I am confused by all the excitement surrounding the EU cookie directive; why is it such a painful thing?

As far as I can see cookies that are required for your site to function are allowed such as shopping carts and site logins. Am I missing something here?

The original HTTP specification was designed to work in a stateless way so to my mind this is a stepping stone in the right direction towards stateless RESTful websites. Why should state be added to the process when it is not needed.

There is plenty of mileage left in Digest Auth etc so why is everyone worried?

An obvious answer might be that Google Analytics needs to set cookies to be able to track traffic. There is a somewhat unsatisfactory answer to this point: http://cookies.dev.wolf-software.com

So have I missed something that I should be panicking about? What has you worried about it?

  • Are you seriously suggesting all EU websites abandon session-based login and go back to using HTTP authentication? That is just inane from both a usability and technological point of view. Giving up social login, single sign-on, async login, multi-factor authentication, etc. would not only cause a huge decline in usability and subsequent drop in conversions, but it would remove most of the advanced security features used in online banking. And all for what? I have no problem with the EU watching out for consumers and limiting the datamining by marketing agencies. But let's not go overboard... Dec 17, 2011 at 23:50
  • And just to be clear. I'm not saying that digest authentication is useless or obsolete. But it's no replacement for sessions (and URL-encoded SIDs present their own security concerns). HTTP authentication is perfect for small non-commercial sites with minimal application requirements who just need a barebone ad hoc solution for protecting a small set of directories with minimal setup. I use digest authentication all the time to setup temporary password protection for confidential file downloads for work. But it's not acceptable for use on 99% of the projects I develop. Dec 17, 2011 at 23:58
  • @Lèsemajesté don't panic! :) After reading the directives myself I have come to the conclusion that session cookies will be allowable should this come into force. I still disagree with your assessment of digest authentication however and suggest you read berenddeboer.net/rest/authentication.html
    – Treffynnon
    Dec 18, 2011 at 17:45

3 Answers 3


The "excitement" relates to confusion about how the new directive (PDF: 2009/136/EC) should be interpreted and implemented, and whether or not it's fair to European webmasters:

Do the laws apply to third party cookies?

The UK data protection body in charge of enforcing the laws in Britain says in their guidelines that they're seeking clarification (see my answer here), but until then, we don't know whether we'll have to ask permission to use third-party cookies from Google Analytics, for example.

Might the laws cripple EU websites?

If it turns out that the new laws require European webmasters to ask each visitor's permission to use third-party cookies, this will affect a lot of websites and render analytics, affiliate systems, usability testing, and even video embedding from third-parties (many of which use cookies) unusable or far less effective. It will also require many site owners who otherwise wouldn't have had to issue a request to store cookies to suddenly do so, drop the services, or seek cookie-less alternatives.

Does the directive apply to services hosted outside of the EU?

Related to the above, if I run a business from the UK but run a blog on a hosted service outside the EU that makes use of 'unnecessary' cookies, must I rebuild my theme to request permission to use them? If so, will the service be prepared to provide this functionality? If not, do I have to migrate my blog elsewhere? These questions are yet to be answered.

How best to obtain permission?

The new directive exists to ensure that people without technical knowledge have the same control over their privacy as more technical users. It does this by turning an opt-out system ("here's a cookie, you can always vomit it up if you don't want it") into an opt-in system ("would you like a cookie? here's what's in it...").

The new laws are great for consumers, welcomed by privacy groups, more closely aligned with opt-in email and permission marketing conduct, and in line with the sentiment expressed by movements like Do Not Track, which hope to block information harvesting techniques employed by behavioural ad networks.

The trouble is that opt-in systems carry more interface overhead than opt-out ones, because a request for permission has to be made to every user. Article 66 of the directive says:

"The methods of pro­viding information and offering the right to refuse should be as user-friendly as possible."

Unfortunately, they leave the actual method as an exercise for the reader. This is probably a good thing, because having the method dictated might make implementing the law even more painful. That said, it still raises a lot of questions about the best way to gain consent.

