A few years ago a law in Europe changed the landscape of the internet. Known as the General Data Protection Regulation, or GDPR, this piece of legislation purports to protect user privacy. The most visible effect of this law is a requirement that websites warn users if cookies are being used on the site, and allowing for disabling of such. This warning, while seemingly innocuous, can cause confusion and annoyance. What should folks do when presented with this warning?
First, let’s back up a bit. By now most folks know that cookies are small pieces of data put on your computer by a website. These pieces of data, initially conceived in the nascent days of the web, were designed to make websites work better. For example, remembering you when you return to the site so you don’t have to log in again, or remembering what you did that last time so you don’t have to start all over again.
Nowadays, cookies are used cooperatively among many websites to help identify the internet surfer. Naturally, privacy concerns abound. Cookies are also used to gather statistical and analytic information, purportedly to provide the site purveyor with data that will help it improve the site. And just about every website uses cookies in order to work properly.
Why does a European law affect so many U.S.-based websites? Well, because the web is worldwide. If a website caters to European visitors, then it’s prudent to be compliant with European laws. Similarly, states laws in the U.S. must also be taken into account. Most notable of these is the California Consumer Privacy Act, which aims to allow users to prevent their personal data from being sold. Even if you’re not in California, you’re often presented with this option.
Everyone has seen a warning that informs the user that the site uses cookies and provides the option to opt out of cookie usage for all except those necessary for the site to work.
Options can get tricky; many sites try subtle and not-so-subtle tricks to get a visitor to accept all cookies. GDPR says the default must be “not accept optional cookies,” but this is obviously not followed by all.
The interesting thing is that in the several years since the GDPR came into existence, there have been few reports of poor user experience when not accepting nonessential cookies. As such, in the vast majority of cases, there is no harm in disallowing nonessential cookies. More recently, many websites have made it easy to either accept or reject nonessential cookies, so rejecting is an easy option.
Accepting nonessential cookies won’t lead to any malicious attacks (more spam doesn’t count as malicious). But it is still prudent to take the few seconds to go through the few additional clicks of the rejection process. Make this a regular practice and it will come naturally so you won’t even notice that you’re doing it.
John Agsalud is an IT expert with more than 25 years of information technology experience in Hawaii and around the world. He can be reached at jagsalud@live.com.
