Consent will be required for cookies in Europe
out-law.com
out-law.com
But HTTP cookies are a horrible hack mostly created to by-pass the problems of stateful sessions with a stateless protocol. HTTP needs fixing or perhaps something on top of it. The current state is a disgrace.
It's not OK advertising groups track people's internet use around the world with 1x1 pixels and all those tricks. And never mind the evil Adobe tracking people with Flash, those are even worse and much harder to delete from your computer.
There are just too many poorly implemented web services using ridiculous amounts of large cookies. People run into problems because of the 8KB HTTP header limits in Apache and 16KB in IIS. Also I've worked for a large dotcom using multiple J2EE technologies running out of cookies in IE6/7 (20 max) and losing sales as people couldn't add a check-out/basket cookie.
Programming a cookie-based website preventing session hijacking is quite hard and even major sites had issues. How can you expect people less competents like mom-and-pops shops and banks to be secure?
This problem needs a proper solution from standards and browser vendors.
http://en.wikipedia.org/wiki/HTTP_cookie#Drawbacks_of_cookie...
I also wonder if this law as it is written right now goes for sites hosted in the EU or for sites that are visited by EU citizens (which would have much further reaching consequences).
http://news.bbc.co.uk/2/hi/europe/760782.stm
Similar laws have been used by the US against the owners of foreign websites:
Broadly speaking, if your primary markets are not America or Asia and you are the type of company that buys racks of space in datacenters without blinking, western EU is where you'll probably be.
The main factors are servicing, bandwidth and reliability.
For example, many trans-national African projects are hosted in the EU because it's simply cheaper to set up infrastructure there, because you're piggybacking on the infrastructure that's already there (long-term shared costs). Once in place, it's easier to service because you outsource service contracts on things like hardware to the vendor, who can give you a decent quote because ... they have a servicing system in place.
Power comes from the power grids that are in place, and that's very reliable. Bandwidth comes from the bandwidth structure that's .. you got it .. already in place and being upgraded all the time.
Now try and set up a load of servicable hardware in a reliable datacenter (bandwidth and power-wise) in Africa. Or Eastern Europe. Or the Middle-East. It's doable, but the price tag goes up, up, up. To service your account your vendor will have to invest in local infrastructure, hire competent servicing personnel near site, find a way to deliver hardware components in a timely manner without access to a general depot, etc. And because you're the only one requesting this you'll have to pay for it all.
You could try and move into the Russian Federation, but the operational costs there are, ah, unpredictable. Also, the Russian networks do not extend well beyond the metropolitan areas (trans-national traffic is also a work in progress).
I could go on, but my point is that the western EU hosts and accounts for a lot of traffic.
I sincerely doubt this Directive will have much impact. There are just too many interests involved.
I'm not sure how this is actually enforceable, but I think you'll have problems with EU (for example, if you decide to go to Europe for holidays) for not complying with their rules. Which is sad.
An EU citizen buying abroad is responsible for paying the VAT (usually to customs), not the merchant, and if it is 'downloadable' then VAT only applies if the merchant is european.
The changes eliminate an existing competitive distortion by obliging non-EU suppliers to charge VAT as EU suppliers when they are providing electronic services to EU non taxable persons, something which EU businesses had been actively seeking for some time.
http://ec.europa.eu/taxation_customs/taxation/vat/traders/e-... (official website)
Article:
http://www.internetnews.com/ec-news/article.php/2194111
Also:
http://www.avangate.com/articles/software-vat-123.htm
Private customers (consumers) in EU countries must be charged VAT for electronically supplied services and products, both by EU and non-EU providers.
...
Non-EU companies that trade with European consumers (private customers) need to register and account for VAT.
Maybe it'll be a national question.
But, when you're talking about stores, web applications, entire online platforms (including advertising ones), I think you have to ask user permission to do whatever with user's data. I guess this is why EC decided to ask for opt-in.
Many sites, including Google, Facebook, Wikipedia, require registration, and you have to agree with the TOU and Privacy Policy, where usually they place the cookies TOU and policy.
How do they enforce this? I guess browsers with extensions like Firefox (eg. CS lite) would be advantaged. I remember only Chrome and Firefox with extensions and Opera's widgets.
EDIT: (some conspiracy) could this be a move against IE? (ActiveX is discouraged)
An exception exists where the cookie is "strictly necessary" for the provision of a service "explicitly requested" by the user
Strange how all those lawyers aiding the writing of the law would miss such a thing ...!?!
Strange how all those lawyers aiding the writing of the law would miss such a thing ...!?!
Strange how all those lawyers aiding the writing of the law would miss such a thing ...!?!
A steering wheel in a car is not strictly necessary to drive it. Drivers could physically turn the tires.
And so on.
That is very very risky. Let's say that [popular-site-with-logins] is hosted in EU and switches to ?sessionid=... style. Now people start sharing links to their content in the "normal" way (select url, copy, paste) and suddenly you have problems with random users being logged in as someone else. (or you have to limit session to ip, which annoys mobile users)
Sure, other (non-sign-up) functionality might also need cookies (changing font size, switching themes, the small things) and you might not want to annoy the user with stupid checkboxes for those kinds of stuff, but other than that?
I still don’t see the big scandal.
Now comes the hacks: serve javascript with a unique id in it. Set the cache policy to never re-download, or recheck the file. Use you lawful (semi) permanent cookie.
The user obviously asked for the data to be stored, since it's part of caching.
Or am I going to have to ask the user before being allowed to cache anything locally?
Stil think it's a nonsense law though ..
Now, even if you want to allow cookies (and have signaled as much in your browser), a site will have to disrupt your browsing experience to accept a cookie from the website.
Completely redundant and adds yet another layer of bureaucracy on top of website design. Very EU.
And there are plenty of good uses for cookies without having to register: session tracking for shopping carts (so that you can add items without logging in), session tracking for sites that show you a navigation breadcrumb...
You can use cookies to act as a "bread crumbs" trail, so people can see what other pages/products they have looked at.
If you make a multi-lingual site, you can use a cookie to remember what was the last language the user chose, and show all future pages in that language, without them having to change it on every page.
The process for doing this relies on being able to set a cookie when the ad is served and read the cookie back on the landing page for the conversion. Taking away the ability to track conversions will set the online advertising industry back significantly, which is why the major opposition to legislation like this comes from advertising companies.