This is a long post:
This is regarding the UK, UE, and Italian cookie laws.
Even though
My sites are hosting in the USA
I reside in the USA
My sites are not commercial sites
None of my sites, that is my code, currently uses cookies
Most WP cookies would probably be allowed by the cookie laws as exceptions.
I still want to follow the UE, UK, and Italian cookie laws as closely as possible.
I believe that there will be some sort of USA cookie law in the future (probably as poorly written as the others) and I want to at least have a head start.
If well written, as a web site visitor, I would welcome such a law as a means of at least knowing when third party cookies are being used and have an opt-out option.
Accordingly, I would like to offer the visitor to my sites, including the blog, the ability to opt out of cookies, including WP cookies.
WP cookies do provide some benefits but I've been doing some "playing" around with them and have not encountered any situations where deleting all WP cookies really affects the performance or functionality.
I am talking about only non-session cookies because I believe they are not governed by the laws unless they are third party cookies and they are pretty much all not session cookies. I might be wrong about the law - does anyone know for sure?
If you want to remember the "opt-out", you will, of course, wind up creating a cookie to tell you not to create cookies - that is rather bizarre, if you think about it, but there is no other straight forward way to remember the opt-out and not ask the visitor every time they load or reload a page.
You would also create a cookie, or use the same one with a different value, to tell you that the visitor has accepted the use of cookies so you don't need to ask them again.
I think both cookies - the opt-out and didn't opt-out cookies - should be set to an expiration period of perhaps 3 months, maybe less. This would allow you re-query the visitor to make sure their desires have not changed regards cookies.
I also think there needs to be an easy to find link where the visitor can request changing their cookie decision. It would allow them nullify an opt-out choice or opt-out. I'd put that link in the WP sidebar.
As to WP cookies, there is the "remember me cookie: but given that most, if not all of the current browsers can save user ids and passwords, and auto-fill the fields as needed, having a site not remember you does not cause much additional work on the visitor's part.
A visitor goes to the site, they are asked to login, the browser has already filled in the user id and password fields, and all the visitor needs to do is press the enter key or click some button.
For me, that makes the use of a "WP remember cookie" a moot subject.
Looking at the WP code WP uses, you find, of course, the use of the PHP setcookie function to create cookies, and WP does so in several lines of code. I don't what to try and maintain a bunch of changes in core files.
There is a way to override PHP functions which I could use to substitute my processing for the setcookie function. My function would check for a opt-out cookie and if one exists, ignore the request to create the cookie if it is a non-session cookie. If there is an opt-in cookie, I would call the renamed original function to create the cookie.
No extra processing would be needed for WP to check for and use its cookies, the person opts-out, there is already code that handles a "cookie not found" condition.
What are your thoughts on that way of handling a visitor's an opt-out of decision on the part of the visitor?
It requires no code changes and still supports cookies if the visitor does not opt-out.
Oh, when the pages loads, if there is no opt-out or opt-in cookie, I would display a bar in the center of the page. Why put something that requires visitor action at the top or bottom of the page? Put it where they can't see it and make it modal, that is, something they mush attend to before they can proceed. Providing such a bar or popup is simple.
Thoughts, anyone?
Almost forgot, without putting the user's opt-in or opt-out preference in a database or even a flat file, they would be asked about cookies if they go to the site on a different computer or using a different browser profile.
It is not practical to use such a means of remembering the opt-in or opt-out decision without requiring a name and that would effectively mean the visitor has to login to opt in or out.
I don't think that is a viable way and might run a foul of the law.
Cookies are the best way to remember a visitor's opt in our out decision.
What do you think and does anyone know of another way to control whether or not WP creates non-session cookies?
I think it is something the authors should add as an option. Something you could turn on and off via the settings page.
