Cookie laws

[Andrew Eddie]

http://www.bbc.co.uk/news/technology-13541250

I'm not familiar with the legalities but is there anything we need to
be preparing for (or lobbying as the case may be) regarding changes to
cookie laws?

Regards,
Andrew Eddie
http://learn.theartofjoomla.com - training videos for Joomla 1.6 developers

[JM Simonet]

As far as i know this does concern only the "Do Not Track" part of
cookies, not the kind we use for Joomla.
I.e. lang preferences, etc. are OK
The issue is the gathering of infos for advertising purposes.
This concerns entitites like Google, Facebook, AOL, Yahoo, etc.
Basically, it seems this law is targeting at the "remanent" cookies
and not the "session" cookies.
JM

>--
>You received this message because you are subscribed to the Google
>Groups "Joomla! CMS Development" group.
>To post to this group, send an email to joomla-...@googlegroups.com.
>To unsubscribe from this group, send email to
>joomla-dev-cm...@googlegroups.com.
>For more options, visit this group at
>http://groups.google.com/group/joomla-dev-cms?hl=en-GB.

--
>Please keep the Subject wording in your answers
This e-mail and any attachments may be confidential. You must not
disclose or use the information contained in this e-mail if you are
not the
intended recipient. If you have received this e-mail in error, please
notify us immediately and delete the e-mail and all copies.
-----------------------------------------------------------
Jean-Marie Simonet / infograf768
Joomla Leadership Team - Production Working group
Joomla! Translation Coordination Team

[Michael Hamanaka]

It is certainly an issue to be aware of in a community like this and for some periodic updates of knowledge from both sides of the argument.  Possibly some innovations can be thought of and adopted as some users/governments will want to have more choices when it comes to privacy on every website, almost the same as the way some people want to have the font appear bigger or smaller, or their preferred language  ;)    It could be good for websites to have frontend exposed controls for privacy management that is related to just that site,  but my friend, I would have to track that choice of yours in a cookie!

Mike Hamanaka

Website Production 

Vertualize.com

Office:  310-564-6444

On Wed, May 25, 2011 at 5:45 PM, JM Simonet <infog...@gmail.com> wrote:

As far as i know this does concern only the "Do Not Track" part of cookies, not the kind we use for Joomla.
I.e. lang preferences, etc. are OK
The issue is the gathering of infos for advertising purposes.
This concerns entitites like Google, Facebook, AOL, Yahoo, etc.
Basically, it seems this law is targeting at the "remanent" cookies and not the "session" cookies.
JM

--
You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group.
To post to this group, send an email to joomla-...@googlegroups.com.
To unsubscribe from this group, send email to joomla-dev-cm...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.

[Micheas Herman]

A tangential, but related issue. How about setting the default to have
session cookies to be ssl only by default.

The only widely used browser that does not support SNI (server name
identifier, which allows more than one ssl certificate on a single IP
address) is IE on windows XP.

At least putting a red warning sign that your login and sessions are
not secure would be a good step in the right direction.

I have not fully thought through the implementation, but being as
firefox, chrome, and safari on XP, and the Microsoft sanctioned
solution of upgrading to vista or w7 and running IE on that are all
viable workarounds to the IE XP issue, and that firesheep is going to
grow more robust over time, it would seem like this could be a way of
making a lot of websites a lot more secure.

[brian teeman]

The best guide to this that I have found can be found at http://www.out-law.com/page-5486 starting half way down at "forthcoming changes to the law". (This is a well respected legal site)

As the bbc article states the governments (at least in the UK) have been caught out on this and haven't worked out exactly what it means or what they should be doing. As a result they have decided not to prosecute/investigate anyone about this for one year in the hope that this can be handled by the browsers. Personally I believe thats a flawed approach and doesnt comply with the law as its the responsibility of the site owner not the site visitor to control the cookies. (Remember that the UK govt decided not to upgrade their computers to browsers >ie6 for budgetary reasons)

There is some confusion if the regulation applies to ALL cookies or just those related to user tracking. The article above explains that.

