4

Possible Duplicate:
Google Analytics and the EU cookie directive. Who will fall foul of the law? Google or the developer?

I intend to use Google Analytics, and as I understand it I will need to offer users the option to opt out of cookies.

The question is this: I hate these constant cookie option boxes, everyone I ask it getting annoyed by them too. It's nice to have the option, but we all know they have been in use for well over a decade.

So - how big of a deal do I have to make about the fact that I'm using Google Analytics? can I pop a small link at the bottom of the page, maybe integrate it into "Privacy policies" page, and give people the option to opt out there? This would be very much the "Assume the majority of users don't mind, but at least make the option available" stance.

Ironically setting a cookie seems to be the only way I can see to enforce the opt-out as IP's change.

Improve this question
5
  • I think modern browsers send this header: HTTP_DNT = 1 for "do-not-track" either enabled/disabled. I would recognize this in visitors and automatically NOT use cookies with those people.
    – ionFish
    Jul 9, 2012 at 17:33
  • 1
    And a single IP can include multiple users. Also, I assume you are referring to the new "EU" cookie law - something which the rest of the world need not be concerned with.
    – MrWhite
    Jul 9, 2012 at 21:30
  • @ionFish: That would be a good option, however that would have to be set in the user's browser settings, so would not work as a web based PER-SITE opt-in/out. w3d: Yes indeed - hence why I cant do it by IP. And yes thats the one, the EU is a pretty big place and also contains most of our customers, so is important.
    – Digital Lightcraft
    Jul 10, 2012 at 7:29
  • This is not a question with a definitive answer. We will only find out when someone is taken to court because their method wasn't suitable what is acceptable and what isn't. Setting a cookie to record preferences is allowed. Much more detail here webmasters.stackexchange.com/questions/14473/…
    – paulmorriss
    Jul 11, 2012 at 15:21
  • @ionFish Also, note that in the UK at least, they've stated that while they'd like to rely on browser technology to implement this, it's not far enough advanced yet to be sufficient so site owners need to pro-actively gain consent.
    – Zhaph - Ben Duguid
    Jul 13, 2012 at 12:10

1 Answer 1

Reset to default
1

Assuming you're talking about the UK implementation of the cookie law, there's a fairly good guide from the International Chamber of Commerce (PDF) on this, which covers most cookie types and what you should be doing as a site owner.

In the first instance, you should really perform a "cookie audit" so that you understand what cookies are being set by your sites, and then document these in an accessible place - for example a "Privacy and Cookies" link in the footer. However, this isn't considered sufficient for "explicit consent". Implied consent is only really acceptable for "Strictly Necessary" cookies such as those controlling sessions for shopping basket or authentication systems.

Google Analytics fall under the "Performance Cookies" section, and as such consent should really be gained, however some people are deferring to Google for this one, which while "easier" may not be sufficient. There are tools out there that will help you block these cookies until the user has accepted them (note: I'm not affiliated with them in any way, but I've implemented their system on a few sites very easily).

Improve this answer
2
  • 1
    +1 Thanks for the informative answer. I do feel, however, there is a serious problem with explicitly seeking consent for the GA (and related) cookies. Visitor stats need to be as accurate as possible to be of any use. Gaining consent, particulary in an unobtrusive way, is going to result in inaccurate visitor stats, which is no use to anyone.
    – MrWhite
    Jul 13, 2012 at 23:40
  • I fully agree, however by implementing the bill with no amendments to the wording from the EU, that's what we're stuck with here in the UK. Other countries may have taken a more lenient approach that addressed the correct issue (3rd-party, cross-site tracking cookies for behaviour targeted ads) rather than this blanket policy we've got.
    – Zhaph - Ben Duguid
    Jul 13, 2012 at 23:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.