A legal problem with planting a cookie in another site's domain

Roland Perry ukcrypto at chiark.greenend.org.uk
Fri, 11 Apr 2008 18:07:33 +0100


In article <01dc01c89bf2$42479ec0$e57ea8c0@Jinja>, James Firth 
<james2@jfirth.net> writes
>Roland Perry wrote:
>> Are you volunteering to make this argument to ICO, and see what they
>> say?
>
>I only have 2 problems writing to the ICO.  Restricting the length of my
>rant in order to keep to the salient points and getting the ICO to confirm
>receipt of my emails. Royal Mail recorded it shall be.
>
>So far there are several issues I would like to bring to the attention of
>the office.  Comments welcome.
>
>1.) The data leaking from one of Phorm's products in 2006 (referrer
>strings).  Although not personally identifiable as yet, the sexual health
>angle of at least one leak is stark.
>
>2.) The use of cookies as an opt-in (or opt-out) mechanism is:
>a.)  not robust, in that it allows for "nagware" or other subversive means
>to get users to activate the service
>b.)  does not comply with at least DPA 11(1) - requests in writing
>c.)  raises questions over informed consent under PECR e.g. was the person
>enabling Webwise informed and in a position to do so, e.g. was it a child?

d)

>Also the "seat" argument, just because the last person to sit at the
>computer consented, the next person to sit at the same computer, e.g.
>internet café, did not necessarily consent.
>
>3.) The setting of cookies in other's domains as "done" already in this
>thread.

I'd stick to just 2(b) and 2(c), in addition to 3.

2(d) raises other possibilities of being discharged by putting up 
notices (a bit like the ones warning about cctv).
-- 
Roland Perry