0

This is a long post:

This is regarding the UK, UE, and Italian cookie laws.

Even though

My sites are hosting in the USA

I reside in the USA

My sites are not commercial sites

None of my sites, that is my code, currently uses cookies

Most WP cookies would probably be allowed by the cookie laws as exceptions.

I still want to follow the UE, UK, and Italian cookie laws as closely as possible.

I believe that there will be some sort of USA cookie law in the future (probably as poorly written as the others) and I want to at least have a head start.

If well written, as a web site visitor, I would welcome such a law as a means of at least knowing when third party cookies are being used and have an opt-out option.

Accordingly, I would like to offer the visitor to my sites, including the blog, the ability to opt out of cookies, including WP cookies.

WP cookies do provide some benefits but I've been doing some "playing" around with them and have not encountered any situations where deleting all WP cookies really affects the performance or functionality.

I am talking about only non-session cookies because I believe they are not governed by the laws unless they are third party cookies and they are pretty much all not session cookies. I might be wrong about the law - does anyone know for sure?

If you want to remember the "opt-out", you will, of course, wind up creating a cookie to tell you not to create cookies - that is rather bizarre, if you think about it, but there is no other straight forward way to remember the opt-out and not ask the visitor every time they load or reload a page.

You would also create a cookie, or use the same one with a different value, to tell you that the visitor has accepted the use of cookies so you don't need to ask them again.

I think both cookies - the opt-out and didn't opt-out cookies - should be set to an expiration period of perhaps 3 months, maybe less. This would allow you re-query the visitor to make sure their desires have not changed regards cookies.

I also think there needs to be an easy to find link where the visitor can request changing their cookie decision. It would allow them nullify an opt-out choice or opt-out. I'd put that link in the WP sidebar.

As to WP cookies, there is the "remember me cookie: but given that most, if not all of the current browsers can save user ids and passwords, and auto-fill the fields as needed, having a site not remember you does not cause much additional work on the visitor's part.

A visitor goes to the site, they are asked to login, the browser has already filled in the user id and password fields, and all the visitor needs to do is press the enter key or click some button.

For me, that makes the use of a "WP remember cookie" a moot subject.

Looking at the WP code WP uses, you find, of course, the use of the PHP setcookie function to create cookies, and WP does so in several lines of code. I don't what to try and maintain a bunch of changes in core files.

There is a way to override PHP functions which I could use to substitute my processing for the setcookie function. My function would check for a opt-out cookie and if one exists, ignore the request to create the cookie if it is a non-session cookie. If there is an opt-in cookie, I would call the renamed original function to create the cookie.

No extra processing would be needed for WP to check for and use its cookies, the person opts-out, there is already code that handles a "cookie not found" condition.

What are your thoughts on that way of handling a visitor's an opt-out of decision on the part of the visitor?

It requires no code changes and still supports cookies if the visitor does not opt-out.

Oh, when the pages loads, if there is no opt-out or opt-in cookie, I would display a bar in the center of the page. Why put something that requires visitor action at the top or bottom of the page? Put it where they can't see it and make it modal, that is, something they mush attend to before they can proceed. Providing such a bar or popup is simple.

Thoughts, anyone?

Almost forgot, without putting the user's opt-in or opt-out preference in a database or even a flat file, they would be asked about cookies if they go to the site on a different computer or using a different browser profile.

It is not practical to use such a means of remembering the opt-in or opt-out decision without requiring a name and that would effectively mean the visitor has to login to opt in or out.

I don't think that is a viable way and might run a foul of the law.

Cookies are the best way to remember a visitor's opt in our out decision.

What do you think and does anyone know of another way to control whether or not WP creates non-session cookies?

I think it is something the authors should add as an option. Something you could turn on and off via the settings page.

0

I'm answering my own question.

The answer to the question of how overriding/replacing a builtin PHP function is that there is a rename_function() function but it is part of the ADP debugging extension which has to be installed in the PHP installation.

I could install it on my local set up but I doubt I'd be able to convince my hosting company to install it on their servers.

So, for now, the only way to do anything about cookies is to edit the 58 calls to the setcookie() function in the core files.

Oh, as for needing cookies, my testing has so far found that cookies are only required if you login. You could tell visitors that if they become a registered user and login to the site, they will have to accept cookies.

  • All of the authentication functions are in pluggable.php. Pluggable functions let you override functionality without editing core files, which is always always always a bad idea. – Milo Nov 12 '15 at 20:42
  • I am a professional computer programmer of 42+ years and understand all of the ramifications of software modification. In my career I have made changes to major IBM software components, to provide new or different capabilities and I know how to approach such changes as to design, testing, and maintaining an awareness of the status of updates to the component. If I change a WP "core file" I accept full responsibility for the effect and dangers. What I'm trying to do is override the setcookie function because there a 57 calls in WP code and I need to control cookie creations.CONTINUED – SimonT Nov 14 '15 at 3:01
  • What I'm trying to do is avoid changing WP code. If I can cause my code to be executed when WP calls setcookie, I can control the use of cookies without any changes to WP. Such a change would affect only the code executed when I make the change and would have no lasting effects anywhere. As it stands, it looks like I'm going to have to look at changing t5hose 57 calls to the setcookie function. By the way, the WP "programmers" have their own function named setcooies - only one character different than the name of the PHP function - very, very bad form just waiting to trip them up. continued – SimonT Nov 14 '15 at 3:10
  • You said "All of the authentication functions are in pluggable.php" This is not an issue of authentication of any type. I want to control all setting of cookies, not just the "login" cookies. There is no provision for doing that that I can find. If you know of a way to control the creation of each and every cookie set by WP, let me know. – SimonT Nov 14 '15 at 3:16
  • I think the only ones that are of concern have to do with logged in users, which as I mentioned, can all be removed by overriding the relevant functions in pluggable.php. The comment cookies can be disabled by removing the action hooked in default-filters.php. setcookies in the Snoopy class? Not written by WordPress developers, and it's deprecated and no longer used by core. Best of luck in your endeavors! – Milo Nov 14 '15 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.