GDPR, Something Stringent Building Sway, Part VIII-b

Cookies And Cookie Consent Banners For GDPR

In the last issue of this GDPR series, we considered the practical implications of the General Data Protection Regulation (GDPR) for websites and website development, with respect to professional services. This time we take a closer look at “cookies” (http cookies/web cookies): its history, implementation, and the subsequent recourse to “cookie consent banners.”

What Are Cookies And How They Work

In the earliest and simplest implementation, cookies are small text files that websites store on your computer or mobile device to help track your activity and preferences. Cookies are created and sent by a website’s web server when you visit it, and stored on your browser. The browser then sends the cookies back to the server each time you visit the website again. The server uses the cookies to identify you and remember your cookie preferences.

In the present-day application of cookies, a website must gain a visitor’s permission to use cookies (see below,) it can retain a record of this by setting a persistent cookie on your browser. A persistent cookie is a cookie that lasts for a long time, even after the browser is closed. The persistent cookie can store information such as your consent status, the date and time of consent, and the type of cookies allowed. The website can then read the persistent cookie and respect your choices when using cookies.

The cookie is placed on your computer by the web server using the HTTP protocol. The web server sends an HTTP response header called Set-Cookie, which contains the name, value, and attributes of the cookie. The browser then stores the cookie according to the attributes, such as the expiration date, the domain, and the path. The browser also checks the attributes to determine when and how to send the cookie back to the server.

Here is an example of an HTTP response header that sets a cookie:

HTTP/1.1 200 OK

Content-type: text/html

Set-Cookie: consent=yes; Expires=Wed, 21 Oct 2025 07:28:00 GMT; Domain=example.com; Path=/

This header sets a cookie named consent with the value yes, which expires on October 21, 2025, and applies to the domain example.com and all its subdirectories. The browser will store this cookie and send it back to the server whenever it requests a page from example.com or its subdirectories4.

A more complex example of a cookie, in human-readable format, with various pieces of information like the user ID, browsing history, site-specific configuration, site behaviour, credentials, location, and contact information would be as follows:

  Cookie Name: userSessionInfo

  Unique User ID: U1234567890

  Browsing History: ["home",
"products", "product_12345", "about_us",
"contact", "blog", "blog_post_67890",
"terms", "privacy_policy", "checkout"]

  Site-Specific Settings/Preferences:
{"theme": "dark", "language": "en-US"}

  Frequency of Visits: 14 times in the last
month

  Duration of Website Visits: Average of 5
minutes per visit

  Login Credentials: {"username":
"user123", "password": "encrypted_password"}

  Geolocation: {"latitude":
"10.654321", "longitude": "-61.501928"}

  IP Address: "192.168.1.1"

Contact Information: {"email":
"user123@example.com", "phone": "+18001234567"}

The same information stored as a string on the visitor’s computing device would look like:

userSessionInfo=U1234567890|home,products,product_12345,about_us,contact,blog,blog_post_67890,terms,privacy_policy,checkout|theme=dark&language=en-US|visits=14&avg_duration=5|credentials=user123&encrypted_password|geo=10.654321,-61.501928|ip=192.168.1.1|contact=user123@example.com&+18001234567

History of Cookies

HTTP cookies, also known as web cookies or browser cookies, have a history that dates back to the early days of the web. In the 1990s, to address the problem of maintaining state on the stateless HTTP protocol Lou Montulli from Netscape Communications Corporation invented the HTTP cookie—a term derived from the Unix programming term “magic cookie,” which refers to a packet of data a program receives and sends back unchanged. The introduction of the cookie raised privacy concerns as user/visitor behaviour could be tracked which led to major discussions about privacy implications in 1996. In the late 90s, browsers began to introduce settings that allowed users to manage cookies. By the 2000s, cookies became a standard part of the web experience, used for a variety of purposes, from session management to personalization and tracking.

In 2011, the European Union implemented the ePrivacy Directive, which required websites to obtain informed consent from users before storing non-essential cookies on their devices. Following this, in 2018, the General Data Protection Regulation (GDPR) came into effect in the EU, further regulating the use of cookies and requiring more explicit consent from users.

Throughout their history, cookies have evolved to become more secure and privacy-focused, with modern web standards and regulations guiding their use and implementation. They have become a fundamental technology for enabling interactive and personalized web experiences.