Wedge

Hello,

I'm a developer attached to a project that builds discussion forum software, and I'm trying to get some guidance on whether the software we have is compliant with the cookie laws or not, since the guidance is very confusing.

I would note also that our package ('Wedge') is derived from an existing US-based development ('SMF') and shares much of the same code including the cookie management. I should also note that SMF's developers have absolutely no plans to add any facilities for managing cookie privacy, so that UK site owners which use SMF will be left non-compliant, and not through their own fault.

Currently, Wedge offers two cookies, one is a session cookie created automatically for guests. The session cookie is not shared with any third party. The cookie itself is simply a session ID, though the session ID allows for counting how many non-registered users are visiting, and also the last action carried out by that session can also be logged, meaning that site administrators can identify what topics of discussion a given user is viewing.

When a user actually logs in, a second cookie is deployed. Due to a bug, the first cookie is not erased, though it is not used when this second cookie is. The second cookie is more persistent, however the user is asked how long the session should persist for. This particular cookie carries two items of information, namely the user id of the logged in user, and their session ID. (The user id is carried through primarily for performance, though either way, that session ID is tied to a user account.) It is also possible for administrators to view the actions being carried out by logged in users.

Now, there is a note in the standard registration agreement text, which reads:
"Also note that the software places a cookie, a text file containing bits of information (such as your username and password), in your browser's cache. This is ONLY used to keep you logged in/out. The software does not collect or send any other form of information to your computer."

I recognise that this is not sufficient for compliance and that something more obvious will be required.


Anyway, this at least is the current position, and I would note that pretty much all of the discussion forum platforms offer a similar collection of features, and to the best of my knowledge, none of them are compliant at this time, and I do not believe there are plans to address that, meaning that site owners are likely to place themselves at risk by using any of these software packages.

My understanding of the cookie laws is that the registered-user cookie would be acceptable, by expressly asking for consent during registration so that on creating the user account, it would be clear that consent had been given.

With respect to the session cookie, I am not clear as to whether this is acceptable or not. We will work on the issue where the session cookie is not removed as promptly as it should be, but given that its primary use within the system is to identify the number of active users who are not currently signed in (and potentially the action they are carrying out), it seems to me that we should ask for consent and not issue if it not given. I do note that the software will be used by people not based in the EU as well as people based there (the core development team consists of one person in the UK and one in France)

I am concerned, also, with respect to the logging of actions. The tracking is not entirely real time, but 'most' page views (certain internal actions are excluded, and there is a threshold whereby making page views in that time will not be logged, typically views less than 8 seconds apart) are logged, and it is tied to the session ID (regardless of being signed in or not). My concern is that currently we are not advising users that this is being done, and that unlike general access logs, it is tied to a user, and could readily be argued to be personally identifiable. I would note that this can be disabled by the site operator, though it is enabled by default.

On a related note, that same session log is also able to identify whether a given user is signed in or not and that information is often made available to all users (visually), even though every user has the option to 'hide' the fact that they are online from the general population, site operators will be able to see that fact regardless.

I appreciate that this is a complex list of information I am giving, but I feel that as I develop a platform that others will make use of, I am duty bound to get advice on what is acceptable within the bounds of the UK privacy laws, and perhaps some insight into what is required across the EU.

Thank you in advance for any insight you can provide.

Peter Spicer
Developer of 'Wedge', wedge.org.