I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't?
For example:
2
closed as off-topic by Tobi Nary, Steffen Ullrich, Ohnana, Matthew, M'vy Apr 25 '16 at 9:11
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – Tobi Nary, Steffen Ullrich, Ohnana, Matthew, M'vy
-
4I think in at least some cases this is related to a law that was passed in the EU that required sites to disclose to the user that they used cookies for certain purposes, for example third party advertising. (Cookies for purposes of session management and such were exempt). – puzzlepalace Apr 22 '16 at 22:58
-
8This is due to an EU law, as answered in greater detail over on UX.SE. – WBT Apr 22 '16 at 23:02
-
1The comments already answer the question; I voted to close as not security-related. – Tobi Nary Apr 22 '16 at 23:58
6
The reason you see that message is Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, according to which users have to give consent for the storing of information (read cookies) or retrieval of information already stored.
Some cookies are exempt from this rule, namely when the cookie
- is needed for carrying your data over the network, or
- required for the (requested) service to operate properly.
Or in legal jargon, when the cookie
- is used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or
- strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
Directive 2009/136/EC, Article 5(3):
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.Directive 2002/58/EC, Article 5(3):
Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.
The interested reader can also take a look at the Opinion 04/2012 on Cookie Consent Exemption document.
Note that a directive is not a law. "A 'directive' is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to devise their own laws on how to reach these goals."
