23

The EU cookie legislation http://www.out-law.com/page-10510 is rightly or wrongly are being introduced, there has been much negative comment from both legal and technical commentators - that said it has implications.

What UX solutions or otherwise have you been working through to resolve the need of 'gaining a user's prior consent' when cookies are used?

You may have read yesterday on the bbc and guardian sites that this legislation has been deferred in the UK for a year so that 'a workable solution' can be found.

http://www.bbc.co.uk/news/technology-13541250

It would be nice to maintain this thread with examples like the ICO one below - however they may prove to be thin on the ground!

Improve this question
6
  • 1
    I loved the "until the visitor deletes his 'consent' cookie"... This legislation is so wrong. I haven't done anything yet about it, but see in the future browsers doing this consent request for you, then we'll have two problems, double consents?
    – jackJoe
    Commented May 19, 2011 at 14:59
  • 1
    @jackJoe: So the user can revoke consent by technical means. How is that a legal problem? As for the double consent issue, that's a site problem. Don't ask for consent if you already have it. You know that you have consent when your cookie is already present (because that cookie would be illegal otherwise)
    – MSalters
    Commented May 23, 2011 at 12:44
  • We have put together a small site for people to be able to see how long they have left before the new law will start to be enforced. countdown.wolf-software.com We are also working on a complete cookie solution that will gain person for any type of cookie, we hope to have this available and verified by the ICO within a couple of weeks.
    – user8782
    Commented Oct 2, 2011 at 10:44
  • 2
    Solution: Along with the consent question, there should be a button to send an automatic letter of complaint to each of the politicians who supported the bill. Every bit of my time they waste should waste some of theirs as well. :)
    – JohnGB ♦
    Commented Oct 4, 2011 at 15:32
  • I'd guess HTML5 localStorage. It's not a cookie, so as I understand it, it's exempt, and it allows you to store data on client machines. As a bonus, it speeds up response times, improving the UX!
    – ctbeiser
    Commented Oct 5, 2011 at 3:12

7 Answers 7

Reset to default
11

I think the notification system used here at the stack exchange could be used to quickly ask the user "Would you like a cookie? We will use it to give you a better experience [Yes][No]"

example

Improve this answer
5
  • 2
    If this is made too small then visitors won't click "yes" but too big at it'll be terrible UX. I'd prefer visitors to click "buy now" than "accept cookies".
    – dave1010
    Commented May 26, 2011 at 22:10
  • Excellent, this can be the new "Please please please take this survey!!!11" window that everyone ignores, meanwhile totally destroying UX (not to insult your solution, but I don't find any work arounds reasonable for this catastrophic logistics nightmare)
    – Zelda
    Commented Oct 4, 2011 at 15:07
  • @BenBrocka Yes it CAN be, as with any notification. Using it wisely is the key.
    – jonshariat
    Commented Oct 4, 2011 at 23:00
  • @jonshariat the problem is that in this context even the wisest, most conservative use of notifications would result in an overwhelming deluge of them, assuming nothing changes in terms of what requires a cookie or not and sites don't stop using advertising and analytics wholesale (don't count on it)
    – Zelda
    Commented Oct 5, 2011 at 13:13
  • Well technically you only need 1 identifying cookie per server. All the rest of the options can be held server side based on that single identifier. Anyone setting a deluge of cookies is really just being lazy.
    – JamesRyan
    Commented Apr 30, 2012 at 11:35
9

In the long term, I'd love to see a standardised way to do this (even though it may be wishful thinking).

The only way to achieve that, since trusting site owners isn't an option ;), is to have browsers implement some kind of UI that triggers when cookie storage is requested.

I imagine it'd look something like the yellow alert bars browsers like Chrome currently have in place:

Chrome's notify bar Chrome's warning bar

The little arrow that points up from the bar over the browser chrome ensures that they can't be gamed (eg. a scummy site putting a bar like that up that you click on, only to find you're now downloading malware).

Improve this answer
3
  • 2
    This seems a good idea but will it fall fowl of the type of statements that were popular in accessibility guidelines of the past with language such as 'until browsers support xyz…'. It also assumes that everyone has the latest browser and to be fair those most at 'risk' or 'exposed' to the malicious activity this legislation aims to resolve would be those who are least likely to have the latest or up to date browsers.
    – Adam Fellowes
    Commented May 20, 2011 at 10:36
  • That's true. I'll edit my answer to specify that this is a more long-term idea (perhaps even wishful thinking)
    – Rahul
    Commented May 20, 2011 at 10:38
  • At least IE already has this option under privacy: you can select between accept / block / confirm for cookies, separately for actual / 3rd party. Problem: it's a modal message box for each cookie, which is about 20 for a typical page.
    – peterchen
    Commented May 23, 2011 at 9:55
5

The Information Commissioner's Office (ICO) website is already requesting permission to use cookies. They've taken the 'great big wodge of text' approach. The results are ugly (click image for big version):

ICO cookie request

It remains to be seen whether web developers will take the new laws seriously enough to vomit cookie warnings at every new visitor in this way, but those who do might be best to adopt a cleaner version of the ICO's approach, with a more unified look and feel, fewer lines of text, and an "Accept cookies" button instead of the checkbox and "continue" combo the ICO are using.

