8

I'm working on legal portion of my site, Privacy Policy in particular. I've done the research and found that nearly all the answers to my question (below), is generalized.

Question: Do cookies "collect" data from user browsers, or do cookies "request" then receive data from user browsers?

This seems to be a very important distinction. Do I put into my privacy policy that my site "collects" data from my users or do I "request" data from my users.

My understanding of the core functionality is that cookies request data of user browser or browser activity. Users control how their browser will respond (or handle cookies) in their browser settings. If users have the ultimate control of handling "responses" to cookies is it proper for website privacy policies to state that they use cookies to collect browser data? Isn't it more accurate to state something like: "We use cookies to request data from your browser. Depending on you have your settings, your response to our request my impact your experience." Or something along those lines.

For years the way I understood the phrase "cookies collect browser data" is that we (websites) force code (the cookie), onto your browser that opens a siv for all your activity to flow back to us. But this isn't the case at all. Cookies actually make a "request" (i.e., asks) for the user's permission first, and depending on how the user has set up their browser settings, the cookie request is honored or denied.

I'm trying to stay away from the term "collect" as a general matter. I think it's improperly used and leaves the wrong impression on users.

Has anyone else thought about this? Am I missing something?

UPDATE: Thank you for all the good responses below. I've concluded that my Privacy Policy will NOT state "We use cookies to collect info...," but rather: "We use cookies to request info..." because the former implies no consent required, whereas the latter implies consent required, and IS the more accurate case.

12
  • 12
    I don't think this is on-topic. But to be more helpful: cookies are no active element, i.e. they neither collect nor request data. Cookies are just a kind of small storage set by the server which the browser will send back for each visits to the the same site. It can be used by the site to identity that it is the last user as the last time. Any data collection is done independently from the cookie but can be associated with the cookie and thus with the one visiting the site. Thus, cookies help to to collect data but they don't collect any data themselves. Jun 18, 2018 at 20:11
  • This is the same generalized answer I've been finding. What's the triggering mechanism? If a cookie is just storage how does the browser know what to do, i.e., "...which the browser will send back for each visit to the same site." ? Doesn't a cookie "tell" a browser what it needs? Jun 18, 2018 at 20:32
  • 6
    @SteffenUllrich That's why I'm against mentioning cookies (or any technology) in a privacy policy. A privacy policy should mention the things that you collect and how you use them, it should not necessary mention the technologies that make it happen. Imagine what would happen if every technology that make a website work would need to be mentioned...
    – Rolf ツ
    Jun 19, 2018 at 9:48
  • 1
    @StackNoFlow "to request info" is absolutely wrong. You're not asking anything and the only "permission" is whether cookies are blocked or not. Since cookies are needed for almost every site needing login, very few have cookies disabled. Also worth pointing out that "user didn't have cookies blocked" is not explicit consent mentioned in GDPR, if that's a thing to worry about. Jun 19, 2018 at 9:54
  • 1
    You asked the question, but it seems like you have already made up your mind and are only looking for agreement/validation. Most of the answers explain that cookies don't request, collect, or "do" anything, they are storage containers.
    – Confuzing
    Jun 19, 2018 at 13:45

6 Answers 6

5

The data being "collected" or "requested" is not the cookies, nor is it likely to be stored directly in the cookies.

The data your privacy policy needs to talk about is data you have requested explicitly, like name and e-mail address; and data you have collected because browsers send it by default, like referrers, IP addresses, and user-agent identifiers.

The role of cookies is to tie together this information across multiple requests - to know that the same user who told you their name was Bob is now accessing the home page; or that the same user who was connecting from China yesterday now appears to be connecting from Russia. But it is not the cookie that has taught you that their name is Bob, nor that their IP address is allocated to China.

Your privacy policy should first and foremost talk about the data you are collecting. If it must talk about cookies, it should talk about them as a technology used to "connect", "tie together", or "associate your browsing with" that data.

2
  • There's been excellent information about cookies, here, that I did understand before. Thank you to everyone. If I had a do-over I would have framed my question a little differently, but this answer helps me the most. Thank you, @IMSOP Jun 19, 2018 at 14:46
  • "We use cookies to associate your browser with our website." I like that! Jun 19, 2018 at 14:54
17

Cookies neither collect nor request data. Cookies are just boxes you can store information in the client side that may be later retrieved when the client enters the site after setting the cookie.

9
  • 1
    Yes, this is accurate, but it's not just a box that is open for everything and anything poor into. If the cookie doesn't actually "request" data from the client there must, at least, be a gatekeeper to restrict what enters the box (sent back to the server), so to speak. Login credentials, times, referrers, ect. Jun 19, 2018 at 3:56
  • 4
    "Login credentials, times, referrers" per se has nothing to do with cookies. The application developer chooses what to store. It is very unusual to store referrers in cookies, but a developer can chose to store whatever. Jun 19, 2018 at 5:33
  • 6
    @StackNoFlow One use of cookies for analytics is that you can set one with essentially random data, and then if you see the same random data again you know it's the same user. The cookie is neither requesting or collecting data, it's a tool being used to collect data. When I put a sticker in someone's hair saying "valuable customer" so I remember they're a valuable customer, is the sticker requesting data or collecting it?
    – user253751
    Jun 19, 2018 at 5:47
  • 11
    @StackNoFlow does the sticker ask the customer anything? No. It's you who are doing the asking.
    – muru
    Jun 19, 2018 at 7:39
  • 4
    @StackNoFlow Did your browser ask you about all the cookies security.stackexchange set? I have currently 26 cookies set by this site, you probably have the same amount. There's your answer. There's also no "gatekeeper" who decides what you can put into cookies. Jun 19, 2018 at 9:58
14

HTTP is a stateless protocol. From the server pespective, every connection is a new one. Does not matter if you never ever connected to that server, or it's the 100th image you download from it in the last second. Your connection and every single other connection are just the same, faceless anonymous unknown connection. To put an identifier on each one, the cookie was created.

