New EU Laws governing cookies; will Google Analytics still be usable after May 25th?

[bendyman]

Hi, first time I've posted a question, New EU Laws governing cookies; will Google Analytics still be usable after May 25th? - apologies in advance if its already been covered, but I couldn't find any answers when I searched - google search showed someone else ask the question already, but no straight answers were given:-

From May 25th the Privacy and Electronic Communications Directive will come in to force which prohibits the use of cookies without informed, prior consent from web users. I've been trying to research to see whether or not this will affect Google Analytics.The Directive seems to be designed to prevent behavioural tracking, rather than web stats, but after reading the directive (with no law experience) I'm fairly confused by what will be prohibited.  If anyone has any thoughts on the matter, I'd be very grateful!

[BenFox]

Last time I checked (last month) no body knew. There is a definite case for them being allowed as part of the functionality of a website but it looks like this is going to be decide the first time the ICO takes someone ot court over it.

Sorry I couldn't give you a straight answer but I don't think there is one yet.

[manchestermichael]

Hi Ben

welcome to the Q&A.

As (other) Ben says, there's no real clarity on this. Best practice would seem to dictate giving site visitors the option to opt-out the first time they visit after May 25th.

In reality, nobody is going to do this and kill their webstats, unless and until site owners are taken to court, and IMO that's most likely to happen to high-profile pubic service sites.

I'd suggest that good practice and as insurance, review your Privacy Policy to ensure it's clear what's being tracked and what's not using cookies, and ensure there's a reasonably prominent navigation link to the Policy.

[JustinTaylor88]

Hi Ben

I've been looking into this a fair bit myself and have arrived at the following conclusions.

As already mentioned this whole legislation is up in the air to say the least, there is little guidance on how this will be practically implemented. From what i gather, general cookies that enhance usability by remembering information such as preferences etc are ok, however cookies that hold information that is deemed to be personal are more of an issue. Therefore i guess the case you make regarding Google analytics could be an interesting one.

We look after a number of medium weight websites that use cookies, some of which could be deemed to fall foul of this legislation, however so is just about every ecom site on the Internet. I am taking the view that i will see how the big boys tackle this, the likes of Amazon, Ebay, etc and follow their lead. For me this is one occasion not to be ahead of the game, especially as it will interfere with the purchase process and pretty much goes against every UX rule out there.

One other interesting point is that almost every site i have seen cover this story (BBC, Mashable, TechCrunch etc) all use cookies on the pages they are reporting this story on.

I suspect there will be a lot more debate and tweaking of this law before it is actually enforced as it seems impractical to implement as it stands

[Highland]

As with many things in government, most of this is a "fix" to a problem that doesn't exist. If you don't want to be tracked, you can easily opt out. But the EU seems to think it knows better and declares that ALL cookies must be opt in only. This rule screams that it was written by people who want to push an ideology (i.e. government is going to save your privacy at all costs) and have no idea how the Internet works.

The largest problem with this rule is that there's no way to ascertain why a cookie was placed (most commonly called a session). In virtually all cases, cookies are pointers to something else. What's stupid is that you can still easily track people without cookies, you just pass your session ID in the URL. It's clunky but it works and there's no law against it. And there's always log parsing.

My bet is that there will be some sort of legal action taken against Google (the biggest fish in the pond) and we'll see where that goes. My bet is it stays in limbo until that trial is complete. I can't see anyone wasting the resources going after every violator.

[bfinternet]

I’ve been keeping an eye on this topic myself, specifically trying to spot new & useful information from authoritative sources. The main area that’s of concern for all our customers is the grey area of Analytical cookies.

These two might be of interest:

1. It’s not about cookies, it’s about privacy – That’s from the Government Digital Service who look at websites like direct.gov.uk. It looks at the subject with some common sense and raises an interesting point that focussing on cookies may push sites into tracking users in other ways; using super cookie methods that the user cannot detect or control/disable as they can with standard cookies, which would be more intrusive.

Interestingly the GDS has taken a stance that analytical cookies are ‘minimally intrusive’ and (most importantly) ‘essential’ – which is a different line to the ICO. There’s a link to a PDF with guidelines at the end for government departments and other public sector bodies:

“Use of web-analytics/metrics: The use of metrics are integral are to departments’ being able to provide the best possible user experience in order to encourage citizens to use more cost-effective channels for accessing government services. They also allow departments to assess and demonstrate whether the digital services they offer provide “value-for-money” as demonstrated by the recent National Audit Office (NAO) report.

Consequently, collecting these metrics are essential to the effective operation of government websites, at present the setting of cookies is the most effective way of doing this. The ICO guidance supports this view as it states ’...it is highly unlikely that priority for any formal action would be given to focusing on uses of cookies where there is a low level of intrusiveness and risk of harm to individuals. Provided clear information is given about their activities we are unlikely to prioritise first-party cookies used only for analytical purposes in any consideration of regulatory action’”

2. EU cookie legislation – a look at some of the implementations – That’s new as of Friday, written by one of the Information Commissioner’s Office Technology Reference Panel:

_”+ First of all the 27th May deadline for implementing the legislation is more a marker for ICO – not a hard date. This means that from this time the ICO will start looking at the subject more closely.

• In the meantime in the run up to the end of May the ICO will publish information for individuals to allow them to raise concern via the ICO website. Note the ICO has not had much activity on the complaints front in last 12 months.
• They will also be making it clear that on an individual level it is unlikely that ICO will pursue 1 cookie on 1 web page
• The ICO can’t audit every UK website but can look at trends or patterns – eg if many issues raised about specific types of cookie
• ICO will also be issuing a clarification of its line on analytics cookies – these are not exempt from the law”_

It’s certainly a topic where the regulation and solution is still evolving. Personally I wonder if this might end up in the same situation as the DDA subject from a few years ago; the end result being that the worst offenders get a letter asking them to clean up their act, but for the rest of us who follow good practices there’s nothing to worry about.

[KeriMorgret]

Today's YouMoz is also about this subject. http://www.seomoz.org/ugc/not-freaking-out-about-the-eu-cookie-legislation