Improve this answer
3
  • 2
    Wow, even though I specifically went to that site to read that message my brain seemed to 'disengage' while looking at it. I had to re-read it several times before I took it all in.
    – JonW ♦
    Commented May 26, 2011 at 15:45
  • I agree. Given that they're the governing body that will oversee and enforce the new law in the UK, it's not a great advert, is it? If they hope to convince site owners to abide by the new law, they would do well to simplify and improve both the look and the user experience as a model for others to adopt.
    – Nick
    Commented May 26, 2011 at 15:48
  • Ha, it's even mentioned that "parts of the site will not work without cookies". That's not really asking for consent, it's more like threatening people into accepting cookies.
    – Mathieu Dhondt
    Commented Oct 5, 2011 at 16:13
4

IMHO the browser comes with the ability to turn off cookies, and if it's not deactivated, you just consented to letting me store cookies. That's all the consent I need as an application. Not trying to be a jerk, just saying.

Improve this answer
5
  • 5
    The EU directive requires "consent, having been provided with clear and comprehensive information". You fail the precondition check. Please note, the EU is less friendly than the USA when it comes to businesses breaking the law.
    – MSalters
    Commented May 23, 2011 at 12:39
  • 1
    @MSalters - You don't even need the last three words of your comment. The EU is less friendly than the US when it comes to businesses period.
    – Charles Boyung
    Commented May 23, 2011 at 14:16
  • It's a really interesting question for arm-chair communication lawyers. Connecting to someones server to access information freely offered, seems like the user is at the mercy of their connection software, this legislation should have been enforced on the browser not the website. Terrifying to have your government dictating laws of this nature, it's censorship of useability! Kinda like being an iOS developer. :)
    – sirtimbly
    Commented May 23, 2011 at 14:45
  • we're not talking about information on their computer, we're talking about information (cookies) on my computer. If you want something from me, you better ask.
    – MSalters
    Commented May 23, 2011 at 14:58
  • 3
    @MSalters - I can't argue with legislation that is already passed, that's silly. Especially since it doesn't impact me. But, theoretically you (the user) didn't put that information there, a web site put that information there for it's own use to associate your web client to a specific set of data on their server. You, the user chose to accept that data into your computer when you left your browser configuration defaults and then loaded a web site in that browser.
    – sirtimbly
    Commented May 23, 2011 at 18:31
2

I expect that within a week of the first websites implementing this, there will appear apps for FF and Chrome that let you set your preferences once and for all. Apart from that, the "native" way is is probably to use the browsers' current notification methods - usually the bar on top.

Improve this answer
2

Depending on how busy your site is and how willing you are to re-write your cookie code, maybe you can just bypass cookies altogether by taking a browser fingerprint, sending that up the tubes and using that information to setup sessions. The session id can subsequently be placed in the URL for future reference. To get the fingerprint you could MD5 the browser fonts, plugins, screen size and other javascript accessible guff.

Here is the EFF page on how to track browsers without using cookies:

http://www.eff.org/deeplinks/2010/01/help-eff-research-web-browser-tracking

Naturally you can reverse engineer that code from the frontend side.

Another option is to store the unique identifier in an image, e.g. the store logo. Or the browser history URLs can be looked at, as per those sites that know if you have been to 'example.com'.

Naturally your detection code can be obfuscated by putting it through the closure compiler.

These 'cheats' do need scripting, but only Windows Server admins have that turned off, don't they? Nonetheless, some plan B will be needed...

You can geoip your site visitor so that you only need worry about the cookie problem if their IP is in one of the EU countries.

Only if you cannot automagically identify your EU visitor would you then need to degrade gracefully to cookies - and asking for them. Naturally you'll be wanting to do that with a huge un-bypass-able modal dialog-box showing the Cookie Monster hugging Peadobear asking how you wish to be stalked today obviously to the tune of your favourite Rick Astley song - that should help with conversions...

Yep, this new cookie law is silly, but cookies were never intended to track people in the first place, were they..?

Improve this answer
3
  • thanks for the information and link its an interesting approach. As with all legislation its loop holes have already been found by those the regulation aims to restrict.
    – Adam Fellowes
    Commented May 24, 2011 at 7:36
  • 1
    The legislation only covers tracking cookies, not stuff like session ID cookies that are required for a site to function. So there's no need to implement complex browser sniffing just in order to run a session. (And, since the legislation covers tracking technologies, not just cookies, doing so in order to run analytics on a user who's said No would still be illegal.)
    – John Y
    Commented Oct 3, 2011 at 8:41
  • @John Yeates Big thanks for that comment - as I write I am implementing a little cookie to remember some page drop-downs and it did cross my mind earlier this morning that 'this might not be okay', but it is, so thanks!
    – ʍǝɥʇɐɯ
    Commented Oct 3, 2011 at 8:47
1

We've seen this re-usable approach for wrapping Google Analytics cookies, similar to Stack Exchange's own notification system:

http://cookies.dev.wolf-software.com/

It isn't perfect, but gives you a reference implementation; I suspect the best approaches will be built in a similar way (modal dialogs are too intrusive).

I've also written an article on what we've learnt from the ICO's own UX in more detail: http://blog.silktide.com/2011/05/can-we-use-analytics-with-the-new-uk-cookie-law/

(apologies for shameless self reference, but I believe it is on topic).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.