There is a feeling that in most cases the regulation would be satisfied if cookies are only used by the site for the function of the site and that there is a statement on the site explaining what they are and what they do. In that case then there is nothing for joomla to do as its like the impressum laws in germany and is upto the site owner to implement.

However if it is decided that it applies to all cookies (and the bbc article suggests that the govt approach to make it a browser task suggests that they think it does) then there are probably some things that need to be done at a core level especialy regarding to the default duration of cookies.

There has been a little discussion on the joomla forum http://forum.joomla.org/viewtopic.php?p=2505376

IANAL 

[ssnobben]

Agree: I would like to see one allowed type of a 24 h cookie only.

On 26 Maj, 03:13, Michael Hamanaka <haman...@gmail.com> wrote:
> It is certainly an issue to be aware of in a community like this and for
> some periodic updates of knowledge from both sides of the argument.
>  Possibly some innovations can be thought of and adopted as some
> users/governments will want to have more choices when it comes to privacy on
> every website, almost the same as the way some people want to have the font
> appear bigger or smaller, or their preferred language  ;)    It could be
> good for websites to have frontend exposed controls for privacy management
> that is related to just that site,  but my friend, I would have to track
> that choice of yours in a cookie!
>
> Mike Hamanaka
> Website Production
> Vertualize.com

> Office:  310-564-6444On Wed, May 25, 2011 at 5:45 PM, JM Simonet <infograf...@gmail.com> wrote:
> > As far as i know this does concern only the "Do Not Track" part of cookies,
> > not the kind we use for Joomla.
> > I.e. lang preferences, etc. are OK
> > The issue is the gathering of infos for advertising purposes.
> > This concerns entitites like Google, Facebook, AOL, Yahoo, etc.
> > Basically, it seems this law is targeting at the "remanent" cookies and not
> > the "session" cookies.
> > JM
>
> >  http://www.bbc.co.uk/news/technology-13541250
>
> >> I'm not familiar with the legalities but is there anything we need to
> >> be preparing for (or lobbying as the case may be) regarding changes to
> >> cookie laws?
>
> >> Regards,
> >> Andrew Eddie

> >>http://learn.theartofjoomla.com- training videos for Joomla 1.6

[Andrew Eddie]

Thanks Brian

I think there are things we can do in the core distro to raise
awareness, like ensure that we have a good sample "privacy" page that
people can use in their own sites (possibly even part of the default
install without sample data). We could also do things like add an
optional message to the login module/page that also explicitly links
to an explanatory page.

However, I think the biggest potential problem lies in the extension
community where they are bolting onto a web service that uses 3rd
party cookies which trigger such legislation.

Regards,
Andrew Eddie
http://learn.theartofjoomla.com - training videos for Joomla 1.6 developers

[brian teeman]

Well there is nothing the core can do about extensions other than educate and raise awareness and the sample content is a start.

Whilst the login link idea is a good one are there not other areas of joomla front end that create cookies that need to be considered at least in terms of re-assessing how long the life of the cookie is.

[my...@yalefamily.com]

If this is the case. Something like a request to extention developers. Should be put on the joomla extention page. To create some awareness. But I would like to admin. Control for the backend of joomla

Sent on the Sprint® Now Network from my BlackBerry®

---

From: brian teeman <br...@teeman.net>

Sender: joomla-...@googlegroups.com

Date: Thu, 26 May 2011 07:58:26 -0700 (PDT)

To: <joomla-...@googlegroups.com>

ReplyTo: joomla-...@googlegroups.com

Subject: Re: Cookie laws

Well there is nothing the core can do about extensions other than educate and raise awareness and the sample content is a start.

Whilst the login link idea is a good one are there not other areas of joomla front end that create cookies that need to be considered at least in terms of re-assessing how long the life of the cookie is.

--

[elin]

Privacy policies are really up to the site owner although I do think that we could consider adding a pretty generic example to the sample data similar to the way we have a copyright module.

Privacy policies should disclose that a site uses cookies, which can be like that used on joomla.org

Cookies are used to store visitors' preferences and record past activity. The core of Joomla! does not share cookie information with any third parties. Your browser has options that will allow you to clear and block cookies, but doing so may impact your experiences on this site. 