Think of a cookie as being a badge. If you talk to a server without a badge, it will send you one: I don't know you, so your badge is ID:ABC123.

Every time your browser talk back to the server, it sends the badge together: "I am ID:ABC123 and need logo.jpg"

If the server have anything to add, it will write a new badge and send to your browser: "You logged in, and are a valuable user. You are ID:ABC123,TYPE:1"

When you ask the next thing, the badge goes back: "I am ID:ABC123,TYPE:1 and need custom_logo2.bmp"

It's a passive variable. It does not collect anything, it is just arbitrary data the server uses to identify you. Log in to any service, delete the cookies, refresh the page and it will ask who are you. The cookie is what identifies your browser and session.

This is a simplistic example. Usually cookies are encrypted and don't really hold values, they usually only point to a record on the server side where the real values are stored. Otherwise anyone could put the TYPE:1 on their cookies and be a very special guest on the example service.

What is the privacy thing about the cookies? They can track you around. If I have a service hosting images, and you link a image from my server on your page, my server will receive a request from your client. The request will have a special field named Referer, and this tells me you are coming from, say, your-own-site.org, and I send him a cookie identifying him (ID:ABC999). Not only this, but I put on my database a record telling ABC999 acessed your-own-site.org. Later your client requests another image, but coming from slashdot.org, and the request gives me the ID ABC999. From my server I know the client accessed your site and slashdot, so I can start building a picture of what kind of sites he access, and what is his profile. Does not look like much, but if you think about Google, Facebook, and almost every Content Delivery Network, they track almost every single site you access. That's why almost every browser have a Block third party cookies option somewhere: this way the client will only store and send cookies for the domain he is accessing, not every CDN, image storage, telemetry or analytics site around the world.

3
  • Very nice description! And useful..thank you! What I'm trying to determine is do websites "collect" or gain ANY information from a client without making some kind of request for that information? Whether it's passive or direct. In short, if I got this right, it sounds like no. Which means the user/client must authorize the data/info transfer, which is typically done by the user either implementing "Block third party cookies" or not. So, if a user/client is NOT blocking third party cookies then they are essentially authorizing data "collection", the transfer of data/info back to the server. Jun 18, 2018 at 22:37
  • 4
    @StackNoFlow I highly doubt that your opinion of "by not turning off this obscure checkbox in their browser they authorized the data collection" will stand up to GDPR.
    – user253751
    Jun 19, 2018 at 6:02
  • @immibis, I agree. I'm more interested/concerned about the proper, accurate language I'm using in my Privacy Policy. A lot of these responses are pulling me away from that, although I'm still trying to address them. It's also still interesting how cookies and browsers interact. Jun 19, 2018 at 7:09
1

A cookie is just a piece of text. It doesn't "collect" or "request" anything, it isn't an active component, and so it all depends on how you use it.

It can be used to collect and store some data about the user, like language preferences for example. The cookie will contain something like lang=es, and that means the user should be shown the content in Spanish. Or it can be used to identify the user, so for example it could contain id=482477359937882940034 and that can be used to serve content specifically to one user (like their email, private messages, etc.) or track them by linking several different requests to the same ID.

The server usually sets and modifies the cookie, and send it to the browser. The browser then sends it back to the server with every request. It's basically data that is continually passed back and forth.

So your privacy policy should say that "your website uses cookies to...", and then it depends what you use them for. I don't know what exactly you use them for, so I can't give you any specific advice, but I'm pretty sure that a sentence like "We use cookies to request info..." is very likely to make no sense at all. To be honest, nobody cares about cookies, and the cookie law (EU law, I'm assuming you are in the EU) was just a stupid law. The GDPR law (EU law) is a much more complete law, and focuses on personal data in general. What matters is what you do with those cookies, what data you collect, for what purpose, and if it's a legitimate purpose according to the GDPR. It's a pretty complex law, but I can only tell you that if you are trying to avoid asking for the user's explicit consent by assuming they can always tweak their browser settings, you are on the wrong track.

0

Servers don't have to do anything. Client browsers send cookies to the servers together with the request willingly - because they expect it to be useful for the server to provide the client with some service based on the cookie they store, so to speak.

I am not sure what either of those two (collect vs request) in this context mean but the server is in a passive relationship with client browser here. You can as well disable storage (and sending) of cookies in your browser if that's what you wish.

4
  • Just because cookies are under full control of the web browser doesn't mean the OP can assume every user knows that. Jun 19, 2018 at 6:37
  • Ignorantia non excusat. Judging from the title it seems like OP wants to put blame on servers for using cookies.
    – Gillian
    Jun 19, 2018 at 9:55
  • 1
    "Servers don't have to do anything" - that is just plain wrong. The server has to set the cookie, otherwise there would be nothing for the browser to send back.
    – piet.t
    Jun 19, 2018 at 11:50
  • Server doesn't set anything, server sends back to the client the cookie and the client can and doesn't have to save it and send it during future requests.
    – Gillian
    Jun 19, 2018 at 11:54
-1

The cookie STORES data, the server will collect/store data within it, and 'request' data back out of it later.

Not the answer you're looking for? Browse other questions tagged .