On 26 May 2011, a new EU directive comes into force that users accessing websites should now be asked for permission to allow the website to store cookies containing information about them and their visit to the website.
How have you have tackled this issue? Is there another way to handle this besides an opt-in prompt the first time a person visits my site?
The exact answer depends on what country you are in - remember it is up to individual countries to implement directives so it will vary. In Britain, if you use cookies for sessions when users log-in or storing preferences, it seems to boil down to wait and see.
http://www.torchbox.com/blog/eu-law-cookies-and-ico
EDIT: This answer is now years old and isn't really correct any more! Also, if reading this now, remember GDPR comes in to force next year in the EU and so this question isn't even really relevant any more! Good luck!
On 26 May 2011, a new EU directive comes into force
Yeah... It now needs to be transcribed in member countries. Which can take another months or even years if a few of them drag their feed. Don't hold your breath.
There's something sweet, with respect to internet law: for looking into whether what you're doing is illegal on the internet, it might be illegal a) in the country you're based in, b) in the country your visitor is based in, and c) in the country your site is based in. Cloud-based hosting adds an extra twist to the problem (e.g. if your S3/EC2 site is based in the US with cloud-front serving data in Europe).
As you can imagine, a country's justice system can seldom go after a site operator as conveniently as they'd like, if at all. Thankfully so, too. Were it not the case, it would mean that Iranian censure would apply to US-based sites, among other colorful consequences. And since it is the case, questionable sites such as those from EU neo-nazi parties end up comfortably hosted in the US.
If the EU member states set up laws that website operators find too coercive, they'll will just relocate.
In my country (Denmark) the new EU directive has been postponed because the local laws aren't in place yet.
However it seems the EU law may be somewhat altered in Danmark. Here the seems only to regard "tracking-cookies" and not "session-cookies".
Session-cookies to help in a single session is/"will be" okay and do not need to be accepted by the enduser.
How the enduser is going to "accept" the tracking-cookies is still somewhat "fuzzy".
In some discussions (within the danish board that handles the cookie-law: http://digitaliser.dk/group/589573/profile) popups are mentioned but also just having a link (on all pages) to the individual sites "cookie-usage". Like in the bottom right of BBC's site: http://www.bbc.co.uk/