Your IP address may be recorded as part of use of the contact form and in the collection of statistics about site use.

Should you choose to register on this site your name and email address will be stored. If you wish to remove your account contact the site administrator.


We really, really need to deal with that last point more appropriately in the core.

Elin

[brian teeman]

Sorry Elin but you have missed the point of the new law it is nothing to do with sharing cookies or even disclosing that the site uses cookies

[elin]

I'm responding to the more general issue of what we might want to disclose to users about what they need to include in their privacy policies.

I think there are things we can do in the core distro to raise
awareness, like ensure that we have a good sample "privacy" page that
people can use in their own sites (possibly even part of the default
install without sample data).  We could also do things like add an
optional message to the login module/page that also explicitly links
to an explanatory page.

Elin

[brian teeman]

Can we keep to the topic of the cookie laws please as this is a serious issue that effects ALL web sites in the EU and presumably all websites viewed in the EU

[elin]

Brian,

The post you linked explicitly suggested that including a privacy policy link on each page is a good baseline strategy.  

How to comply with the UK's current law on cookies
We recommend that if your website uses cookies, you should:

• include a link to your privacy policy on all pages;

• explain in that policy how and why you use cookies; and

• include a link in your policy to www.aboutcookies.org so that your visitors can access instructions on deleting and controlling cookies.

Also about the "new" law

"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

Consequently some cookies do not need users' consent, because they are necessary to fulfil the user's request. That will cover, for example, the use of cookies to remember the contents of a user's shopping cart as the user moves through several pages on a website. Other cookies, including those used to count visitors to a site and those used to serve advertising, will require consent. 

There will no doubt be questions about what constitutes consent in such circumstances under which consent in necessary, such as whether simply stating that it's happening upon first entering a site, requiring active consent such as a pop up upon entry to a site, or something else. While some privacy advocates such as AWP29 would like to move to the most extreme interpretation (and you could to be ultra safe comply with that interpretation by using a popup type mechanism) that is just one view. On the other hand business advocacy groups like IAB will push for more lenient interpretations. It is up to site administrators to make informed decisions about where on that spectrum they will place themselves and to also be knowledgeable about any extensions they install.

 At the same time site administrators will need to be aware of best practices, which is why starting off a new site with a built in privacy policy that can be updated to match their legal context and specific site structure makes sense. 

Personally, Andrew about the lobbying question, I would encourage OSM and other open source organizations to advocate for clarification of the rules so that basic "information society service" is not disrupted.

Elin

[brian teeman]

If you read what you just quoted then you will see that we, joomla, have an issue with the new regulations and will need to consider the use of cookies within joomla.

[Jennifer Marriott]

I think if you read Elin's response Brian you will see that she agrees that we, Joomla, have important issues to discuss regarding these new regulations, and not only regarding Britain's new regulations, but new regulations regarding privacy, tracking and other personal data security that most likely are going to be changing and adapting all over the world in the near future.  

It is an important discussion to be had, and hopefully we should all be mindful that allowing everyone a chance to discuss and share their knowledge is essential to solution building.  Due to your comment about being off-topic, I really hope you aren't insisting that the only regulations to be considered are Britain's new regulations.  There are changes being brought up and thought about in the US also.  It is a global issue.  I think that the decisions that are going to be made are not going to be easy ones, nor satisfy everyone, but I am sure it will give everyone the flexibility they need to meet the regulations in their country or region and be adaptable as regulations and needs change.

[brian teeman]

As I wrote these are not new British laws but for the entire EU

[Jennifer Marriott]

I stand corrected.  Substitute EU for the word Britain in my previous post.  The rest still stands as it is an issue with global considerations.

[brian teeman]

that is why I said "presumably all websites viewed in the EU"

[Jennifer Marriott]

All websites viewed in the EU or all websites who's owners are located in the EU?  I was not aware that the EU can enforce regulations on companies or website owners outside of their jurisdiction?  Can you point to an article that explains how the EU will be enforcing these regulations outside of their jurisdiction?  Does it involve internet filtering for EU internet users?  Is it being enforced at the ISP level then?

