All cookies have a dark side, and no, it’s not the chocolate.

Once upon a time, visits to websites were discontinuous, weren’t recorded and each was treated as the first one. This would make any multi-step operation impracticable as any commercial transaction would thus have to be conducted from start to end in one visit. This was due to the fact that, being the HTTP a ‘stateless’ protocol ^[1]Web browsers and web servers communicate using the HTTP – Hyper Text Transfer Protocol. This is the mean by which websites can be accessed. , websites weren’t able to store information about their visitors activity.

All that changed with Cookies.

Cookies are small pieces of data, stored on internet users’ browsers, which record their online activity and which websites use to store information about visitors. Among the stored information one can find the operating system, the Web browser and its version, the webpages visited using that browser, the time and date of the visit and the IP address, username and password, and other types of order form information or personal information like e-mail, phone numbers and addresses.

The practical and pleasant outcome is that we are now able to surf the Web more enjoyably and efficiently, while saving significant amounts of time. For instance, cookies allow a persistent login to various online websites, as they recall your previously created session identifier for every website, hence, enabling to finalize an online purchasing transaction in several visits without having to start the operation from scratch. Cookies allow as well the showing of advertisements tied directly to the parts of the website a visitor has consulted.

All this is possible due to a unique identifier assigned anonymous and randomly to the user on the first connection to the website, which the browser will store and use in subsequent visits.

Cookies may be used to many ends, such as remembering behaviours or movements within the website pages in order to customize the visitors experience or convey more personalized advertisement according to those activities.

Without cookies, much of the Web as we know it would cease to exist… Frequent visits to websites would require constant registration and shopping online would be almost impossible.

But cookies came with a price…

Indeed, cookies are the main reason why internet users enjoy all kinds of apparent free online services, as Youtube, Facebook, Amazon. The thing is: they are not really for free. They cost us bits of our privacy.

While cookies provide a variety of benefits, they also raise some concerns regarding the potential for abusive invasion of privacy of users, due to fact that they might store personal or sensitive data.

One of the issues is, as a website’s owner compile databases of information about individual users through cookies, it can sell the users personal information to third parties to its own profit. For instance, the user’s search preferences and purchasing habits might be linked to its e-mail address and sold, within a list of other users with similar behaviour, to a company which offers related or not so related goods or services which can result in unwanted marketing.

Another issue is represented by third-party cookies—also known as “tracking cookies”. Mainly used by advertisers, they are able to track your browsing activity across multiple websites and compile surfing habits. The risk of a matching between user’s e-mail, home address, and other personal data to his surfing history – behavioural profile – is a risk to privacy.

So cookies are not dangerous in themselves. They do not contain viruses and they do not download malware (malicious software) or spyware in your computer. Most of the information it contains has been presented by the user to a website as part of a registration form, payment pages, and other online forms. So one must always consider which websites the information is given to, reading the privacy policy of the website before sharing any personal information. These policies serve as a contract with the user regarding what the company may and may not do with the user’s information.

If you are concerned about your privacy, you can disable cookies. Web browsers as Mozilla Firefox have options which allow you to decide whether or not you want to block cookies on your computer. You can choose, as well, to automatically delete cookies when the browser is closed. Another option is to corrupt the cookies of specific websites so no information could be get out of it and the cookie won’t be replaced by another.

What does the law have to state on this matter?

Well, EU law doesn’t prohibit the use of cookies. It recognizes their importance and usefulness for the functioning of modern Internet but warns about how intrusive they might be to privacy. Therefore the legislative strategy consisted in establishing some requirements regarding the information to be given by website operators to end-users about their purpose and the consent of the latters.

The Privacy and Electronic Communications (e-Privacy) Directive, in its 2002 version, was amended in 2009 and major changes were introduced, now foreseen under Directive 2009/136/EC.

Article 5(3) of the e-Privacy Directive was amended as follows:

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. ^[2]Article 5(3) of the old law of 2002 provided as follows: Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in … Continue reading

That provision is complemented with recital 66, which states:

(…) The methods of providing information and offering the right to refuse should be as user-friendly as possible. (…) Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. (…)

 

The amended article 5(3) determines now that storing and accessing information on users’ computers would only be lawful on condition that the user concerned, having been provided with clear and comprehensive information about the purposes of the processing, has given consent to that end.

The meaning of ‘consent’ under the e-Privacy Directive is taken from the definition under the EU’s Data Protection Directive. Consent to personal data processing must therefore be “freely given, specific and informed”. It can be referred to as ‘opt-in’, meaning that the user must give his or her consent before cookies or any other form of data is stored in their browser.

This shall not prevent strictly necessary storage or access for the provision of a service “explicitly requested” by the user.

Considering the vast room for abuse associated with the use of cookies, and the concerns related to privacy that it raises, initiatives as the ‘Cookie Sweep Day’ announced by the French data protection agency (“CNIL”), whose director is the current chair of the Article 29 WP, and to which other European Data Protection Authorities (DPAs) adhered, might not come as a surprise. In order to assess the general level of compliance with the current legal framework, several random checks to websites were conducted.

Recently, Jean-Claude Juncker, the new President of the European Commission, recommended that the new EU Commissioner for Digital Economy and Society, Günther Oettinger, further the reforms to the e-Privacy Directive.

A new reform might be well needed as tech giants as Google, Microsoft and Apple are already developing new tracking technologies, which are intended to replace cookies, deemed to be inefficient.

Cookies might belong to the past anytime soon, but the privacy concerns are here to stay.