thing has been great fun so far. Make sites nag with crap options for something most people dont care about. For some sort of privacy? I have an idea, when I go to a website the bugger should just work. I dont want to be nagged and I can leave the site and go elsewhere to someone who doesnt. Unfortunately with GDPR-sucks life has got harder for little benefit as far as I can tell.
Sites have an option. Obey the law and stop violating people’s privacy. You want to show ads? That doesn’t need tracking, just show ads related the the content of the site. The banners are not mandated by GDPR, they don’t even comply with it so how could they be. They are an attempt to circumvent the law.
On the plus side: some damned good beer, schnapps, Heckler & Koch, a few of great composers, some decent motor cars and resistance to Roman expansion long ago.
On the minus side: Karl Marx, a couple of world wars, sauerkraut, sarin, mustard gas, Rhineland wines and world leaders of industrial pollution until the USA and then China showed how it should be done.
Still ambivalent over their contributions to the UK aristocracy.
Sauerkraut and Rhineland wines are wonderful .. sounds like you just haven’t experienced good ones.
As for aristocracy the choices are limited - Hapsburgs, Bourbons, Glukcksbergs who are all related anyway, so hardly specifically German or a choice.
And then there are Messrs Hilbert, Reinmann, Gödel, Gauss, Krebs and Koch, to name but a few...
Given that it's almost impossible to have an interactive web site without using cookies.
The whole thing is just a waste of time and effort. Most people just click on the accept button automatically, no one has time to read the "policy" small print, and given that you cannot book a plain ticket, shop online, book a hotel, etc. etc. without using cookies you may as well give up on the internet if you don't like them.
So nothing has changed except forcing people to go through a pointless "accept" dialog, plus, thousands of man-hours eaten up creating said pointless dialog.
Given that it's almost impossible to have an interactive web site without using cookies.
There's a world of differnece between a session cookie containing state, and an advertising cookie used for targeting crud at you. The first is perfectly permissible (with no need to ask permission) and teh other requires explicit opt-in consent. The fact that nobody in their right mind would opt in to having targeted adverts chucked at them (in the same way no sane person would opt into having targeted rocks chucked at them) means that advertisers are deliberately trying to find ways to circumvent the rules.
Where possible, I try to prevent any adverts from being served to me at all, for three reasons: it's my bandwidth, I don't want to see them, and I don't trust third party crap being served to my browser to not be as virus-ridden as a crack whore.
"advertisers are deliberately trying to find ways to circumvent the rules."
I remember the day I stopped using Tucows.com. It was the day the ad-blocker stopped downloads working because they re-directed all the download links via the ad server. I don't even know if Tucows still exists.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
