I am developing a web application that is only being used internally in a company (inside EU), and it is only for the employees.

Do I have to show a message to the users that my application is using cookies?

  • Do you even use any cookies that would require you to ask for consent? Not all cookies do. – jcaron Sep 1 '16 at 16:19
  • Here is my opinion, although lazy users may not like it: No, you don't have to show a message, even on live sites facing the public. Just put it in the terms: "We do blah. By using this site you agree to blah, otherwise you must leave and forfeit rights to blah us" It's no different than a popup since, technically, every user must read and agree to the terms in order to use your site(s). Popups are also a paradox since often, cookies are already dropped before a user (or suer) clicks "I consent". For example, how many of you actually conditionally load analytics after a consent click? About 0. – dhaupin Sep 1 '16 at 20:52
  • @jcaron for now, I have a "remember me" function to keep the user logged in even if the session is over – behzad Sep 2 '16 at 8:48
  • @dhaupin that sounds like a simple solution, but first i will ask the HR, if something like this is already in everybody's contract – behzad Sep 2 '16 at 8:49

This guidance (Guidance on the rules on use of cookies and similar technologies) from ICO(UK's independent body set up to uphold information rights) has a part related to the intranet:

How do these rules apply to intranets? In our view the rules do not apply in the same way to intranets. The Regulations require that consent is obtained from the user or subscriber. A ‘user’ is defined as any individual using a public electronic communications service. An intranet is unlikely to be a public electronic communications service. Although the Regulations would not therefore apply in the same way to cookies that are set on an intranet it is important to remember that the requirements of the DPA are likely to apply if your use of cookies is for the purposes of monitoring performance at work, for example. Wherever an organisation collects personally identifiable information using cookies then the normal fairness requirements of the DPA will apply.

| improve this answer | |
  • 1
    To amend this: Despite claims to the contrary there is no such thing as a Cookie law, there is a [privacy directive] (eur-lex.europa.eu/LexUriServ/…) (that covers, but is not limited to cookies). The point of the privacy directive is to get the users "informed consent" that their data is tracked. So if you have previously acquired the informed consent, e.g. as part of the employment contract, or because your users have accepted terms of use when they sign up for intranet access then there is no point in getting extra permission for cookies. – Eike Pierstorff Sep 1 '16 at 14:07
  • That reference seems a bit hazy: "We don't think the regulations apply to an intranet unless you are using cookies in such a way that they would apply." – Stephen Ostermiller Sep 1 '16 at 20:10
  • @eike Your comment sounds like a great answer to this question on its own. Also, it sounds like you would recommend that we change our tag from eu-cookie-law to eu-privacy-directive, correct? – Stephen Ostermiller Sep 1 '16 at 20:12
  • 1
    @StephenOstermiller, as to your first comment: this guidance refers to two different sources, so the meaning is: even if the EU privacy directive does no apply the DPA (the British Data Protection Act) might. So in context this is not particularly hazy. As for the second comment, the EU does not have even have the authority to pass laws (at least not directly - the EU parliament adopts directives that need to be transformed into national laws by the member states), so yes, a tag that says "EU law" should indeed by renamed. – Eike Pierstorff Sep 2 '16 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.