16

I am just looking for some advice on the new UK Cookie Law and how it affects PHP sessions. I understand that you do not need the users to opt in when a cookie is "strictly necessary" and the example given is adding an item to a shopping cart.

I am using similar functionality that remembers what you have stored in a contact form, which I feel is strictly necessary use of a session and therefore no opt in is required.

However the confusion for me arises because I have a session_start(); at the top of each page, which means the cookie is set straight away. Some users will not then go to use the contact form, so this means that the cookie is not strictly necessary for them.

I could remove session_start(); from the top of each page, but this functionality is used throughout a number of websites and it would be preferable if we could leave it in.

Could anyone shed any more light on this?

PeeHaa
  • 71,436
  • 58
  • 190
  • 262
Ian Jamieson
  • 4,376
  • 2
  • 35
  • 55
  • 7
    What new cookie law? – j08691 May 01 '12 at 15:00
  • 1
    new-eu-cookie-law-how-do-i-know-if-people-have-opted-out: http://stackoverflow.com/questions/7482724/new-eu-cookie-law-how-do-i-know-if-people-have-opted-out – Stefan May 01 '12 at 15:04
  • @j08691 - It's in the EU - http://www.cookielaw.org/ – Eric Petroelje May 01 '12 at 15:04
  • Yes sorry it is an EU law, but it only coming into affect for the UK on 26th, all other areas will still be unaffected. – Ian Jamieson May 01 '12 at 15:17
  • 4
    @EricPetroelje the linked site is hilarious crap. How can they ask me if I want a cookie when they only provide a "accept" button? Bureaucratic bullshit. I am looking forward to see the German equivalent... – WarrenFaith Jun 01 '12 at 12:29
  • 2
    @WarrenFaith well by having a 'no' button, you would need to store a cookie on that user's machine to save their answer – Ian Jamieson Jun 03 '12 at 21:53
  • you can store it in the session or add it as a parameter to each urls. anyway this all doesn't make sense... – WarrenFaith Jun 03 '12 at 23:04

5 Answers5

15

The simple answer is that you're probably going to be okay, the extent to which this law will even be enforced is massively up for debate anyway.

We will enforce the law proportionately. We’ll look at the risks if and when customers complain to us. If a websites’ cookie and privacy is a risk to many people, we may then take action.

There is a balance to be struck though, as not all cookies are equal, and our enforcement approach will bear this in mind.

For example, someone may complain about a cookie placed without their consent, but if it was just used to remember essential details rather than to gather information to be used for marketing purposes, then it may not be appropriate to act.

(Source: The ICO's Dave Evans on EU cookie law compliance)

robjmills
  • 18,438
  • 15
  • 77
  • 121
3

From what I have heard, the ICO is going to be fairly liberal in the interpretation of the law, the most important thing to do is show that you are making changes to comply with the spirit of the law.

I think that as the form is essential to the site, you don't need to prove that it is essential to 100% of users.

In an ecommerce site it is being taken as read that it's ok to have cookies that relate to shopping bag without asking permission, as it is essential to the function of the site, even if a particular user doesnt actually add anything to their basket.

Stuart McMillan
  • 31
  • 4
3

No, I think the php sessions donot fall under the Cookie Law. There is are a lot of differences between Cookie and Session.

For example, read here: http://php.about.com/od/learnphp/qt/session_cookie.htm

Also, if you read the law: http://www.bis.gov.uk/assets/biscore/business-sectors/docs/i/10-1132-implementing-revised-electronic-communications-framework-consultation.pdf

It says,

"The provisions of the amended Article 5(3) refer to any attempt to store information, or gain access to stored information, in a user’s equipment" (pg 57)

So you see, it says "user's Equipment" and sessions are not stored there, they are stored at server http://ejvyas.blogspot.com/2010/02/where-is-stored-is-it-in-browser-or-at.html

Raheel Hasan
  • 5,753
  • 4
  • 39
  • 70
  • 1
    Also note, though the ICO guide says something about "Session Cookies", it also clearly says that the "cookies" are those which are stored on users machine. – Raheel Hasan Jun 01 '12 at 13:19
2

If you're able to store a PHP session cookie on a user's computer to enable the 'essential' functionality of your website - what stops you then associating additional information with that visitor without their consent/knowledge..? (Apart from it being illegal.)

After all, all the information you store - except the cookie ID which is client side - is kept on the server side and the user can't do anything to view/modify this?

So in short, if the user 'allows' you to store a PHP session cookie on their computer there's nothing to stop you storing lots of other data about their visit? - IP, Browser, OS etc...

Paul
  • 21
  • 1
  • 4
    This is exactly why the cookie law is an absurdity. If you don't want cookies, order your browser not to store them or to warn you. Bureaucratic interference, besides, there are other ways website-visitors are being tracked (browser, ip, screen-resolution and other identifiers) – GDmac Oct 05 '12 at 14:55
1

Having read GDPR and having knowledge of how sessions work in php I have to tell you this: 1. session_start() in php is called before headers because you cannot send additional headers (as php session does) after the page loads and headers have already finished. 2. Because this happens sessions in php is an essential thing of the language itself for the language to work properly so it is something you need. Not want. 3. A php session stores a cookie in the users machine with the session id to know the connection. Not the user. For example the server says "I have a request from someone. To not mix the requests from everyone keep an id of everyone". The person, ip, geolocation or any other data is not known at the time. To be clear of this session_start() not storing any other data but the session id is how the server side language php and the server itself works and it is not possible to have consent before you initialize it. 4. But: before storing any other data you have to inform. I believe you have to inform when you start doing it, how you do it, how long you do it and what you are storing. So no more tracking on guests. Third parties like google, facebook and other implementations on your page is another story. You should pretty much remove it for guests if third parties don't allready do.

Simple: starting a session before headers is mandatory for php. Storing data needs consent so when the user logs in, registers or any other interaction inform the user and store a consent in the database (for you) and in the cookie itself (for the user to know).

Labros kar
  • 41
  • 7