EU PECR rules on getting permission to use cookies - how can XF help make me compliant?

[MGSteve]

The rules were changed at the last minute to allow implied consent by informing people you use cookies, explaining what they are used for, and advising them that continued use of your site is an acceptance of said cookies.

That being said, it'll be an interesting technical challenge to try and manage individual cookies - especially those set by third-parties such as advertisers.

Yup, a complete farce if you ask me. It was litterally the last minute - the day before the rules came into force they allowed implied consent. This was of course, after most of the large sites had already done the work to present a popup!

We just list them in our privacy statement, along with what they are for. We don't allow people to opt out selectively, its allow all or don't use the site.

When it gets moved over to XF I *may* spend the time to allow people to opt-out of certain ones, but to be honest, I probably won't. Most users don't give a toss to be honest.

 

[duderuud]

The problem is: You have to explicitly list the cookies you install in my computer and give me the choice to remove them if I want to. I'm actually working with a large web store that want to become 100% compliant in UK and use as solution TrustE to clean their cookies. Their lawyers said that you have present the user with a popup that notifies him/her about all cookies and let them choose if they want to remove ads related cookies and keep only the minimal required cookies for site functionality. If by any chance you say you remove the cookies but you don't, there it comes the big boy hammering you with a large fine.

From that perspective, all the cookies related to trackers and ads will 100% be deleted by users making you lose important revenues. That is enforced only if your company is registered in UK.
At least that is what their lawyers say.

I'm from Holland and the same applies here. It is impossible to comply to the regulations because they are to vague. And because of that no one exactly know which cookies are allowed and which not.

 

[Hackfall]

The problem is: You have to explicitly list the cookies you install in my computer and give me the choice to remove them if I want to.

How are the ICO in the UK going to enforce that when their own site doesn't allow this. The ICO website just has a link to a page that explains how to delete cookies yourself on your browser in prefs or tools.

 

[Slavik]

Thank you for the post. Slavik, Jake or any mods, could you please merge the threads?

Done

 

[Lycaon]

I implemented this on my sites - http://civicuk.com/cookie-law/index

 

[Floren]

I implemented this on my sites - http://civicuk.com/cookie-law/index

That's not a proper implementation, I don't see anywhere the choice to delete the cookies. To me it looks like a fancy way to improve their rank in Google, I would never implement that in a site governed by UK enforced cookie law. Take a look at a proper (legal) implementation, this is a good example what needs to be built directly into XenForo.

Seriously, there is no feedback from any company directors?
Do we still have a communication line with XenForo team or this aspect of customer service became a myth?

The EU cookie law is an important matter that should be addressed quickly starting with XenForo site, so I don't understand why there is no reply from anyone.

 

[Mike]

We're looking into what is necessary.

 

[Slavik]

The EU cookie law is an important matter that should be addressed quickly starting with XenForo site, so I don't understand why there is no reply from anyone.

Problem is Floren, not even the ICO can give propper details as to what is "acceptable" or not. When I rang up I was told to "look on the website". When I pushed for more specific answers I was told I would "have to do with the guidance on the website" until more definative guidance was published.

Recent developments seem to suggest "implied consent within your websites ts+cs" and "instructions to remove cookies" are good enough.

Other people claim different things.

Personally I find BT's implementation rather elegant... http://www.bt.com/ look under the footer.

 

[Chris D]

That's not a proper implementation, I don't see anywhere the choice to delete the cookies. To me it looks like a fancy way to improve their rank in Google, I would never implement that in a site governed by UK enforced cookie law. Take a look at a proper (legal) implementation, this is a good example what needs to be built directly into XenForo.

Seriously, there is no feedback from any company directors?
Do we still have a communication line with XenForo team or this aspect of customer service became a myth?

The EU cookie law is an important matter that should be addressed quickly starting with XenForo site, so I don't understand why there is no reply from anyone.

I think it's important to bear in mind that as important as this is;

a) It needs to be done properly
b) I'm sure the "law" will be quite relaxed with a bit of a grace period before they start handing out fines and what have you to websites.

It's also worth remembering that they're going to start scrutinising websites first that are big hitters. Such as Google, Facebook etc.

Neither of these two yet adhere to the Cookie law, they'll get in trouble ages before little internet forums do.

 

[Floren]

Problem is Floren, not even the ICO can give propper details as to what is "acceptable" or not. When I rang up I was told to "look on the website". When I pushed for more specific answers I was told I would "have to do with the guidance on the website" until more definative guidance was published.

Recent developments seem to suggest "implied consent within your websites ts+cs" and "instructions to remove cookies" are good enough.

Other people claim different things.

Personally I find BT's implementation rather elegant... http://www.bt.com/ look under the footer.

Thanks for the info, much appreciated. That is exactly what TRUSTe does. At least that is how the setup will be done on the web store I was referring earlier.
What's left is a word from XenForo developers how this will be implemented in XenForo. Are we going to have an official answer from them?

