Richi's Rant: Web Analytics Illegal after 26 May? Crazy!

[#1]

Most serious UK websites, including this one, contain visitor analytics code that will be illegal in just over a month's time. That's my conclusion after studying the Information Commissioner's Office (ICO) guidance on the new cookie compliance rules planned for 26th May 2012.

My opinion? Crazy. Ludicrous. Pointless.

The ICO guidance says that websites must get "specific and informed...consent" from users, in order to legally use Web cookies. The more the ICO talks about this and 'clarifies' the law, the more it seems that the implications are monumentally onerous.

The law is being brought in to comply with European directive 2009/136/EC. It supposedly aims to protect naïve users from being tracked around the Web.

It's unclear why European lawmakers saw this as a huge problem requiring countless webmasters to invest time and money with no return. I suspect that there was just a vague unease about big companies such as Google and Facebook knowing too much about our surfing habits. I don't see a groundswell of citizen concern that would make this a worthwhile priority.

There are some exception to the cookie consent requirement, but they're pretty limited:

• For load-balancing
• Remembering shopping baskets
• Keeping user data safe (e.g., to verify online-banking identities)

One of the key uses of cookies is for website owners to understand where their visitors are coming from, how users navigate through sites, what items are popular, etc. This is known as analytics. The ICO's advice is now very clear: such use of cookies is not an exception to the rule.

The ICO would have website owners pop up a box to new users asking them to give consent to using cookies. Anyone who knows much about user behaviour will know that this idea is a total non-starter. Indeed, the ICO proved this to itself, after trialling the idea on its own site, as Aunty Beeb points out:

Since asking users to click a box if they agree to accept cookies from its site, the organisation says just 10% of visitors have complied.

Ten percent. That's hilarious (or it would be, if it wasn't so stupid).

Meanwhile, in a December 2011 press release, the ICO said it plans to:

...focus its regulatory efforts on the most intrusive cookies or where there is a clear privacy impact on individuals.
  

---

Richi Jennings, editor of Input Output UK, is also an independent analyst, specializing in blogging, email, spam, security, and other technology topics. His writing has won ASBPE and Neal awards. You can encircle him at +richi, follow him as @richi on Twitter, pretend to be his friend at Facebook.com/richij or just use boring old email: io@richij.com.

[#2]

I'd add Unimplemenatable, Unenforceable, Short-lived.

[#3]

Peter, we can but hope that it's short-lived.

[#4]

Hoping for widespread civil disobedience where we all simply refuse to implement this.

[#5]

I must admin, I think it's a great idea ...... in theory, but the practicalities of implementation are somewhat difficult, as people have said, haha. The other MAJOR problem is that they've not actually gone out of their way to publicise this, by .... like .... actually telling anyone...... or anything......
I was fortunate to find out about the legislation just before it came in, as I was writing a new site, so I just incorporated it into the registration process.
In defence of the idea: on my phone I set cookies on a case-by-case basis and it's bloody scary how many nasty little tracking cookies sites try to set, Google Analytics is particularly pervasive on this.
On the non-compliance side, it's not so much they will track people down, it's more when people complain they will take action - for the first year they will work with companies to ensure compliance, after that they will start busting people.

[#6]

My Learned Lord, these are not the analytics you are looking for, they are load-balancing informatics.   We here at muchedupcookiecrumble.splodge take our load-balancing very seriously and this means we need to detail and track any customer for there own security as our load-balancing informatics also help us make sure the user receives a secure, fairly balanced experience with there best interests at heart.  We also load-balance our stocks to be inline with the full IT experience and to be fully compliment with all and any prevailing law's of the people both in stature and in fairness.

Short version, your either doing it wrong or have cheap lawyers.  Remember if the law is an ass then be that ass :smileylol:

[#7]

The ICO don't even follow their own rules, I'm not worried by this and I certainly won't be removing my analytics code from my sites. As Steve Jobs once said to The Beatles "sosumi".

[#8]

Paul Gray wins a thousand internets.

[#9]

I guess you've never heard of access_logs ? You can use them for analytics. Sure they're not quite as robust as jaavscript and cookie based analytics, but they work well enough. There may be legitimate scenarios where cookie blocking is a problem, but analytics is not one.

[#10]

Hmm... so, a cookie which can be easily blocked if you care about it, BAD. Massage surveillance infrastructure to monitor all internet communication and makes anything the GDR did look amaturish = GOOD

Nice to see where the governments priorities are....

[#11]

That is a good thing. Users first. What benefit does the user have for being tracked? It just helpes the company. There are no direct REAL user benefits for being tracked.

[#12]

Good read. I don't plan on doing anything drastic until I see Google implement said procedures. 

This damn Cookie law was introduced by internet novices! I don't think they understand how this will, quite literally, destroy the internet. Sure we can use access_logs to generate stats reports but they're not accurate. If G Analytics is a trends tool, what the hell does that make an access_logs report generator? 

I hope this is short lived. 

[#13]

Speaking as a User and not a website builder this is a good idea. This is a privacy issue. I don't want every single website I visit to store information about me, and my online behaviour. I want to choose the websites I visit most and ignore the ones I visited once or went to by accident. Why should I be bombarded by snowboard jacket adverts just cause I went to a site with snowboard jackets? Why should I have to manually delete my cookies each week to get rid of the unwanted ones?

