The EU is legislating on technology it doesn’t understand again. This irritates me.
Browser cookies – weren’t they something people used to get worried about and disable back in the 90s? (then re-enable quickly when they realised nothing works without them).
A cookie is a file, containing some data, which is stored on your computer by the websites you look at. More often than not cookies are used to allow you to login to a website – when you login, you send your username and password to the website and the website sends back a token which gives you access to the site – the authentication token is stored in a cookie, and this cookie is sent to the website every time you request a page, proving that you’re logged in. This is the only sensible way to do authentication on the web.
Cookies can also be used to track people as they browse around your website – this works by storing a unique code in a cookie on the visitor’s computer, then whenever they make a request for a new page on your website, you add an entry to a log on your server showing which pages they visited. Users are not identified by name or address – they are known only by the unique code you assign them, along with their IP address (which gives you some basic information about what part of the world they may be in and who’s their ISP). This kind of tracking is very useful for a website developer like me because it allows you to tell how people flow through your site, where they get stuck, at what point they get bored and go away etc. – it allows me to improve my site by identifying the pages that work well and improve those that work less well. In my opinion this type of tracking is completely harmless and you should just assume that any website that is worth its shit is tracking you in this way. Mine does, via the use of Google Analytics.
There is another way cookies can be used that’s a bit more sinister, and it’s this that the EU are knee-jerking against with their new bullshit law. Lemme explain it:
Typically a cookie can only be set or read from one website – if I set a cookie on my website, and one of my visitors goes to another website, that website can’t see the cookie that my website has set. This means that each site is a silo – I can track where users have been on my site, but I have no idea of what products they bought on eBay before they came to my site. This is the way it should be, and always has been.
However with social networking and the likes of YouTube and Facebook, “embedding” content has become very common and widespread. Common embedded content includes YouTube videos, the Facebook “like” button, the Twitter “follow” button, but also the Google Analytics tracking code that I use on my website, and the Google Adsense code that people insert into their website to make a few pennies selling pay-per-click advertising.
The reason this matters is that when you embed content from a third-party website, you’re allowing that website to place tracking cookies on your visitors’ browsers – the cookies will only be visible to the site that set them. So if I insert a YouTube video on my blog, visitors to my blog will not only receive my tracking cookies, they will also receive any cookies YouTube wish to set – what’s more, these cookies will be completely invisible to me because they were set by YouTube’s domain not mine. However, because that video is embedded in my website, any Javascript code within the YouTube embedded player will also be able to tell what page of my site you are on – in other words by embedding a YouTube video, I’m allowing YouTube to track what visitors do when they’re browsing my website.
Should YouTube be able to track visitors as they browse around the YouTube site? Of course. Should YouTube be able to track visitors as they browse around my site? Definitely not!
If you think about all the websites that have Facebook “like” buttons on them (it’s a lot), and consider that in most cases these allow Facebook to track everything you do whilst you’re on that site – Facebook can basically track everything you do on the internet. Google can too because of Google Analytics and Adsense, which are installed on the vast majority of websites out there. This is obviously a bit of a privacy concern.
In simple terms; this new EU law is designed to stop big companies like Google and Facebook from having too much access to our browsing habits, particularly on sites which don’t even belong to them – this is a very sensible thing to do – but requiring all EU websites to display a cookie policy and thoroughly audit their Cookie usage just to stop the big boys from gathering too much data is like napalming several hectares of forest when all you wanna do is cut down a couple of oversized trees. Grow some balls and buy a chainsaw for fuck’s sake!
Besides, I don’t like being told what I should publish on my own website. Can you imagine if every book had to contain a warning that reading in the dark might cause eye-strain, or that if you turn the pages too quickly you might get a paper cut? What if this applied not just to books, but to every piece of printed paper ever produced? It sounds absurd but that’s basically what the EU are asking people to do with websites – slap-on arbitrary and pointless warnings and opt-out clauses that nobody will ever read or use. It’s a waste of time, money and energy. Forget it. I opt-out of your stupid cookie rules.
This is a technology problem not a legislature one – the problem is that there’s no way to embed code from another website in a restricted way. I would like to be able to embed YouTube or Facebook code, but do it in a way that made it impossible for those sites to track my visitors.
I would suggest that the best way to implement this would be to add a new HTML tag (or an attribute to the <embed> tag) that would allow the tag to behave like a sandboxed iframe with cookies either disabled or restricted to the site where it’s embedded – in other words an embedded YouTube video on my site would only be able to see cookies set by other YouTube videos on my site – it wouldn’t see cookies set on the YouTube homepage, or cookies from YouTube videos embedded in other people’s websites, or any of the cookies I set myself. This would allow us to continue using embedded content without breaking the silos around each website.
Of course the people providing the embedded code snippets might need to be forced to use the new sandboxed tags rather than the older insecure ways, but at least then you’re focusing your legislation at the cause of the problem – the big companies who are embedding their code using a method which allows them to gather data which they really shouldn’t have access to.
Also I think it’s kinda hypocritical that the government(s) should be trying to take away our fundamental internet freedoms and privacies via pieces of legislation like ACTA, PIPA and SOPA, whilst trying to convince us that they’re protecting our privacy with stupid ill-thought-out pieces of legislation like the Cookie Monster. I wish politicians would just go to hell and stop fiddling with the internet, they clearly don’t know what they’re doing.