Heya,

My site is creating cookies, both attached to my domain name and to smugmug.com itself, when people visit it.

As I'm based in the UK I'd kind of like to try and obey the law and avoid a £500,000 fine. Is there an easy way for me to do one of the following:

• disable cookies
• add a 'Please confirm you're happy with cookies' request (that can disable the site if they say no)
• get confirmation that all of the cookies set by Smugmug (whether on my own domain or smugmug.com) are exempt due to the exceptions to the regulation

I'd also like to be sure that my site complies with users' "Do not track" preference set in their browser, and I think I need to describe the use of any cookies that aren't covered by the exception.


As an individual, I'm unlikely to get more than a telling off by the ICO, but any UK based professionals are liable to a proper spanking.


Here's a link to the guidance on the law:
http://www.ico.gov.uk/for_organisati...e/cookies.aspx


I should've thought about this a while back, but it didn't occur to me to check my photo site for cookies until today.

Interesting question. I am not an expert on this, but aren't these regulations related to the storing of personal information and tracking? Are any of the Smugmug cookies actually storing information that this regulation would apply to?

If your site stores a cookie in the user's browser to remember that the viewer selected the Journal viewing style so that the site can use that viewing style on subsequent pages, does this regulation really apply to that cookie?

If I'm understanding this correctly, I think the first question would be whether any of the cookies that Smugmug does set are actually doing things that are covered by this regulation and if so, which ones and what can be done about those specific cookies.

Hi

As of 26th May in Europe all business websites are required to have the functionality to allow users the option to control which type of cookies functionality they accept. (http://www.ico.gov.uk/for_organisati...e/cookies.aspx ). This is in addition to any control the user has via browser settings.

Can you tell me if Smugmug is planning to develop something for us so that we can continue to use SM for our business needs ?

Mike

Cedric, a good example of how to handle this can be found at bt.com. Look for the popup box bottom right. If you click to change settings it shows 3 levels of cookie and explains what will happen if you disable each.

If a user disables a cookie that remembers if they visited the site before its no big deal but if they disable those that control login id and shopping cart items the site will not function correctly. Somehow this needs to be clearly explained. Would probably require a prompt if the user tries to buy something that they will need to enable a cookie again.

didn't there used to be an official response on this thread?

Presumably it's enough that we have a .co.uk domain (pointed to smugmug) to fall under the remit of this law?

i find the whole thing a bit of a PITA as a site visitor to be honest, yes its only once per site, but I've realised this week just how many different sites I visit, each requiring at least an acknowledgement that yes, I'm not scared if you 'track' me.

Anyway, I'd imagine we're pretty cookified here, even for customers. Not only the shopping cart, but also sharegroups, gallery passwords, event favourite galleries, preferred viewing style....

I would prefer a catch-all "yes this site uses cookies. Please opt in if you're happy" popup rather than a suggestion that maybe we probably don't need an opt-in for what smugmug currently does.

What have sites been doing if users refuse to opt-in? One I know of, Barclays bank, has a "if you login, you accept we will use cookies". essentially saying, no cookies, no service.

I confess the changes caught me by surprise as well - I wasn't expecting cookie popups to appear on sites like bbc.co.uk, so a bit of a communications fail by the lawmakers to let us all know about it. We're certainly not the only ones!
http://www.bbc.co.uk/news/technology-18206810

but yeah, lets get something in place.

actually another easy option for smugmug and us might be to go down the route of 'implied consent'. From the ICO page:

Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies. If you are relying on implied consent you need to be satisfied that your users understand that their actions will result in cookies being set. Without this understanding you do not have their informed consent. You should not rely on the fact that users might have read a privacy policy that is perhaps hard to find or difficult to understand. In some circumstances, for example where you are collecting sensitive personal data such as health information, you might feel that explicit consent is more appropriate.

http://www.ico.gov.uk/news/blog/2012...ookie-law.aspx

So more a "hey, we use cookies here for x,y and z. If you don't like this, please don't continue to use the site"

Also relevant:

How can UK organisations comply with the new cookie changes? The first is, do a cookie audit. Work out what your website does, which cookies it uses, what other technologies you might use. And from there, you can at least establish where your starting point is. The other thing to do, at the same time as that, is to review the information you give to your users about cookies. Make it more prominent, make it more user friendly, make it mean something to them, rather than just the person who wrote it. So being clear, honest, open and upfront about cookies is a really easy first step towards compliance. Once you've done that and your users are aware, you can then start to think about the best methods for getting user consent on your site. That suit what you do, what your users know and what their understanding is.

http://www.ico.gov.uk/news/blog/2012..._20120525.ashx (pdf)


OK, so, how about we get together a comprehensive list of what cookies Smug uses..... is this anywhere already?

edit: also, if you use any 3rd party tools like Google analytics these will need to be considered.

