Andrew Cormack Janet Who Burnt the Cookies?

One portion... Mix with... Bake into... Resulting in... Recipe for Trouble Good intentions – They’re breaching your privacy... Technological innocence – Using cookies... Legislation – Regulating cookies...

An Unpleasant Taste EU Directive amended in 2009 – One small change makes a big difference: “is given the opportunity to refuse the storage of or access to that information” (2003) replaced by “has given his or her consent” (2011) Member States’ Laws due in May 2011 – UK enforcement begins next week Headline story: “All Cookies Need Prior Consent” – But law actually has a number of different flavours...

How many flavours? Directive says two: – Those “strictly necessary for the provision of an information society service requested by the subscriber or user” – The rest: “must provide information and get prior consent” UK Information Commissioner lists five or more: – Strictly necessary, settings-led, feature-led, functional and analytical, third party,... – Maybe these overlap? But then again...

How many ways to (tr)eat them? Three? – Itemise (list and describe) All of them (since 2003!) – except maybe non-personal, essential ones Clear Information Commissioner guidance/examples – Identify (on web pages/functions/etc. that need them) Those that do something the user asked for E.g. Remember language/preference, watch video, personalise Clear Information Commissioner guidance/examples – Interact (through some sort of consent dialogue) Those that do something else E.g. advertising, analytics Not clear 

Feeding frenzy? Guidance now appearing thick and fast – And inconsistent  E.g. International Chambers of Commerce – Agrees with ‘necessary’ and ‘functional’ – Analytics count as ‘performance’ (with load-balancers!) – Only cookies displaying adverts (not trackers) need consent E.g. UK Government Data Service – Look at privacy intrusion only – Analytics don’t harm privacy at all

Other countries? Seems to be less guidance What I can read mostly matches UK – With interesting variations on “necessary” Unless you know otherwise?

Samples now available But – Are these compliant? – Are they user-friendly? – Do they offer the choices you want?

UK Information Commissioner

British Telecom

Janet

Crumbs of comfort From the Information Commissioner guidance... – “1 st party analytic...might not appear as intrusive as...” (p20) – “simply allow you to improve your website” (p12) – “unlikely to prioritise...in any regulatory action” (p25) – “[ICO] may consider other options ourselves” (p27) Maybe do others first and let these firm up a bit? Behavioural advertising still looks indigestible  – But NRENs and their customers may rely less on these?

Leftovers Targeted advertising cookies – Regulators really do seem to want prior consent – ICC agree, but have no idea how to get it – NB when ICO sought cookie consent, only 10% gave it Platform & plugin cookies – “Above” and “Below” your content – Who is responsible for their compliance? And other things stored in the client – Web bugs, flash cookies, etc.

Menu (short-term) Work out what cookies you have Document them all Highlight the functional ones Decide on an approach to analytics – Consent-based? – Opt-out? – Privacy-based? Watch out for changes in technology and guidance

Menu (long-term) Get better at spotting these bugs when they turn up – Suggest better ways to solve the (real) problem Support our legislators – MEPs have scarily little help – Either in drafting or assess impact of what they do Look at the headlines and the text – They might not be the same – E.g. “right to be forgotten” 

I think we were lucky this time...

THANK YOU Janet, Lumen House Library Avenue, Harwell Oxford Didcot, Oxfordshire t: +44 (0) f: +44 (0) e: