Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

The EU cookie legislation http://www.out-law.com/page-10510 is rightly or wrongly are being introduced, there has been much negative comment from both legal and technical commentators - that said it has implications.

What UX solutions or otherwise have you been working through to resolve the need of 'gaining a user's prior consent' when cookies are used?

You may have read yesterday on the bbc and guardian sites that this legislation has been deferred in the UK for a year so that 'a workable solution' can be found.

http://www.bbc.co.uk/news/technology-13541250

It would be nice to maintain this thread with examples like the ICO one below - however they may prove to be thin on the ground!

share|improve this question
1  
I loved the "until the visitor deletes his 'consent' cookie"... This legislation is so wrong. I haven't done anything yet about it, but see in the future browsers doing this consent request for you, then we'll have two problems, double consents? –  jackJoe May 19 '11 at 14:59
1  
@jackJoe: So the user can revoke consent by technical means. How is that a legal problem? As for the double consent issue, that's a site problem. Don't ask for consent if you already have it. You know that you have consent when your cookie is already present (because that cookie would be illegal otherwise) –  MSalters May 23 '11 at 12:44
    
We have put together a small site for people to be able to see how long they have left before the new law will start to be enforced. countdown.wolf-software.com We are also working on a complete cookie solution that will gain person for any type of cookie, we hope to have this available and verified by the ICO within a couple of weeks. –  user8782 Oct 2 '11 at 10:44
1  
Solution: Along with the consent question, there should be a button to send an automatic letter of complaint to each of the politicians who supported the bill. Every bit of my time they waste should waste some of theirs as well. :) –  JohnGB Oct 4 '11 at 15:32
    
I'd guess HTML5 localStorage. It's not a cookie, so as I understand it, it's exempt, and it allows you to store data on client machines. As a bonus, it speeds up response times, improving the UX! –  ctbeiser Oct 5 '11 at 3:12

7 Answers 7

I think the notification system used here at the stack exchange could be used to quickly ask the user "Would you like a cookie? We will use it to give you a better experience [Yes][No]"

example

share|improve this answer
2  
If this is made too small then visitors won't click "yes" but too big at it'll be terrible UX. I'd prefer visitors to click "buy now" than "accept cookies". –  dave1010 May 26 '11 at 22:10
    
Excellent, this can be the new "Please please please take this survey!!!11" window that everyone ignores, meanwhile totally destroying UX (not to insult your solution, but I don't find any work arounds reasonable for this catastrophic logistics nightmare) –  Ben Brocka Oct 4 '11 at 15:07
    
@BenBrocka Yes it CAN be, as with any notification. Using it wisely is the key. –  jonshariat Oct 4 '11 at 23:00
    
@jonshariat the problem is that in this context even the wisest, most conservative use of notifications would result in an overwhelming deluge of them, assuming nothing changes in terms of what requires a cookie or not and sites don't stop using advertising and analytics wholesale (don't count on it) –  Ben Brocka Oct 5 '11 at 13:13
    
Well technically you only need 1 identifying cookie per server. All the rest of the options can be held server side based on that single identifier. Anyone setting a deluge of cookies is really just being lazy. –  JamesRyan Apr 30 '12 at 11:35

In the long term, I'd love to see a standardised way to do this (even though it may be wishful thinking).

The only way to achieve that, since trusting site owners isn't an option ;), is to have browsers implement some kind of UI that triggers when cookie storage is requested.

I imagine it'd look something like the yellow alert bars browsers like Chrome currently have in place:

Chrome's notify bar Chrome's warning bar

The little arrow that points up from the bar over the browser chrome ensures that they can't be gamed (eg. a scummy site putting a bar like that up that you click on, only to find you're now downloading malware).

share|improve this answer
1  
This seems a good idea but will it fall fowl of the type of statements that were popular in accessibility guidelines of the past with language such as 'until browsers support xyz…'. It also assumes that everyone has the latest browser and to be fair those most at 'risk' or 'exposed' to the malicious activity this legislation aims to resolve would be those who are least likely to have the latest or up to date browsers. –  Adam Fellowes May 20 '11 at 10:36
    
That's true. I'll edit my answer to specify that this is a more long-term idea (perhaps even wishful thinking) –  Rahul May 20 '11 at 10:38
    
At least IE already has this option under privacy: you can select between accept / block / confirm for cookies, separately for actual / 3rd party. Problem: it's a modal message box for each cookie, which is about 20 for a typical page. –  peterchen May 23 '11 at 9:55

The Information Commissioner's Office (ICO) website is already requesting permission to use cookies. They've taken the 'great big wodge of text' approach. The results are ugly (click image for big version):

ICO cookie request

It remains to be seen whether web developers will take the new laws seriously enough to vomit cookie warnings at every new visitor in this way, but those who do might be best to adopt a cleaner version of the ICO's approach, with a more unified look and feel, fewer lines of text, and an "Accept cookies" button instead of the checkbox and "continue" combo the ICO are using.