I guess I don't understand how the EU regulations will be able to be enforced on all website owners everywhere in the world, and then what happens when the regulations for a region/county outside of the EU has regulations that may conflict or may be stricter than the EU regulations, will that region be able to enforce their regulations then on all website owners everywhere, or enforce their regulations on the EU?

This certainly is a big, big issue.  It is great that dev is having this discussion.

[Mark Yale]

Hello all

 

Please help me make sure I am on the right track here on the topic and history, of cookies

 

1 they collect data from the browser

2 we can now clear the cookies from our browsers

3 they sit on our pc harddrives

4 they contain the site location user id and pw for each site within the specific browser used?

 

K let me stop there for a moment  if there is more please list like above (thanks)

 

With that said  it is the individual that has the option of deleting the cookies themselves

 

If I am correct on this NOW  then this is a privacy awareness to an admin/user of joomla core/extensions used

 

Now also the privacy issues extends a bit further than that as I use the community builder (free version) and love the power and settings tool (something the basic core does NOT HAVE

(creating profile tabs / fields and requiring the fields to me filled in….

 

To me one of the reasons I AM USING JOOMLA  and even the Community Builder are these:

1 I can force a registration for someone to View my site (parts or all)

2 with Cb I can hide some profile features to just the member themselves

 

Something that just occurred to me and am wondering,  can a Generic Paragraph be written about what cookies do and how they work build it into the Joomla Core and add it in the Admin BACKEND  maybe in the site config settings to allow admins to decide if they want to show that written paragraph  for people WHO REGISTER onto the joomla site that is created by someone. Just like the e mail verification,  make there be a way where as a user registers they MUST CHECK a box (like some forums) before they can continue to register onto the site acknowledging they have read the awareness paragraph.. (make it printable for the user to) even build it into a faq system..  but as a user Checks this box stating they have read the paragraph, allow it to be kept into a dbase log that can be exported through joomla in a crv file (this will protect the admins of the site to)  from those who say they didn’t read the paragraph.

 

I think this paragraph will help those with the current discussion on the cookie laws whether it be global or USA or EU   

 

In doing this I think that would make it easier to create awareness to each user that joins ANY JOOMLA CREATED SITE..  if joomla is created to not allow cookies then that could be added with the awareness paragraph   or have it up to an admin to decide if they want their site to do even a form of tracking where a visitor comes from (search engine or a link from another site and what browser they are using) 

 

 

The 2 basic things as an admin I want to know is where the person came from (search engine, facebook ad, or  facebook group or even a link from another site  even an e mail list (subscribe unsubscribe)  I also want to know the browser and version they use…..   because then I can ask if they are viewing my site the way I have it set up and designed (with a template)

 

I know this seems like a lot

(please don’t take the caps as yelling, I am using them to point out areas of my thinking)

This can be food for thought

 

Thanks all

Mark

 

 

From: joomla-...@googlegroups.com [mailto:joomla-...@googlegroups.com] On Behalf Of Jennifer Marriott
Sent: Thursday, May 26, 2011 10:52 PM
To: joomla-...@googlegroups.com
Subject: Re: Cookie laws

 

I think if you read Elin's response Brian you will see that she agrees that we, Joomla, have important issues to discuss regarding these new regulations, and not only regarding Britain's new regulations, but new regulations regarding privacy, tracking and other personal data security that most likely are going to be changing and adapting all over the world in the near future.  

It is an important discussion to be had, and hopefully we should all be mindful that allowing everyone a chance to discuss and share their knowledge is essential to solution building.  Due to your comment about being off-topic, I really hope you aren't insisting that the only regulations to be considered are Britain's new regulations.  There are changes being brought up and thought about in the US also.  It is a global issue.  I think that the decisions that are going to be made are not going to be easy ones, nor satisfy everyone, but I am sure it will give everyone the flexibility they need to meet the regulations in their country or region and be adaptable as regulations and needs change.

--

[elin]

The usual this is not legal advice disclaimers.