 

[Chris D]

Thanks for the info, much appreciated.
What's left is a word from XenForo developers how this will be implemented in XenForo. Are we going to have an official answer from them?

Mike says they're looking into it.

 

[Floren]

Mike says they're looking into it.

Where was this posted? I don't see any replies from devs into this thread...
How long does it takes to post a clear answer?

 

[Pereira]

Where was this posted? I don't see any replies from devs into this thread...
How long does it takes to post a clear answer?

http://xenforo.com/community/thread...lp-make-me-compliant.29690/page-2#post-370825

 

[Slavik]

Where was this posted? I don't see any replies from devs into this thread...
How long does it takes to post a clear answer?

Above my post, he ninjaed me to it

Also for your reading

http://www.ico.gov.uk/news/blog/201...idance-e-privacy-directive-eu-cookie-law.aspx

Key points being.

• Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies.

• If you are relying on implied consent you need to be satisfied that your users understand that their actions will result in cookies being set. Without this understanding you do not have their informed consent.

• You should not rely on the fact that users might have read a privacy policy that is perhaps hard to find or difficult to understand

 

[Floren]

Above my post, he ninjaed me to it

Wow, sorry about that. When I clicked on the thread title it skipped Mike's post... I apologize.
The British Telecom implementation is really sweet, I hope something like that will be done in XenForo.

Code wise, I hope the GeoIP PECL extension will be used...

 

[HWS]

We're looking into what is necessary.

Since the sites will get almost unuseable without cookies, everyone will accept it.
This is why you can simply ignore it.

IMHO the regulators are aiming against tracking cookies from advertising agencies.

 

[Floren]

IMHO the regulators are aiming against tracking cookies from advertising agencies.

Which is a great thing. Imagine you visit one of the Simlinks/Viglink sites and they install a eBay cookie that generates them revenue on items you purchase within 10 days. That is theft, IMO... not to mention they can track your activity on other Simlinks/Viglink sites and get a global apercu of whatever you visit and buy. I want the choice to disable this scam, if I visit their sites. By principle, if any site I visit has those type of products installed I never come back again... but sometimes we are forced to, due to the nature of information they offer.

 

[akia]

I never come back again... but sometimes we are forced to, due to the nature of information they offer.

If the information is that essential, it seems a fair price to pay.

 

[MGSteve]

Which is a great thing. Imagine you visit one of the Simlinks/Viglink sites and they install a eBay cookie that generates them revenue on items you purchase within 10 days. That is theft, IMO... not to mention they can track your activity on other Simlinks/Viglink sites and get a global apercu of whatever you visit and buy. I want the choice to disable this scam, if I visit their sites. By principle, if any site I visit has those type of products installed I never come back again... but sometimes we are forced to, due to the nature of information they offer.

C'mon Floren, you can't call that theft. For a start, I'm not sure the SkimLinks or VigLinks cookies actually remain on eBay (or wherever) past the length of your visit to eBay - I could be wrong though.

Either way, quite how is it theft? Who are they stealing from - you? No, as you don't pay any more if you click on an affiliate link, the website that had the affiliated link on it just earned a few cents by you clicking the link - its not theft, its called monetisation.

In any case, Skimlinks in particular do allow you to opt out of the tracking aspect of their system by setting an opt-out cookie.

But to call it a scam and theft is so far wide of the mark, its ridiculous.

 

[Floren]

C'mon Floren, you can't call that theft. For a start, I'm not sure the SkimLinks or VigLinks cookies actually remain on eBay (or wherever) past the length of your visit to eBay - I could be wrong though.

It is confirmed, the cookie stays active for 10 days. Anything you purchase through an affiliate link will bring money to the visited site owner and Simlinks/Viglink, regardless if you buy or not a product/service through the original affiliate link they posted in their site. I have no idea why they allow this in other countries, users should be informed they are putting money into someone else's pocket without knowing.

Either way, quite how is it theft? Who are they stealing from - you? No, as you don't pay any more if you click on an affiliate link, the website that had the affiliated link on it just earned a few cents by you clicking the link - its not theft, its called monetisation.

I remember once that I went to buy some airline tickets and the price was $40 more than the linked price. Once I deleted my cookies, the price was proper. Yes, I call this theft.

In any case, Skimlinks in particular do allow you to opt out of the tracking aspect of their system by setting an opt-out cookie.

That is nice, I did not see this anywhere on sites that use the system. Feel free to show me few examples. I'm pretty sure that option is very well hidden, not clear like the UK cookie system is.

But to call it a scam and theft is so far wide of the mark, its ridiculous.

It is your choice to accept those type of programs, the same way I see them as a bunch of scammers and thiefs that take advantage of the legal system. I bet 99% of people who click on links like that have no idea how the system works. Everyone is entitled to their own opinion and I respect your choice, the same way I'm sure you respect mines.