How does EU Cookie law affects SharePoint Sites?

Question

The Euorpean Union has forced a new cookie law to protect privacy of a user. The full documentation is at Information Commissioner’s Office guidance

According to an extract from the above document,

Those setting cookies must:

• tell people that the cookies are there,

• explain what the cookies are doing, and

• obtain their consent to store a cookie on their device.

Is there anything special I need to tell my clients or should I just display a warning that "this site is using cookies...." to get the consent of the user?

Answer 1

There's a very good guide from the International Chamber of Commerce on this (linked to from the ICO blog post talking about their changes).

In there, they define 4 categories of cookies, and the level of consent you should be trying to achieve.

The very first step you should do is undertake a "cookie audit", and really understand what cookies your site is setting and what they are being used for. You should then include that list on an easily found page on your site (i.e. a link next to the Ts & Cs, or as a core part of the Privacy section, and linked to in the page footer - burying it on your site is not considered appropriate).

Once you know what cookies are being set, you should identify which categories they fit into, and handle them appropriately - note that if a cookie falls into multiple categories you should gain consent for each one:

1. Strictly Necessary Cookies: This would include the ASP.NET Session cookie. These can usually be set without gaining consent, but you must detail them on your site and tell the user what they do. They are usually not permanent (i.e. they time out and are deleted at the session or when the browser closes).
2. Performance Cookies: This covers analytics systems (i.e. Google Analytics). Consent should really be gained, however some people are deferring to Google for this one, which while "easier" may not be sufficient. There are tools out there that will help you block these cookies until the user has accepted them (note: I'm not affiliated with them in any way, but I've implemented their system on a few sites very easily).
3. Functionality Cookies: This covers cookies set to remember a user's preferences on your site, for example the ASP.NET Authentication Cookie (if you're using Forms Auth or Profile providers) - you can usually include a note with the control that changes the setting stating that this will store a persistent cookie.
4. Advertising or Targeting Cookies: This covers all 3^rd party cookies and any 1^st party cookies that are used by ad systems. Technically the person setting the cookie is responsible for gaining consent, however it's often the site that is best placed to gain that consent.

Finally you don't state whether this is a public facing site or an Intra/Extranet but this also has an impact - an Intranet can set what cookies it likes, and the acceptance of them can be mandated by IT policies, etc., similarly for Extranets your acceptance of the terms for accessing them should include acceptance of the cookies.