The ICO has stepped in to offer a list of six methods to request cookies (see page 6). They admit that no solution is ideal:

  1. Pop ups (ugly - see this discussion - and often ignored by users)
  2. New terms and conditions (users must explicitly agree to them before using the site)
  3. Settings-led consent (good for visual customisation, not so good for analytics)
  4. Feature-led consent (still have to make users aware that cookies are in use)
  5. Functional uses (they suggest a permanent 'permissions' area with notifications)
  6. Via third parties (but they don't know how the laws apply yet)

Since there's no 'one solution fits all' approach to request permission to store cookies, each site owner has to come up with their own way of doing it. Because no real thought has been given to standardising the request format or presenting a common look and feel, we're likely to see a hodge-podge of different pop ups and implementations.

Shouldn't browsers be handling this?

The ideal scenario might be to delegate all of this to the browser, but controls for cookies aren't mature enough and, even if browser updates brought granular cookie support, we'd still have to accommodate older browsers, which makes some kind of in-page request inevitable.

Does it present a commercial disadvantage?

The new privacy laws might make EU Web services less attractive than US ones. As Nick Halsted of TweetMeme says:

"If you go to two websites with identical functionality and one of them asks you to sign a big scary box that says ‘I am tracking everything about you’, and the U.S. one doesn’t, which one are you going to sign up for?" [source]

Not only might the addition of a modal permissions bar result in decreased sign ups and engagement, but we can't even split-test alternative request methods, because tracking the results of a split test first requires us to ask the user for permission.

What's more, if it turns out that EU businesses can't use Google Analytics et al without permission from each visitor (when US businesses can), isn't that a competitive disadvantage too? The US already has a thriving start-up community and funding ecosystem. Some would argue that privacy directives, while great for users, are a pain for businesses because they further stifle those competing with companies outside the EU.

Has it really been thought through?

While the goal of empowering users with decisions over their own privacy is a noble one, the usability aspects haven't been thought through. The good news is that (in the UK, at least) we have until May 2012 to figure something out.

In short, it's nothing to worry about, but there's a lot to think about. Once the ICO clarifies the case for third party cookies and other EU data protection officers have done the same, it's important that European webmasters pool resources to present a unified solution.

  • "It will also require many site owners who otherwise wouldn't have had to issue a request to store cookies to suddenly do so, drop the services, or seek cookie-less alternatives." I think, they will move their businesses out of Europe. It's so much easier in many cases.
    – feeela
    May 28, 2011 at 15:18

Most complaints I've seen fall outside of the exceptions you've mentioned and more into the realm of marketing/data. Some of the big issues I see are:

  1. Standard analytics (Google Analytics and others)
  2. Additional testing (A/B testing etc for usability/conversion rate optimization)
  3. Affiliate tracking.
  4. Re-marketing there are many programs now that drop a cookie and generate dynamic ads based on user's activity.
  5. Personalization - such as offering personalized product recommendations based on previously viewed products etc.

Admittedly I'm US based so I haven't followed this as closely as others may have but I don't believe any of the above fall into the "exceptions" and all are widely used.


It appears to be painful for people who read the headlines and don't know that about those allowed exceptions.

It is also painful if you have cookies for statistical purposes as they aren't allowed without consent:

The exception would not apply, for example, just because you have decided that your website is more attractive if you remember users’ preferences or if you decide to use a cookie to collect statistical information about the use of your website.


It's also painful because although it's easy to put JavaScript on your site that does statistics tracking it's not easy unless you've seen that plugin.

  • I find it rich that a government that is actively retaining IE6 in a few of its departments (MoJ for example) has the bare faced cheek to law down the law, nay, even advise anyone else on their website or business. May 27, 2011 at 14:57
  • 1
    @Digital The ICO doesn't make the laws. It just interprets and enforces the EU directive. It looks like a hard and thankless job.
    – Nick
    May 27, 2011 at 16:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.