Introduction to law: There has been a lot of talks about EU Cookie legislation on websites. Everybody that does websites probably got at least few call from clients with questions and requests to make their websites comply. Cookie legislation also changed in the meantime which confused some. In short, what we have been getting from our client (UK client!) and their lawyers is:
There are 4 cookie categories, in broad terms:
The first does not require an opt-in and no’s 2 & 3 do not require a proper opt-in according to the ICC guide, with only the targeting/advertising cookies requiring the ‘tick-box’ option or similar.
One thing remains interpreted differently among our clients and that is if “Implied consent” is acceptable (for 2 & 3 at least). This means that after displaying opt-in popup message to visitors, if they ignore it and click any other link on website, this is interpreted as “implied consent” to accept cookies (and opt-in popup states that!).
What we needed to do
In short, what was requested from us was:
In most of our cases, only Google Analytics cookies were an issue to deal with.
Idea is simple. On first visit to our website we check if cookieOptIn cookie is set on visitor’s browser. If it is not set, it means visitor is here for the first time and we need to display a cookie opt-in message (we also store value “1″ to the cookie now). If cookie cookieOptIn exists, we check it’s value. Value can be “2″ (cookies accepted), “0″ cookies refused. Depending on that value, we output Google Analytics code or not.
If cookieOptIn exists and value is “1″, as stated above this means it is a new visitor which still hasn’t opted in nor out. For clients that want “implicit consent” to be applied on their websites, we do one more check. We check if cookieOptIn is “1″ AND if they came here through internal link (we check referral server variable and compare domain names). In this case we set cookieOptIn value to “2″ which is the same as opting in.
Notes on implementation:
Code is a bit messy but more than usable. Feel free to use it.