The Cookie Law

A brief discussion of issues around the EU Privacy Directive with regards to the use of cookies in the UK. Given in the PHP UK 2012 Unconference.

Transcript

1. THE COOKIE LAW
   ianb@php.net
   

   View Slide

2. 6.—(1) Subject to paragraph (4), a person shall not use an
   electronic communications network to store information, or
   to gain access to information stored, in the terminal
   equipment of a subscriber or user unless the requirements of
   paragraph (2) are met.
   (2) The requirements are that the subscriber or user of that
   terminal equipment—
   (a)is provided with clear and comprehensive information about
   the purposes of the storage of, or access to, that information;
   and
   (b)is given the opportunity to refuse the storage of or access
   to that information.
   The Privacy and Electronic Communications
   (EC Directive) Regulations 2003
   

   View Slide

3. (3) For paragraph (2)(b) substitute “(b) has given his or her
   consent”.
   The Privacy and Electronic Communications
   (EC Directive) (Amendment) Regulations 2011
   

   View Slide

4. User
   Session
   Client
   Local
   Track &
   Profile
   

   View Slide

5. User
   Session
   Most
   Preferences
   Shopping
   Basket
   Analytics Ad
   Network
   Behavioural
   Tracking/
   Retargetting
   Social
   Plugins
   Affiliate
   

   View Slide

6. Remove
   Replace
   Get Consent
   

   View Slide

7. Remove
   

   View Slide

8. View Slide

9. View Slide

10. Replace
    Flash Local Shared Objects
    Silverlight Isolated Storage
    HTML5 Local/Global/Session/
    Database Storage
    Image Cache
    Browser History
    

    View Slide

11. Query Parameters
    Last-­‐Modified:  Thu,  21  May  2009  21:26:08  
    GMT
    ETag:  "650a7c7523865eae0c7294aa4e7b50dd"
    ETags
    94.13.243.217  -­‐  [13/Feb/2012:14:19:57  
    +0000]  "GET  /user/themes/dilectio/
    images/mright.gif  HTTP/1.1"  200  390
    Log Analysis
    

    View Slide

12. Javascript Fingerprinting
    https://panopticlick.eff.org/
    

    View Slide

13. Client Server
    request ad / send cookie
    send targeted ad
    request ad
    send tracking JS
    send finger print
    send targeted ad
    

    View Slide

14. Get Consent
    

    View Slide

15. View Slide

16. View Slide

17. View Slide

18. View Slide

19. View Slide

20. •Web Statistics
    •Google Analytics
    •_utmz
    

    View Slide

21. View Slide

22. View Slide

23. “Although the Information Commissioner cannot
    completely exclude the possibility of formal action in
    any area, it is highly unlikely that priority for any
    formal action would be given to focusing on uses of
    cookies where there is a low level of intrusiveness and
    risk of harm to individuals. “
    

    View Slide