Is Wednesday the end for Web bugs and dodgy cookies?

Quite possibly, yes


This Wednesday (24 October), the second transitional period of the Data Protection Act takes effect in the UK, meaning that companies are required by law to provide all the personal data they store on anyone, if that person requests it.

This has far-reaching implications for all UK businesses but more significantly (from our perspective anyway) it means all UK Web sites, Web sites with servers based in the UK, and companies that have cookies or Web bugs on UK Web sites will have to review their approach if they are not to fall foul of the new law.

The new laws do have fairly complex repercussions, but only if a site is using the data it has gathered to personally identify visitors. If, as is the case with The Register, any data gathered on the site is used only to build impersonal stats, it is not affected.

There are however two main areas of concern for most Web sites: cookies and email addresses. If a cookie is installed on your machine so a site knows exactly who you are when you visit, the data protection laws come into effect. Also, if visitors are asked to insert personal details such as an email address, name, address etc, that also falls under the new laws.

The security distributor Allasso recently claimed that nine out of ten UK sites collect at least one type of identifying information, and most do so without the visitors' permission, going against the Act.

In essence, if data that can identify you is gathered, a Web site has a legal duty to tell you what exactly is being gathered, what use that will be put to and who will be given access to that information. It will also have to ask you if you are happy with that.

In much of Europe, there is an "opt-in" policy, so a visitor will have to actively click a box to say that information can be used. Legislation going through the EC may soon mean that the UK follows along the same lines and so the Information Commissioner suggests that UK sites adopt the same policy as "best practice". However, legally at the moment, sites need only give you the option, which you need to unclick.

Other main points are:

  • A privacy statement on its own is not enough if you are taking personally identifiable data. People should be made aware if you are taking this data at the time or before you are taking it. The Register's privacy statement is here.
  • Storing IP addresses is not in itself much of a problem because most visitors will be coming in on dynamic addresses (i.e. they will come from a different IP address every time they visit). Static IP addresses are fine unless a site uses that address to link with other data held on someone.
  • Companies have to be careful with data obtained from outside their own sites. Using spiders to gather email addresses is very likely to cross the threshold. If a company buys an email marketing list, it will need to ensure those addresses were obtained legally.
  • Web bugs - if used to gather personally identifiable data - are likely to infringe the Act because, by design, they are not observable to the visitor. This sits badly with the Act assertion that all data be "obtained fairly".
  • In cases where it is possible, Web sites should tell a visitor if they have information on them which they obtained from a third party.
  • Extra care needs to be taken when dealing with kids.
  • The company running a Web site needs to make sure that any personal data stored is secure.
  • Placing personal data on a Web site is not allowed, first because of security but also because it allows that information to be picked up outside the EU. This doesn't apply if that information is already out in the public domain.
  • If a company changes its privacy statement, all data gathered before that point is still subject to the old statement. It a company wants that statement apply to all that it has already, users' consent to that change will need to be sought.
  • Companies that do gather personal data have to, by law, notify the Information Commissioner that they are doing so. This costs £35 a year.
  • If one company takes over another, it will need to take account of how that company's data was gathered before using it under its own privacy statement.


Basically, the best way to view all this is as a tidying up of what has been a very contentious issue for several years. If you don't mind what companies do with the information they pick up from you, there's no problem. If you do, then you have some recourse.

Check out the Data Protection Web site for a lot more information. ®

Related Links

Data Protection site

Related Stories

The Register's privacy policy
Data Protection Act kicks in on Wednesday


Other stories you might like

  • Firefox kills another tracking cookie workaround
    URL query parameters won't work in version 102 of Mozilla's browser

    Firefox has been fighting the war on browser cookies for years, but its latest privacy feature goes well beyond mere cookie tracking to stop URL query parameters.

    HTML query parameters are the jumbled characters that appear after question marks in web addresses, like website.com/homepage?fs34sa3aso12knm. Sites such as Facebook and HubSpot use them to track users when links are clicked, and other websites like YouTube use them to enable certain site features too.

    On June 28, Firefox 102 released a feature that enables the browser to "mitigate query parameter tracking when navigating sites in ETP strict mode." ETP, or enhanced tracking protection, encompasses a variety of Firefox components that block social media trackers, cross-site tracking cookies, fingerprinting and cryptominers "without breaking site functionality," says Mozilla's ETP support page.

    Continue reading
  • Old school editor Vim hits version 9 with faster scripting language
    All of the famed user-friendliness and ease of use, but 'drastically' better performance

    Old school editor fans, rejoice: some two and a half years after version 8.2, Vim 9 is here with a much faster scripting language.

    Vim 9 has only a single big new feature: a new scripting language, Vim9script. The goal is to "drastically" improve the performance of Vim scripts, while also bringing the scripting language more into line with widely used languages such as JavaScript, TypeScript, and Java.

    The existing scripting language, Vimscript, remains and will still work. Only scripts beginning with the line vim9script will be handled differently. The syntax changes are relatively modest; the important differences are in things like local versus global variables and functions, and that functions defined with :def will be compiled before they are run. This allows many errors to be caught in advance, but more significantly, compiled functions execute from 10× to 1000× faster.

    Continue reading
  • Iceotope: No need to switch servers to swap air-cooled for liquid-cooled
    Standard datacenter kit just needs a few tweaks, like pulling off the fans

    Liquid cooling specialist Iceotope claims its latest system allows customers to easily convert existing air-cooled servers to use its liquid cooling with just a few minor modifications.

    Iceotope’s Ku:l Data Center chassis-level cooling technology has been developed in partnership with Intel and HPE, the company said, when it debuted the tech this week at HPE’s Discover 2022 conference in Las Vegas. The companies claim it delivers energy savings and a boost in performance.

    According to Iceotope, the sealed liquid-cooled chassis enclosure used with Ku:l Data Center allows users to convert off-the-shelf air-cooled servers to liquid-cooled systems with a few small modifications, such as removing the fans.

    Continue reading
  • Gartner predicts 9.5% drop in PC shipments
    Stark contrast to 11 percent increase year-over-year in 2021 shipments

    The party is over for PC makers as figures from Gartner suggest the market is on course for a breathtaking decline this year.

    According to the analysts, worldwide PC shipments will decline by 9.5 percent, with consumer demand leading the way – a 13.5 percent drop is forecast, far greater than business PC demand, which is expected to drop by 7.2 percent year on year.

    The PC market in the EMEA region is forecast to fare even worse, with a 14 percent decline on the cards for 2022. Gartner pointed the finger of blame at uncertainty caused by conflicts, price increases and simple unavailability of products. Lockdowns in China were also blamed for an impact in consumer demand.

    Continue reading

Biting the hand that feeds IT © 1998–2022