On 26th May 2011 the rules about Cookies changed.  Business websites in Europe now need to disclose the use of certain types of cookies, and get consent from their users before setting them.  The Information Commissioner's Office has given UK businesses 12 months in which to make their sites compliant.  This tutorial walks you through how to make your IFAPortal website compliant.

What are Cookies?

Cookies are a standard internet technology.  Cookies provide a mechanism to store information, from page to page, request to request. They are accepted by your browser and stored on your computer.  You can choose not to accept cookies in your browser security settings.

Why the legislation?

The legislation is part of the European Privacy Directive.  The laws are an attempt to prevent the collection of anonymous but often personal data without the user being aware that it is happening. Cookies set by a statistics tracking package like Google Analytics, whilst in no way malicious are being used to track your use of certain websites for example.  Europe says people should be given the opportunity to opt out and not receive these cookies.

Are cookies used on your IFAPortal website?

Yes. The platform we deploy your website on uses cookies for the purpose of session and login management.  There is not much we can do about those except disclose them, and inform your visitors that they may block them, but that aspects of the site may not work for them.  We'll be making that disclosure. The good news is that these probably fall under the heading of 'necessary' use.  The Independent Commissioners Office website, uses a similar example to illustrate necessary use; a shopping cart which uses cookies to store the content of users' baskets - the shopping cart site can't function without them.

Do I need to do this?

At the moment UK businesses have until late May 2012 to implement disclosure.  11 months is a long time, and the legislation may change.  We've provided a solution early on, as many of our clients have already expressed concern over the legislation and are asking how they should respond to it.

Adding to your website.

The script we'll be using to do this is the cookiesDirective.js script, written by our Technical Director, Oliver Phillips. There are 3 simple steps to adding it to a website, but below we've tailored the instructions for your IFAPortal website. If you don't think you can set this up yourself, we can do it for you but there'll be a small charge to cover the time involved (unfortunately as people are using different scripts, and the privacy policy URI is unique to each site we can't update all sites centrally).

Before you start, go to your IFAPortal website's privacy policy page (under the About Us menu). Copy the web address that shows in your browser's address bar. Perhaps paste it somewhere you can access it.

Scenario 1 - You don't have Google Analytics installed on your website

Go to your website home page and login, place your page in edit mode. We need somewhere to paste our script. The Regulatory Statement module at the bottom of the page is perfect, since it appears on all pages of your site.

Hover your mouse over the inverted triangle on the far right - and on the submenu which appears select, settings. On the subsequent settings page, click the + icon next to Advanced Settings. You'll see a textbox called Footer.  This where we will paste the script.

Paste all the code between the start and finish tags, into the Footer text box.

<!-- Start cookiesDirective.js script-->
<script type="text/javascript">
    function cookiesDirectiveScriptWrapper(){
    }
</script>
<script type="text/javascript" src="http://js.cookiesdirective.com/1.3.js"></script>
<script type="text/javascript">
    // The position of the disclosure ('top' or 'bottom')
    // Number of times to display disclosure. Enter 0 to show it forever!!!!
    // The URI of your privacy policy

    cookiesDirective('top',0,'yourprivacypolicy.html');
</script>
<!-- End cookiesDirective.js script -->

Replace the section in the text which says yourprivacypolicy.html in the example above with the address of your privacy policy - you made a note of it previously. Click 'Update' towards the bottom of the page, to save your changes.  You're done.

Scenario 2 - You use Google Analytics on your website

The process is similar but not the same.  Analytics is a great program, but it uses cookies to compile it's data.  Those cookies don't qualify as necessary, so we can't set them without our users' consent. Our cookiesDirective script can handle this though.

Get your google analytics code from Google.  Paste it into a text file, remove the <script> and </script> tags, and save it with the extension .js.  Upload the file to your website using your File Manager. You'll be able to reference that file in the following way http://www.yourdomain.co.uk/Portals/xxx/yourscript.js, where yourdomain.co.uk is your own domain name, xxx is your portal number (you can see that when you attempt to upload a file), and yourscript.js is the name of the file you just uploaded.

Log in to your site; place it in edit mode and visit the homepage, then delete your existing google analytics script from your site.  You will find this in a module at the foot of your page. Simply delete the module. Deleting it on the homepage will ensure it is removed from all your pages.

Now we need somewhere to paste our script. The Regulatory Statement module at the bottom of the page is perfect, since it appears on all pages of your site.

Hover your mouse over the inverted triangle on the far right - and on the submenu which appears select, settings. On the subsequent settings page, click the + icon next to Advanced Settings. You'll see textbox called Footer.  This where we will paste the script (note the subtle difference to the previous example, our wrapper function contains another line.)

Paste all the code between the start and finish tags, into the Footer text box.

<!-- Start cookiesDirective.js script-->
<script type="text/javascript">
    function cookiesDirectiveScriptWrapper(){
     cdScriptAppend('Google Script here','head');



    }
</script>
<script type="text/javascript" src="http://js.cookiesdirective.com/1.3.js"></script>
<script type="text/javascript">
    // The position of the disclosure ('top' or 'bottom')
    // Number of times to display disclosure. Enter 0 to show it forever!!!!
    // The URI of your privacy policy
    // A comma separated list of scripts which will create cookies

    cookiesDirective('top',0,'yourprivacypolicy.html','Google Analytics');
</script>
<!-- End cookiesDirective.js script -->

In the line starting cdScriptAppend, replace the text 'Google Script here',with the URI of the .js file you uploaded to your website in the previous step. The effect of this it to only add our Google script to our page once cookies have been accepted by our visitor. Also replace the section in the text which says yourprivacypolicy.html in the example above with the address of your privacy policy - you made a note of it previously. Click 'Update' towards the bottom of the page, to save your changes.  You're done.

Note. If this does not fire, and show a disclaimer once you've saved, then the script has not been added correctly. Make sure the functions are not on the same line as comments (prefixed wirth //), and make sure you have quotes around the the URI of you privacy policy, as in the examples above.