Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On 26 May 2011, a new EU directive comes into force that users accessing websites should now be asked for permission to allow the website to store cookies containing information about them and their visit to the website.

How have you have tackled this issue? Is there another way to handle this besides an opt-in prompt the first time a person visits my site?

share|improve this question

migrated from May 21 '11 at 19:18

This question came from our site for professional and enthusiast programmers.

Looks like the relevent part is on page 20 paragraph (66). It says 'Third parties may wish to store information on the equipment of a user, or gain access to information already stored'. If the user is going to your site and using your cookie, it seems like this doesn't apply. – this.josh May 20 '11 at 20:02
up vote 2 down vote accepted

The exact answer depends on what country you are in - remember it is up to individual countries to implement directives so it will vary. In Britain, if you use cookies for sessions when users log-in or storing preferences, it seems to boil down to wait and see.

share|improve this answer
I know this is an old answer, but the UK government has published updated guidance on the cookie law pdf – MarkJ May 2 '12 at 22:41

On 26 May 2011, a new EU directive comes into force

Yeah... It now needs to be transcribed in member countries. Which can take another months or even years if a few of them drag their feed. Don't hold your breath.

There's something sweet, with respect to internet law: for looking into whether what you're doing is illegal on the internet, it might be illegal a) in the country you're based in, b) in the country your visitor is based in, and c) in the country your site is based in. Cloud-based hosting adds an extra twist to the problem (e.g. if your S3/EC2 site is based in the US with cloud-front serving data in Europe).

As you can imagine, a country's justice system can seldom go after a site operator as conveniently as they'd like, if at all. Thankfully so, too. Were it not the case, it would mean that Iranian censure would apply to US-based sites, among other colorful consequences. And since it is the case, questionable sites such as those from EU neo-nazi parties end up comfortably hosted in the US.

If the EU member states set up laws that website operators find too coercive, they'll will just relocate.

share|improve this answer

In my country (Denmark) the new EU directive has been postponed because the local laws aren't in place yet.

However it seems the EU law may be somewhat altered in Danmark. Here the seems only to regard "tracking-cookies" and not "session-cookies".

Session-cookies to help in a single session is/"will be" okay and do not need to be accepted by the enduser.

How the enduser is going to "accept" the tracking-cookies is still somewhat "fuzzy".
In some discussions (within the danish board that handles the cookie-law: popups are mentioned but also just having a link (on all pages) to the individual sites "cookie-usage". Like in the bottom right of BBC's site:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.