A link elsewhere suggested the Daily Mirror site had a good example. Here's what they put, a prominent, but not excessive, link in the top right "how we use cookies" which goes to:

http://www.mirror.co.uk/cookie-policy/

and a first time visitor pop up that says " This website uses cookies to give you the best, most relevant experience. Using this websites means you're OK with this. You can change which cookies are set at any time - and find out more about them - by following this link[hyperlinked] (or by clicking the cookie link at the top of any page)"

It's interesting that Andy originally replied in this thread and said he would look into it and get back to us and now his post has apparently been deleted. Where is the Smugmug info on this?

Originally Posted by jfriend It's interesting that Andy originally replied in this thread and said he would look into it and get back to us and now his post has apparently been deleted. Where is the Smugmug info on this?

I had a mistake in my post :) We'll have a reply to this thread, thanks everyone for your patience.

I'm now seeing a little smugmug pop up about cookies when visiting my home page, linking to
http://help.smugmug.com/customer/portal/articles/93251

the link isn't perfect (as its more about troubleshooting rather than a "we have cookies, here's why"), but I totally appreciate the speedy solution. :)

I will say Andy, on your page, the pop up banner clashes a little with your nav bar though ;) (On Chrome, 1024x 768)

Presumably it's a catchall 'all smugmug sites' rather than trying to determine which are EU or not.

Anyway thumbs up Smugmug

Visitors to SmugMug from EU countries will now see this message, the first time they arrive at SmugMug. Thanks for your patience while we took care of this!

Originally Posted by paulbrock the link isn't perfect (as its more about troubleshooting rather than a "we have cookies, here's why"), but I totally appreciate the speedy solution. :)

Yeah we'll update that cookies page with some additional wording, stay tuned on that. Thanks!

Originally Posted by paulbrock Presumably it's a catchall 'all smugmug sites' rather than trying to determine which are EU or not. Anyway thumbs up Smugmug

No, it's for visitors who are coming from EU countries to anyplace on SmugMug. Visitors from outside the EU will not see the message.

Originally Posted by Andy No, it's for visitors who are coming from EU countries to anyplace on SmugMug. Visitors from outside the EU will not see the message.

Is there any way for a US account holder to see what your own site looks like with an EU visitor?

Originally Posted by jfriend Is there any way for a US account holder to see what your own site looks like with an EU visitor?

No, there isn't. You can look at the screenshot above, that's the message. It shows only once and when they navigate away it's gone.

Great!

To say the UK required consent for cookies they appear to have made a major change as they brought the law in to allow for implied consent (that appeared to be not allowed at first).

Great that SmugMug has brought this in, one less thing I need to worry about and have to hack in to the custom template headers etc.

Thanks for the swift implementation!

Originally Posted by Andy Visitors to SmugMug from EU countries will now see this message, the first time they arrive at SmugMug.

Not quite.

You see that banner the first time you visit ANY site hosted on SmugMug. Look at a few sites by others (going through this forum and look at examples) and you'll soon get very sick of that banner.

Besides, what are you doing to make sure it does not clash with the styling of anyone's site?

I've just hidden mine (I hope!) so I can find a solution that actually fits my design instead of fighting with it. I'm happy to comply with the law, but it doesn't have to be so annoying - you now have to click it away. Why not the other way around? Click if you need more info?

Originally Posted by jfriend Is there any way for a US account holder to see what your own site looks like with an EU visitor?

Sure - you can use a proxy that 'places' you outside the EU. There are several plugins for Firefox to browse through a proxy, for instance FoxyProxy; search the plugins site with 'proxy' and you'll find some more.

If nothing else - useful for some testing!

Originally Posted by iamback Not quite. You see that banner the first time you visit ANY site hosted on SmugMug. Look at a few sites by others (going through this forum and look at examples) and you'll soon get very sick of that banner. Besides, what are you doing to make sure it does not clash with the styling of anyone's site? I've just hidden mine (I hope!) so I can find a solution that actually fits my design instead of fighting with it. I'm happy to comply with the law, but it doesn't have to be so annoying - you now have to click it away. Why not the other way around? Click if you need more info?

If you are not clearing cookies, once you've seen it, you should not see it again. Can you confirm please?