149

I have for a long time known that websites give me cookies so that small pieces of information can be remembered about my habits, passwords etc. I accept this, but all of a sudden they are asking for my permission to do so.

Why has this changed? What sparked this?

This question was a Super User Question of the Week.
Read the blog entry for more details or contribute to the blog yourself

Improve this question
5
  • 31
    Remember guys! Use Ghostery and AdBlock Plus addons. Both in Chrome and Firefox. Always.
    – Apache
    Jul 28, 2012 at 17:17
  • 12
    @Shiki I use add block most of the time, but I don't think everyone should all the time. Thats how websites exist, from advertising revenue. Some websites even have different content if they detect plug in.
    – NimChimpsky
    Jul 29, 2012 at 8:22
  • @NimChimpsky 1) If you install AdBlock at a friend or at a non-tech-savvy person, always use main filters, and only the most necessary ones. 2) If the person (or you) likes a forum or a site, unblock that. It's possible. Even easy for newbies. 3) But Ghostery should remain ON, for all the time. The only thing it kills (what you may want to use) is the ultra-cheap/worse online tech support chat. But those kind of support sites never help. Most of them are just bots, or unpaid/underpaid people who just redirects you to sites and whatnot.
    – Apache
    Jul 29, 2012 at 9:20
  • 1
    Legal questions are off-topic here
    – kinokijuf
    Oct 12, 2014 at 20:26
  • In 2012 already? Interesting. I started noticing this cookie warnings back then at some point. (I saw this Question around three years ago and look it up to check whether there have been any discussions about GDPR).
    – neverMind9
    Oct 25, 2018 at 23:10

3 Answers 3

Reset to default
121

The EU e-Privacy Directive, otherwise known as the EU Cookie Law, originally came into place on the 26th of May 2012 and means you, as the site owner/administrator, have to get your visitors' informed consent before placing a cookie (probably related to social media elements or login/tracking systems) on their machine.

If you are a WordPress admin, there is a notification plugin for you to use which looks like this:

enter image description here

There is also a great overview.

According to the above link, it is not just standard cookies.

The law also affects anything that acts like a cookie, for example: Flash Cookies and HTML5 Local Storage.

There are also 'suggested categories' from the same link above (overview):

  • Essential (logins)
  • Non-Essential but harmless (functionality, not essential)
  • Fairly Intrusive (web tracking)
  • Very Intrusive (PII - personally identifiable information)
Improve this answer
6
  • 12
    Worth noting that "implied consent" has been added to the directive at the last minute
    – Ben Brocka
    Jul 29, 2012 at 2:04
  • 3
    If you're a serious site, check with a national lawyer. The plugin is sufficient for the UK law of May 26th, but not for all EU countries. E.g. the similar Dutch cookie law of June 5th is stricter and links up with the Protection of Private Data law.
    – MSalters
    Jul 29, 2012 at 22:23
  • 2
    Wait, the cookie laws get even crazier! The Dutch government has decided that all websites in the entire internet in the whole world must obey the Dutch cookie law, which states that sites are only allowed to place cookies if you give them explicit permission. Yes, you are reading this correct, an opt in for cookies for all sites
    – BrtH
    Aug 21, 2012 at 21:01
  • 2
    @BrtH: This is a normal consequence of international law. Every user is protected by the laws of the country where he lives. This means for websites: All websites, that a user could view, must comply with his countries laws. And this means for webmasters: Either they must build websites that will know in which country they are viewed and act according to the laws of this country, or they must build websites, that obey all laws of all countries. But one thing is clear: A Webmaster has to know all internet-relevant laws of ALL countries on this planet.
    – Hubert Schölnast
    Sep 14, 2015 at 9:53
  • 1
    Unless my browser's being hijacked, that link seems to go to a chinese site for budding prostitutes... I believe the overview has moved here: cookielaw.org/the-cookie-law
    – Redmega
    Aug 2, 2016 at 2:48
55

The law has changed.

Functional cookies are still allowed, but other cookies now require explicit permission to set. This is something which is decided EU wide after self regulation failed. Each (EU-) country has its own implementation of the new laws, but all follow the same guidelines.

  • If explicitly needed: allowed
  • Else ask for permission.

Here are a few links to relavant articles regarding Cookie Laws:

Improve this answer
9
  • 6
    You say the law changed, but you don't cite a specific law or movement. What laws? When did this change?
    – iglvzx
    Jul 29, 2012 at 6:24
  • I did not add links because I was still searching for relevant links in another language than in my native language (Dutch). When I returned to the question with some of them bookmarked there were already two other answers which such links.
    – Hennes
    Jul 29, 2012 at 11:33
  • You say functional cookies are allowed, so I can store cookies such as SSID and page language information at the visitor without informing him/her?
    – Martin Braun
    Jun 29, 2014 at 15:29
  • To quote from the second link I posted: "Some cookies can be exempted from informed consent under certain conditions if they are not used for additional purposes. These cookies include cookies used to keep track of a user’s input when filling online forms or as a shopping cart, also known as session-id cookies, multimedia player session cookies and user interface customisation cookies, e.g. language preference cookies to remember the language selected by the user". So yes, remembering the page language and not using for anything else is legal.
    – Hennes
    Jun 29, 2014 at 18:30
  • I am not sure what you mean with the SSID part though. My guess is session ID, in which case you probably already got the answer.
    – Hennes
    Jun 29, 2014 at 18:31
19

It's as a result of the European Union e-Privacy Directive.

You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent can be implied, but must be knowingly given.

There is an exception for cookies that are essential to provide an online service at someone’s request (eg to remember what’s in their online basket, or to ensure security in online banking).

The same rules also apply if you use any other type of technology to store or gain access to information on someone’s device.

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged or ask your own question.