We should look at the actual text instead of articles about it http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011:0036:En:PDF

and for the UK specifically  http://www.legislation.gov.uk/uksi/2003/2426/contents/made I'd note  as an example the text on implementation of a related EU directive:

Proceedings for compensation for failure to comply with requirements of the Regulations
30.—(1) A person who suffers damage by reason of any contravention of any of the requirements of these Regulations by any other person shall be entitled to bring proceedings for compensation from that other person for that damage.
(2) In proceedings brought against a person by virtue of this regulation it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the relevant requirement.
(3) The provisions of this regulation are without prejudice to those of regulation 31.

So, as long as you are not actually causing harm and you have taken reasonable care no one needs to go into a panic about Cookies.   As we say in the US during basketball season, "No harm, no foul." (There are also other much more potentially harmful privacy issues you should worry about, such as database security. This regulation also requires mandatory notification of EU users in case of data breach for example. I would be much more concerned about storing backups containing user data  )

Yes the rules in different jurisdictions are different and that does make it complex. As the original article--which is about Great Britain specifically-- indicates the implementation of regulations in the EU  as of now will be country by country as well. Other articles indicate that only Denmark and Estonia have passed complete implementing legislation.  So there is absolutely no emergency.  We can all calmly have a discussion of how Joomla! as an application can make it as easy as possible for site owners to comply with relevant privacy regulations, whether it be "cookie laws" or the under 13 rules in the US or others which will certainly be enacted in the coming years. 

Yes we could implement something like an informational message for site admins  that in sample or core data and, just like we do with a sample welcome message on the registration email.  The issue would always be that we can do that for the core of Joomla! but people may have extensions such as those serving advertising, using analytics and those doing geodetection that also set their own cookies.  Doing something on login or registration is not useful for cookies specifically since Joomla! uses cookies for everyone but we could think about a core module like the one ICO is using http://www.ico.gov.uk/.  (Registration information involves a whole separate set of privacy issues including whether your database is appropriately secured for the types of data your are collecting.)

In terms of helping site administrators I think it's useful to think about ways to help them understand the privacy issues on their site including for extensions. Perhaps we could add that to the site information tabs. 

For extension developers I'd suggest complete disclosure of all privacy related code whether in docs, on download or on installation and a review of any related changes to policies for any external APIs you might be accessing. I suspect that many will be changing their terms of service to require disclosure to users (Ad Sense, for example, has require this for several years already.)

However, I will also so that as far as I know none of us are lawyers and it might make sense for the PLT to ask OSM to arrange a legal review of this issue as it relates to the core and to whether/how we can safely give advice to people about the need for privacy policies without creating a whole new set of potential liabilities.

It might also make sense for a small team to do some more detailed research on privacy issues for both the CMS and the platform and propose any necessary and appropriate actions.

Elin

[Webdongle]

Has anything more been done about cookies ?

"Website owners ‘must try harder’ on complying with the new cookies law"

"More detail on what is meant by consent. The advice says ‘consent must involve some form of communication where an individual knowingly indicates their acceptance."

http://www.ico.gov.uk/news/latest_news/2011/must-try-harder-on-cookies-compliance-says-ico-13122011.aspx

[Sven]

This here is a nice article about the situation in germany http://spreerecht.de/datenschutz/2011-07/kommt-das-cookie-verbot-faq-zur-deutschen-umsetzung-der-eu-cookie-richtlinie (yep it`s in german but hey google translate will help a bit here)

So most people will just ignore this law, I also do, because for now we have not really to worry about penalty charge here.

But the bill has some funny things to mention, it`s not only cookies, the bill says data what means also browser cache data etc.

And it also makes clear that it`s not enough to just have a disclaimer for cookies, the user must allow the saving and must have the right to disagree later, what means if I use for example a cookie to store the font size I must log the users decision so that he can later change this decision... yep funny joke but it says so...

Cookies are only allowed for services where this is a must have and in a normal Joomla setup without shop or something like that there is no must have for using a cookie, this also includes login cookie, because their is no real need for this cookie so I must ask the user before I save the cookie in her/his browser.

All in all just another stupid law from stupid politicians...