Anybody familiar with certain UK newspapers will know that the EU has a track record of poorly drafted legislation, leaving itself open to dramatic misinterpretation. The most famous was probably the “bent banana directive” which ruled that bananas must be “free of abnormal curvature”, causing much hilarity and fun-making among Eurosceptics.
The “cookie directive” (EU Directive 2009/136/EC) aims to protect privacy by asking users’ permission before a cookie is placed on their computers. There are no specific guidelines as to how this should be implemented, and in the ensuing information vacuum some the worst-case-scenarios have filled the gap.
The worst of them all has users faced with a plethora of opt-in decisions, as websites serve up all the various cookies that websites tend to serve up these days. Any website with banner ads and using an analytics package would have quite a few.
Needless to say, such meddlesome opt-in features would put commercial EU websites at a disadvantage to their non-EU counterparts. Why would we want to do that?
Of course, the solution could be much more subtle, but the lack of any clear guidelines means that dramatic misinterpretation is the order of the day.
Enforcement is also an issue, particularly in a “borderless” online world with many complex permutations: do non-EU visitors to an EU website need to opt-in? What about non-EU websites with EU visitors? And non-EU websites that have affiliates within the EU’s borders? Individual EU countries can implement the directive as they see fit, which hardly helps.
Given the difficulties of enforcement, the cumbersome user experience, and the negative commercial implications, this looks like another “bent banana” directive in disguise: poorly crafted, faintly absurd and probably subject to mass disobedience.
Of course, a high-profile prosecution could signal a real intent to enforce the rules. But until that happens, I wouldn’t start redesigning my website just yet. A wait-and-see approach is probably the sanest course to take.

July 27, 2011 at 3:37 pm
Good post Colman.
The other question is of course “What’s an EU website?”.
Is it one hosted within the EU? What does that even mean, when large websites are hosted in many regions simultaneously
Is it a website belonging to a business that’s registered in the EU?
The whole thing is a clusterfuck, but as you said, it’s most likely that we can just sit back and ignore it. It’s just upsetting that they’re willing to away piss cash & time on such non-issues.
July 28, 2011 at 9:55 am
Well any cookie required for site functionality that the user instigates like login is fine as long as the cookie is deleted when the browser closes. It’s only persistant cookies that this law really pertains to.
A real head scratcher is who is responsible for the cookies Analytics places on a user’s machine. Google or the site owner?
There really is a lot of clarification still required if this is going to be enforceable!
July 30, 2011 at 2:05 am
Worth a watch..
http://www.youtube.com/watch?v.....r_embedded
August 11, 2011 at 11:59 am
Cookies should be stored on temporary basis and should be deleted after session ended. If user is using computer from Local internet cafe then there may be chance of getting his personal information hacked.Your point is right over here,there should be some guidelines for cookie management.
August 12, 2011 at 9:50 am
So, “Usability Testing”, I should be expected to log in to every site I return to? Reddit, Gmail, Amazon, etc would need my credentials manually entered every time? That sounds less useful.
Local internet cafes typically clear browser caches at the end of each user session, which is to be encouraged, but on my own machine I’d like sites to know who I am and react accordingly.
August 12, 2011 at 10:03 am
Ye lets not make internet functionality a lowest common denominator kind of thing, let the people who know what they’re doing get on with it. I should be able to opt out of this law from my browser…