The Joomla! Forum ™

...We have recently become aware of this cookie. We are working with the supplier of our content management system to remove it or, if it can’t be removed, to find another solution.

European Justice Commissioner Viviane Reding, told the European Parliament ...that forthcoming legislation would be drafted along four lines:

Firstly, new rules to give people "the right to be forgotten". These would place the onus on data controllers to prove they need to keep the collected data and would strengthen individuals' right to have information deleted.
Secondly, any data processing should be transparent and people should be fully informed when and how their data is collected. She singled out social networks, whom she asked to provide greater clarity on their data-processing procedures when people, especially young people, sign up to such services.
Thirdly, Reding called for "privacy by default". She said: "Privacy settings often require considerable operational effort in order to be put in place. Such settings are not a reliable indication of consumers' consent. This needs to be changed."
The final principle is "protection regardless of location", which means that European data protection groups will need to have powers to take legal action against data processors outwith the European Union.
All of this depends on proper enforcement of the law and Reding pledged to strengthen and harmonise the powers of regulators in the 27 member states.

Reding said: "For example, a US-based social network company that has millions of active users in Europe needs to comply with EU rules. To enforce the EU law, national privacy watchdogs shall be endowed with powers to investigate and engage in legal proceedings against non-EU data controllers whose services target EU consumers."

"You cannot hide anymore by saying 'my server is in Honolulu and my other server is in Kiev and...' I don't care," warns the commissioner.
"The law is for everyone who does business on the territory of Europe, whatever the origin of the business might be. So you cannot hide anymore by saying ‘I do not have my headquarters in Europe’."

....

• The law is the law and that is final, irrespective of our views on the intelligence of its drafting.
  ....

.....

Joomla! is a wonderful tool that has allowed a somewhat technical layman such as myself to create some sophisticated looking websites without having to spend great amounts of time or money getting to grips with the nitty gritty.

In order to maintain a strong reputation, it seems that it would be a smart move for the Joomla! team find a way to enable compliance by website owners (such as I) who themselves lack the requisite technical knowledge to do so.

I recognise that this means that I am asking others to do heavy lifting for me. I am genuinely contrite about this.
....

.....
.....

That said, it is clear that even governmental websites are struggling to come to terms with compliance (the ICO's present technique looks like a major sticking plaster), and so this can be an opportunity for Joomla! to EARN A MAJOR FEATHER IN ITS CAP (sorry for shouting...).

I do feel that it is well worth keeping focussed on the issue, which is that compliance in full is the only goal. I have spoken to website owners whose businesses are professionally regulated (financial, legal and so forth), and they are concerned that their regulatory bodies may take a stiff view of anything other than total compliance, over and above what the ICO may do to enforce.

We have recently become aware of this cookie. We are working with the supplier of our content management system to remove it or, if it can’t be removed, to find another solution.

But Browsers/users ability is not sufficient to accept as consent for cookies that collect personal information.

a person shall not use an electronic communications network to store information, or
to gain access to information stored, in the terminal equipment of a subscriber or user

.....
You are not permitted to enhance the current law!
....

.....
You will not find in the EU Regulation, PECR 2003 or PECR 2011 a statement that limits the prohibition to the collection of "personal information" via browser settings or otherwise.
As far as the legislation is concerned, it never uses the term cookie at all.
....

The previous rule on using cookies for storing information was that you had to:
tell people how you use cookies, and
tell them how they could ‘opt out’ if they objected.
Many websites did this by putting information about cookies in their privacy policies and giving people the possibility of ‘opting out’.
This rule was set out in Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR):
6. (1) Subject to paragraph (4), a person shall not use an electronic communications network to store information, or to gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met....

consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses

...

....

• I do feel that it is well worth keeping focussed on the issue, which is that compliance in full is the only goal. I have spoken to website owners whose businesses are professionally regulated (financial, legal and so forth), and they are concerned that their regulatory bodies may take a stiff view of anything other than total compliance, over and above what the ICO may do to enforce.

'veryprouddad' made a very valid and significant point

What if in 1.7 install

A User Group and View level called 'accept' (the User Group 'accept' being allowed in View level called 'accept'
A User called 'acceptance' with a password set as User Group 'accept'
Were installed

Also a Module like the Login module but with the ... User name/Password already filled in hidden fields ... the login button would read 'Accept cookies'. There could be some text informing about cookies. Sites that come under the new law could Publish the module and then set all 3rd party Modules/Plugins to Access 'accept'

That would not adversely effect sites that did not need to comply. But would permit those that do, to at least have some control of cookies from 3rd party Extensions (like analytic cookies). And bring the site somewhere near to the stage the ICO site is at the moment.

Is there a real need for a session cookie if the website is one that does not invite visitors to log in?

Google Analytics then needs to do something about its four cookies, however we can well imagine that Google are working on this,

If logging in makes a session cookie required, then the registration procedure should involve explicit signoff allowing the site to drop cookies.

A free Template from Phoca puts a session cookie on the PC ?

.....

No, there is no such feature made directly by the Phoca template, if something is storing something on your PC, it is not made directly by Phoca template.

...
http://extensions.joomla.org/extensions ... tion/17625 ...

It is working fine for me on J1.6 sites but I assume it would be okay on J1.7 too.

For sites where non compliance is not an option then this will keep you out of the firing line.