Include cookie control to comply with cookie law

Here's a good short and sweet snippet that explains what information should be provided:

Information to be provided
Cookies or similar devices must not be used unless the subscriber or user of the relevant terminal equipment:

(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and

(b) has given his or her consent.

http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communica...

As usual with this sort of legal morass it doesn't seem to be as black and white as that. It seems that cookies vital to a website's operation are exempt. So transactional/session cookies etc. Plus it's not just cookies but anything stored on the client, e.g. html5 localstorage.

First-party cookies for analytics and personalised content aren't technically exempt, but apparently at least the UK authorities have said there'd be no interest in regulatory action against websites using such 'minimally intrusive' cookies. Don't really know what that means, so we're breaking the law but only in a very minimal way *rolls eyes* lol

Okay so maybe they're saying 'use your common sense, you know when your website is forcing storage of data on a client that's either unnecessary, or necessary but which you're sharing so you don't know if it will be used improperly'. So that leaves anything third party really, which would be deemed 'moderately intrusive'. Google analytics, mollom, advertising etc etc

I think that's pretty difficult to audit until we have a release here and it's not worth adding another module until known it's absolutely necessary, so setting to postponed.

Well, perhaps this is relevant to keep active. The main alarm bells ring here when third party javascript is included which installs cookies, before a site has the chance to get implied or explicit consent, and that the site including the js has no control over the use of them. At least in the UK we have this notion of implied consent, and opinion that some cookies may be exempt, which might mean this is okay to use so long as there's a warning along the lines of 'if you continue to use this site we'll assume you're consenting to the use of cookies - see our policy to see what may be installed' i.e. the key being there existing a warning before such cookies are installed. But there are cases where it's difficult to guarantee this, or that really you should be getting explicit consent.

For example, there's an issue out which suggests a cookie-less sharethis button might be developed http://forums.sharethis.com/topic.php?id=78651 but not there yet. It might be okay if this button was cookie-less by its presence on a site, but installed cookies when you click it (since you have the opportunity to get consent) but might be questionable as it is.

So I'll put this back active since choices will be made on tools like social sharing buttons #1857354: Configure Social sharing links for default group content types