A legal problem with planting a cookie in another site's domain

James Firth ukcrypto at chiark.greenend.org.uk
Fri, 11 Apr 2008 17:36:57 +0100


Roland Perry wrote:
> Are you volunteering to make this argument to ICO, and see what they
> say?

I only have 2 problems writing to the ICO.  Restricting the length of my
rant in order to keep to the salient points and getting the ICO to =
confirm
receipt of my emails. Royal Mail recorded it shall be.

So far there are several issues I would like to bring to the attention =
of
the office.  Comments welcome.

1.) The data leaking from one of Phorm's products in 2006 (referrer
strings).  Although not personally identifiable as yet, the sexual =
health
angle of at least one leak is stark.

2.) The use of cookies as an opt-in (or opt-out) mechanism is:
a.)  not robust, in that it allows for "nagware" or other subversive =
means
to get users to activate the service
b.)  does not comply with at least DPA 11(1) - requests in writing
c.)  raises questions over informed consent under PECR e.g. was the =
person
enabling Webwise informed and in a position to do so, e.g. was it a =
child?
Also the "seat" argument, just because the last person to sit at the
computer consented, the next person to sit at the same computer, e.g.
internet caf=E9, did not necessarily consent.

3.) The setting of cookies in other's domains as "done" already in this
thread.

James Firth
=20