Question of the Week: What are cookies and why am I being asked about them?

A lot of people have heard about Internet “cookies” and often they have a bad connotation  to them, but to web developers they are very useful.  So what exactly are they?  The official Wikipedia definition states:

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is usually a small piece of data sent from a website and stored in a user’s web browser while a user is browsing a website. When the user browses the same website in the future, the data stored in the cookie can be retrieved by the website to notify the website of the user’s previous activity.  Cookies were designed to be a reliable mechanism for websites to remember the state of the website or activity the user had taken in the past. This can include clicking particular buttons, logging in, or a record of which pages were visited by the user even months or years ago.

This basically means that websites will save small pieces of data on your machine in plain text.  These have a wide range of uses, but here are some common examples that I can think of:

1. Netflix: Isn’t is awesome how it remember where you last left off?  This is done through cookies
2. Amazon (and other shopping sites): They remember what was in your basket last time you visited.
3. Stack Exchange: Remembers you, so you don’t have to log in every time.  (Actually this is a WAY more complicated process detailed here, but you get the picture)

What do these look like?  Here’s a screen shot of my Amazon session found in chrome://settings/cookies/

It appears that Amazon stores the following 6 values: at-main, session-id, session-id-time, session-token ubid-main and x-main.  I don’t know what each of those values mean, but I’m assuming that since I’ve recently been doing some browsing of Amazon, session-id would link to the contents of my last cart or searches.  Since cookies are used everywhere, and appear to be harmless, what’s all the fuss about using these cookies?  It’s the fact that these cookies can literally store anything, and that they’re stored in plain text.  Also any website can use them sometimes without you even knowing.

This leads us to this week’s question of the week from Pureferret where he asks:

Why are websites suddenly asking me about cookies?

I have for a long time known that websites give me cookies so that small pieces of information can be remembered about my habits, passwords etc. I accept this, but all of a sudden they are asking for my permission to do so. Why has this changed? What sparked this?

If you’ve been living in the UK and all of a sudden been seeing messages like this:

then you know what Pureferret has been experiencing.  Super User Yasin Soliman gave this answer:

The EU e-Privacy Directive, otherwise known as the EU Cookie Law, originally came into place on the 26th of May 2012 and means you, as the site owner/administrator, have to get your visitors’ informed consent before placing a cookie (probably related to social media elements or login/tracking systems) on their machine. If you are a WordPress admin, there is a notification plugin for you to use which looks like this:   There is also a great overview. According to the above link, it is not just standard cookies.

The law also affects anything that acts like a cookie, for example: Flash Cookies and HTML5 Local Storage.

There are also ‘suggested categories’ from the same link above (overview):

• Essential (logins)
• Non-Essential but harmless (functionality, not essential)
• Fairly Intrusive (web tracking)
• Very Intrusive (PII – personally identifiable information)

There are a few cookies that are exempt from informing the user of their presence, but these appears to all be non-harmful ones:

For a greater detailed guidance on the rules I suggest looking at this pdf from UK Information Commissioner’s Office.