Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what goodies he has viewed previously.

In my opinion we don't do anything harmful as content advice that the user may enjoy is all we do, using tracking cookies. But as far as I know, in the EU it's illegal to use cookies even for this (not harmful) purpose.

Is there a real risk of being prosecuted when using tracking cookies for not harmful purposes? What countries prohibit tracking cookies besides the EU?

share|improve this question
It actually is not "illegal" to use tracking cookies in the EU. Because if it was illegal then Facebook, Amazon, and a million other services that are built around cookies would cease to function. You might want to read the actual law, then hire a lawyer, to explain what you must do in order to comply with the law. – Ramhound Oct 5 '12 at 16:55
HTTP as a protocol was designed stateless and requires a token to know who you are. That means it suffers from advanced Altzheimer's disease and cannot remember you unless it gives you a note with your name on it which you give it back when you ask it for the next transaction. This is known as establishing a session and therefore is a fundamental part of running an ecommerce website. – Fiasco Labs Oct 20 '12 at 18:44

3 Answers

up vote 1 down vote

This document outlines the changes in the EU cookie law, and things you need to pay attention to: http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/~/media/documents/library/Privacy_and_electronic/Practical_application/cookies_guidance_v3.ashx

From my understanding of the content, the important thing is gaining the users' consent when storing a cookie on their computer. The two exceptions are:

(a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.

covering vital things such as session cookies to allow the user to stay logged in from page to page.

What I've seen a lot of sites doing is have a popup on the first visit (usually inline somewhere in the page) explaining that the site needs cookies to function, blah blah, here are the cookies we wish to set, do you accept, yes/no.

It seems to be all about informing the user and gaining their consent.

P.S: I am not a lawyer.

share|improve this answer
up vote 0 down vote

It depends on where you are, but it's generally not illegal to use tracking cookies. In the EU it's not illegal to use tracking cookies as long as you have user consent, but that's only if your site is based there. They can't enforce tracking cookie legislation on systems outside of the EU.

share|improve this answer
I'm not an attorney, but I'd be willing to bet that if you have a physical presence in a country you are subject to that country's laws and they can take action against you to enforce their laws. – HeatfanJohn Oct 5 '12 at 14:17
1  
It's debatable as there's no test cases as yet. In any case it's easy enough to implement a solution if you do happen to have presence there. – GdD Oct 5 '12 at 14:29
up vote 0 down vote

I am not a lawyer, at all, and know very little about EU law. I can't tell you about the risks of prosecution. However, I can think of a few "Best Practices" you should use, which may help legally:

  1. Tell users you are placing a cookie, explain what the cookie is for, and establish either an opt in or opt out option regarding this cookie. An Opt In that also gets stored with the cookie prevents them from seeing the option again, and is my recommendation.
  2. Set a time to live on your cookies, so they don't last "indefinitely"
  3. Respond to the "Do Not Track" HTTP header by not placing these cookies at all.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.