share|improve this answer
2  
Wow, even though I specifically went to that site to read that message my brain seemed to 'disengage' while looking at it. I had to re-read it several times before I took it all in. –  JonW May 26 '11 at 15:45
    
I agree. Given that they're the governing body that will oversee and enforce the new law in the UK, it's not a great advert, is it? If they hope to convince site owners to abide by the new law, they would do well to simplify and improve both the look and the user experience as a model for others to adopt. –  Nick May 26 '11 at 15:48
    
Ha, it's even mentioned that "parts of the site will not work without cookies". That's not really asking for consent, it's more like threatening people into accepting cookies. –  LaundroMat Oct 5 '11 at 16:13

IMHO the browser comes with the ability to turn off cookies, and if it's not deactivated, you just consented to letting me store cookies. That's all the consent I need as an application. Not trying to be a jerk, just saying.

share|improve this answer
4  
The EU directive requires "consent, having been provided with clear and comprehensive information". You fail the precondition check. Please note, the EU is less friendly than the USA when it comes to businesses breaking the law. –  MSalters May 23 '11 at 12:39
1  
@MSalters - You don't even need the last three words of your comment. The EU is less friendly than the US when it comes to businesses period. –  Charles Boyung May 23 '11 at 14:16
    
It's a really interesting question for arm-chair communication lawyers. Connecting to someones server to access information freely offered, seems like the user is at the mercy of their connection software, this legislation should have been enforced on the browser not the website. Terrifying to have your government dictating laws of this nature, it's censorship of useability! Kinda like being an iOS developer. :) –  sirtimbly May 23 '11 at 14:45
    
we're not talking about information on their computer, we're talking about information (cookies) on my computer. If you want something from me, you better ask. –  MSalters May 23 '11 at 14:58
2  
@MSalters - I can't argue with legislation that is already passed, that's silly. Especially since it doesn't impact me. But, theoretically you (the user) didn't put that information there, a web site put that information there for it's own use to associate your web client to a specific set of data on their server. You, the user chose to accept that data into your computer when you left your browser configuration defaults and then loaded a web site in that browser. –  sirtimbly May 23 '11 at 18:31

I expect that within a week of the first websites implementing this, there will appear apps for FF and Chrome that let you set your preferences once and for all. Apart from that, the "native" way is is probably to use the browsers' current notification methods - usually the bar on top.

share|improve this answer

Depending on how busy your site is and how willing you are to re-write your cookie code, maybe you can just bypass cookies altogether by taking a browser fingerprint, sending that up the tubes and using that information to setup sessions. The session id can subsequently be placed in the URL for future reference. To get the fingerprint you could MD5 the browser fonts, plugins, screen size and other javascript accessible guff.

Here is the EFF page on how to track browsers without using cookies:

http://www.eff.org/deeplinks/2010/01/help-eff-research-web-browser-tracking

Naturally you can reverse engineer that code from the frontend side.

Another option is to store the unique identifier in an image, e.g. the store logo. Or the browser history URLs can be looked at, as per those sites that know if you have been to 'example.com'.

Naturally your detection code can be obfuscated by putting it through the closure compiler.

These 'cheats' do need scripting, but only Windows Server admins have that turned off, don't they? Nonetheless, some plan B will be needed...

You can geoip your site visitor so that you only need worry about the cookie problem if their IP is in one of the EU countries.

Only if you cannot automagically identify your EU visitor would you then need to degrade gracefully to cookies - and asking for them. Naturally you'll be wanting to do that with a huge un-bypass-able modal dialog-box showing the Cookie Monster hugging Peadobear asking how you wish to be stalked today obviously to the tune of your favourite Rick Astley song - that should help with conversions...

Yep, this new cookie law is silly, but cookies were never intended to track people in the first place, were they..?

share|improve this answer
    
thanks for the information and link its an interesting approach. As with all legislation its loop holes have already been found by those the regulation aims to restrict. –  Adam Fellowes May 24 '11 at 7:36
    
The legislation only covers tracking cookies, not stuff like session ID cookies that are required for a site to function. So there's no need to implement complex browser sniffing just in order to run a session. (And, since the legislation covers tracking technologies, not just cookies, doing so in order to run analytics on a user who's said No would still be illegal.) –  John Yeates Oct 3 '11 at 8:41
    
@John Yeates Big thanks for that comment - as I write I am implementing a little cookie to remember some page drop-downs and it did cross my mind earlier this morning that 'this might not be okay', but it is, so thanks! –  ʍǝɥʇɐɯ Oct 3 '11 at 8:47

We've seen this re-usable approach for wrapping Google Analytics cookies, similar to Stack Exchange's own notification system:

http://cookies.dev.wolf-software.com/

It isn't perfect, but gives you a reference implementation; I suspect the best approaches will be built in a similar way (modal dialogs are too intrusive).

I've also written an article on what we've learnt from the ICO's own UX in more detail: http://blog.silktide.com/2011/05/can-we-use-analytics-with-the-new-uk-cookie-law/

(apologies for shameless self reference, but I believe it is on topic).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.