New cookie law in UK?

[StatCounterJen]

Originally Posted by webmonkey

...they have chosen not to comment.

We have actually commented on this extensively via our blog. The post was made last year but our view of the situation remains unchanged.

[DavyAndDavy]

Originally Posted by StatCounterJen

We have actually commented on this extensively via our blog. The post was made last year but our view of the situation remains unchanged.

It's true you commented on the EU Directive although being a year old it is quite out of date and precedes any actual legislation passed by the member states. Some of your points are therefore now incorrect and you comment on what you "hope" member states "will do" not what they've actually done.

Your cookie opt-out feature is excellent and thanks for that. It allows all EU websites to comply without getting cookie consent.

But I was hoping that you'd comment on the more recent UK position where the ICO is "allowing" 1st party analytics cookies.

[webado]

I have serious doubts that Google Analytics plants real first party cookies.

[Arne]

What do you make out of this:
https://developers.google.com/analyt...onceptsCookies

[webado]

The cookies are set and read by google.com - from a script you include on YOUR site. Thus they are third party cookies.

They only reason they might not set bells ringing is that we already collect a ton of cookies set by google.com through everything we do.

[DavyAndDavy]

Originally Posted by webado

The cookies are set and read by google.com - from a script you include on YOUR site. Thus they are third party cookies.

I can see where you are coming from but you misunderstand the official definition of first party and third party cookies. (You can't make up your own definition!) It's down to the domain that the cookie is tagged with.

GA cookies are tagged with the domain of YOUR site not a Google domain, that makes them first party cookies. That means the cookies can only be read by YOUR site - albeit via a script on your site whereby GA is actually doing the reading. (But if you wanted to, your site could read the cookie directly.) Google cannot read the analytics cookies associated with your site unless the user's browser visits your site.

When a visitor visits your site the StatCounter cookie is tagged with the StatCounter domain, not your domain. That makes it a third party cookie. That cookie can only be read by StatCounter, via any site that uses the StatCounter code. In fact the same StatCounter cookie is used by StatCounter for all sites that use the code. (And your site cannot read the StatCounter cookie directly.)

[Arne]

Originally Posted by DavyAndDavy

GA cookies are tagged with the domain of YOUR site not a Google domain, that makes them first party cookies. That means the cookies can only be read by YOUR site - albeit via a script on your site whereby GA is actually doing the reading. (But if you wanted to, your site could read the cookie directly.) Google cannot read the analytics cookies associated with your site unless the user's browser visits your site.

Then, what is this line in the GA script?

document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

To me it is definitely read by GA.

From the link I posted above:

This is how a default installation of Google Analytics works, such that if you install the Google Analytics tracking code on pages on www.example.com with no customizations, the attributes for the __utma cookie will be:

* Name: __utma
* Domain: www.example.com
* Path: /

However, a page on another host of example.com, such as server1.example.com, will not be able to read or write the __utma cookie from www.example.com because the fully-qualified domains do not match.
This is what I believe why you see your site "tagged", it's equivalent with the security code you have in the Statcounter code. But neither makes the cookie a 1st party cookie on your site. The different is that the SC code don't stop you from using the same code on your sub domains, if you prefer that.

[DavyAndDavy]

Originally Posted by Arne

To me it is definitely read by GA.

Yes, of course it's read by GA, but indirectly, via your website, only because you incorporate some GA javascript into your website. If you took it out then the cookies would no longer be readable by GA.

On the other hand, if you removed your StatCounter code, the cookie could/would still be read by StatCounter if the user happened to visit another website that used StatCounter.

Your comparison of the domain tag and StatCounter "security" code are indeed an explanation of what makes the 2 tool work, but we're not talking about that, we're talking about cookies.

A browser can only read a cookie if the domain is the same as the fully qualified domain of the website being viewed in the browser.

Originally Posted by Arne

But neither makes the cookie a 1st party cookie on your site.

This statement is simply wrong. You are getting confused between who ultimately reads and writes the cookie (GA/StatCounter) and who owns the cookie (You/StatCounter). Again, just look at the definitions of 1st Party and 3rd Party and, if you have the tools, look at who owns the cookies.

[ejwjohn]

I am an amateur web site designer and have no professional training in Code writing etc.

I am now a little confuse, as i have used a site call Sitebeam to test a couple of my web sites that have Google Analytics and Statcounter cose imbedded in them. Sure enough when i test a site it comes up with the expected warning that the site is technically breaking the new EU directive, but only because it has detected the Google code, it seems to think that the Stat Counter code is not against the EU Directive .......

The people behind the test are the same as those who have written an ebook on the new Directive , take a look at:-

http://silktide.com/cookielaw

[rotarysteve]

ejwjohn

If your concern is with the sitebeam report not flagging both services, I wouldn't worry about it as IMO that problem is with the sitebeam programming itself. Sitebeam and Nibbler does now recognize SC for analytics, but probably doesn't throw a flag because they don't seem to give SC the same weight as they do GA for an analytical service.