Long live the law and down with big brother tracking! We the silent majority have spoken! Only 10% wanted cookies. What does this tell you about your users. We don't want your dam cookies unless the come with choc chip.

[#14]

Romance - you have no idea what you're talking about.  10% clicked it because it was a pain in the ass, not because they care about their cookies.

[#15]

tom: why didn't you give me an answer? What are the REAL benefits from the user perspective?

I agree with Romance. From user's perspective there are no reasons to be tracked

[#16]

Cristian(anon) imagine you go to the same espresso bar for 5 years and they still wouldn't recognize you. Not know your name, not know your preferred morning double espresso. You would have to explain again and again what your preferences are. I'm quite sure you wouldn't like that. that's not service.

Cookies help big time for delivering service!

[#17]

the real benefit to a user being tracked can be hard to sum up in just a few moments:

* optimize common work flows, if a tracking cookie helps identify users typically do x, y and z.  but software could skip y.  then knowing this means you can make it better for the end user.

* A/B tests are a simple way to figure out what works better for an end user application.

* Marketing - figuring out which sources of traffic drive the best conversions means the business can stay alive because it can more effectively spend it's money.  This means the end users can keep using the service.

* Advertising - ads keep content free on the internet, make their reveneue's go down and you'll have less free content.

The list is huge... the bottom line is ... don't F' with what you don't understand.

[#18]

REGARDING: REAL benefits from the user perspective?

Let us look at a cookie as a customer contact information card.  When you call a company they know your name and other details from there customer database of cards that contain information about you.  This is a manual process that has evolved over time to a computerized version that is fully accepted.  Benefits are two fold in that both the company and the customer gain from not having to re-establish names, contact details, how the  customer likes to not be called miss and that they have a dislike towards any products from Mar's due to allergies a relative once had four generations ago - buts its important to them that they went out of there way to tell you, etc etc  every time. 

So you have a process like this:

You call initially - they note down details to contact you etc etc, you place a order and done.

You then wish to add something to that order so you call, they recognize the number and name and have the details infront of them so when you say I'd like to add something to the order they know what your on about.

Now let's assume they didn't keep contact details of any form and are indeed not allowed to in any way shape or form:

You would then phone up - give them your details etc etc, place your order - nothing changed here.

You phone up to add something to your order and they ask all sorts of questions, this is even the same person you spoke to only a minute ago, this makes for a very frustrating process for both parties and nothing positive comes from it.

Cookies are like that - but there contact details for the website that identify a user with a particular browser on a particular computer.  As you can see if the computer has to ask lots of questions over and over again the user will become annoyed, this is then universally blamed on the computer and the circle of IT starts over again.

Now as with contact details held at a company or a cookie upon your computer you want your details kept for that sole use only and cookies in this case are stored upon your computer, this puts the control of the cookie firmly in your hands unlike a customer contact database.

Another way to look at it is what are the negatives and are they great enough for me to use the option all web browsers  to disable cookies for that site or entirely.  An option that has been around as long as cookies themselves.

There tools for users to obtain this level of control are already firmly in there hands, alas the government only has a hammer in there toolbox so every problem to them looks like a nail when it is common sense mentality in itself as born out by this so called legislation ever exciting, let alone fruiting.

[#19]

To say that there's no benefit to users to having cookies is incredibly shortsighted and nieve.  Exceptions aside, cookies, and in a broader sense analytics, allow content providers to identify issues with their content, presentation and performance - all of which have a positive effect on the user experience.

If you take away my ability to set cookies, I can still do most of the tracking serverside, it's just slightly more hassle (and tied to your IP address/useragent/other headers instead of browser session).  In my case, this means that average user metrics (pages per visit, content navigation etc) may be a little bit off, but to an unscroupulous ad network, it means that everyone that you share an IP address or computer with is now going to see your personalised ads.

A move like this will just result in less privacy for users.  Perhaps a more suitable option would be to send everyone a little slip of paper explaining how to use their browser properly so that they can disable cookies if they so desire?

[#20]

So long as the developer isn't breaking the web browser to spy, then I dont get thier beef. Are they asking peoples permission in the UK to be tracked by outdoor cameras? This is ridiculous

[#21]

Correct me if I'm wrong, but I believe that it will be okay simply to inform the user that cookies are being stored and what they're for, with instructions on how to delete them, whilst still complying with the law. That's certainly what this page implies:
http://www.aboutcookies.org/Default.aspx?page=4

[#22]

You're wrong. That wouldn't be "informed consent"

[#23]

"I suspect that there was just a vague unease about big companies such as Google and Facebook knowing too much about our surfing habits"

I believe you are not informed enough if you made this statement... You may think it's about Google and Facebook, but in fact it is about many more companies that you never heard of and never will. They do have your personal data and you don't even know they exist. You may remove your personal data from Facebook's or Google's databases, but you can not remove them from databases you have no knowledge about.

Please read more about this issue before you continue to spread such statements. I would suggest to start with this page and the demo on it - it'll only take few minutes:
http://www.mozilla.org/en-US/collusion/