[RFC] Cookie notice

[imkingdavid]

Due to the recent proposed laws from various countries that aim to further restrict the placement of cookies, I think it would be a good idea to be safe and display a cookie notice somewhere not too obtrusive, and allow it to be hidden using a combination of jQuery and (you guessed it) a cookie. Basically, we just need to let the user know that for best performance, the board will need to place one or more cookies on their computer in order to store session data.

Something like this, perhaps?

This board uses cookies to store session data and to improve your user experience. Your continued use of this board grants permission for such cookies to be stored on your computer. Cookies created by this board can be cleared at any time by clicking "Delete all board cookies" in the board footer. If you do not wish to allow websites to place cookies on your computer, you may disable them in your web browser. Cookies placed by this board are not used for tracking your web browsing habits or any other malicious purpose. To hide this message, click the X (hiding this uses a cookie as well).

Having not read all of the different laws from all of the different countries, I am not sure to what extent this satisfies the legal requirement, but I think it is a step in the right direction. Thoughts?

[MichaelC]

This seems to be what the major websites are doing and seems to satisfy most laws.

The website team would be willing to develop this.

[EXreaction]

Please make it an option configurable in the ACP (to display/not display the message)

[MichaelC]

Like COPPA?

[EXreaction]

Yes

[callumacrae]

If it is going to be that invasive and long, please have this option disabled by default.

[EXreaction]

Yes, like COPPA settings, it should be disabled as it is specific to certain countries.

[Pony99CA]

Being "unobtrusive" might not satisfy the European law that prompted this; it's supposed to be obvious.

Also, remember that it doesn't apply just to cookies but to any files stored on the users PC not necessary for basic site functioning. That would include Flash cookies (I know, phpBB doesn't use those) and any other garbage that might be downloaded (I hope that doesn't include CSS and JavaScript ).

It also might apply to other places your site loads files from, so it would be good if there was a place to list other files from third-party sites (or include those sites' cookie messages).

Here's one of the first topics that I saw discussing this: phpBB and the EU cookie law - the cookie opt-in regulation

And, yes, it should be disabled by default like COPPA.

Steve

P.S. Should we tie in something for the German "impressum" law (maybe in a new Legal settings page)?

[callumacrae]

It satisfies the laws (at least, it does in the UK), according to the lawyer of the UK-based company I am doing work for right now

[Senky]

+1, also for dsiabled by default, but I would recommend adding this option also to installation process (you know, a lot of boards are located in EU ...).