I have for a long time known that websites give me cookies so that small pieces of information can be remembered about my habits, passwords etc. I accept this, but all of a sudden they are asking for my permission to do so.

Why has this changed? What sparked this?


This question was a Super User Question of the Week.
Read the blog entry for more details or contribute to the blog yourself

  • 30
    Remember guys! Use Ghostery and AdBlock Plus addons. Both in Chrome and Firefox. Always. – Shiki Jul 28 '12 at 17:17
  • 11
    @Shiki I use add block most of the time, but I don't think everyone should all the time. Thats how websites exist, from advertising revenue. Some websites even have different content if they detect plug in. – NimChimpsky Jul 29 '12 at 8:22
  • @NimChimpsky 1) If you install AdBlock at a friend or at a non-tech-savvy person, always use main filters, and only the most necessary ones. 2) If the person (or you) likes a forum or a site, unblock that. It's possible. Even easy for newbies. 3) But Ghostery should remain ON, for all the time. The only thing it kills (what you may want to use) is the ultra-cheap/worse online tech support chat. But those kind of support sites never help. Most of them are just bots, or unpaid/underpaid people who just redirects you to sites and whatnot. – Shiki Jul 29 '12 at 9:20
  • 1
    Legal questions are off-topic here – kinokijuf Oct 12 '14 at 20:26
up vote 120 down vote accepted

The EU e-Privacy Directive, otherwise known as the EU Cookie Law, originally came into place on the 26th of May 2012 and means you, as the site owner/administrator, have to get your visitors' informed consent before placing a cookie (probably related to social media elements or login/tracking systems) on their machine.

If you are a WordPress admin, there is a notification plugin for you to use which looks like this:

enter image description here

There is also a great overview.

According to the above link, it is not just standard cookies.

The law also affects anything that acts like a cookie, for example: Flash Cookies and HTML5 Local Storage.

There are also 'suggested categories' from the same link above (overview):

  • Essential (logins)
  • Non-Essential but harmless (functionality, not essential)
  • Fairly Intrusive (web tracking)
  • Very Intrusive (PII - personally identifiable information)
  • 12
    Worth noting that "implied consent" has been added to the directive at the last minute – Ben Brocka Jul 29 '12 at 2:04
  • 3
    If you're a serious site, check with a national lawyer. The plugin is sufficient for the UK law of May 26th, but not for all EU countries. E.g. the similar Dutch cookie law of June 5th is stricter and links up with the Protection of Private Data law. – MSalters Jul 29 '12 at 22:23
  • 2
    Wait, the cookie laws get even crazier! The Dutch government has decided that all websites in the entire internet in the whole world must obey the Dutch cookie law, which states that sites are only allowed to place cookies if you give them explicit permission. Yes, you are reading this correct, an opt in for cookies for all sites – BrtH Aug 21 '12 at 21:01
  • 1
    @BrtH: This is a normal consequence of international law. Every user is protected by the laws of the country where he lives. This means for websites: All websites, that a user could view, must comply with his countries laws. And this means for webmasters: Either they must build websites that will know in which country they are viewed and act according to the laws of this country, or they must build websites, that obey all laws of all countries. But one thing is clear: A Webmaster has to know all internet-relevant laws of ALL countries on this planet. – Hubert Schölnast Sep 14 '15 at 9:53
  • 1
    Unless my browser's being hijacked, that link seems to go to a chinese site for budding prostitutes... I believe the overview has moved here: cookielaw.org/the-cookie-law – Angel Joseph Piscola Aug 2 '16 at 2:48

The law has changed.

Functional cookies are still allowed, but other cookies now require explicit permission to set. This is something which is decided EU wide after self regulation failed. Each (EU-) country has its own implementation of the new laws, but all follow the same guidelines.

  • If explicitly needed: allowed
  • Else ask for permission.

Here are a few links to relavant articles regarding Cookie Laws:

  • 6
    You say the law changed, but you don't cite a specific law or movement. What laws? When did this change? – iglvzx Jul 29 '12 at 6:24
  • I did not add links because I was still searching for relevant links in another language than in my native language (Dutch). When I returned to the question with some of them bookmarked there were already two other answers which such links. – Hennes Jul 29 '12 at 11:33
  • You say functional cookies are allowed, so I can store cookies such as SSID and page language information at the visitor without informing him/her? – modiX Jun 29 '14 at 15:29
  • To quote from the second link I posted: "Some cookies can be exempted from informed consent under certain conditions if they are not used for additional purposes. These cookies include cookies used to keep track of a user’s input when filling online forms or as a shopping cart, also known as session-id cookies, multimedia player session cookies and user interface customisation cookies, e.g. language preference cookies to remember the language selected by the user". So yes, remembering the page language and not using for anything else is legal. – Hennes Jun 29 '14 at 18:30
  • I am not sure what you mean with the SSID part though. My guess is session ID, in which case you probably already got the answer. – Hennes Jun 29 '14 at 18:31

It's as a result of the European Union e-Privacy Directive.

You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent can be implied, but must be knowingly given.

There is an exception for cookies that are essential to provide an online service at someone’s request (eg to remember what’s in their online basket, or to ensure security in online banking).

The same rules also apply if you use any other type of technology to store or gain access to information on someone’s device.

protected by Community May 28 '16 at 21:52

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.