Cookies and the new European Union PECR Rules

I run several websites hosted in the UK all using Evo (1.0.6). On 29th May a new law comes into force that requires websites to provide explanations about cookies, and to obtain prior consent to their use if they are "non-essential" which is quite tightly defined by the UK Infomation Commisioner's Office.

Evo always places one session cookie with every site visitor. As far as I can see there is no purpose served by this cookie that comes under the ICO definition of essential. Therefore I need to be able to explain what this cookie does and why it needs to be there.

Is there anyone out there who can give me a simple definitive explanation of this cookie's purpose in life?

Just to be clear I am concernd here with visitors who do not need to log in in any way. The only remotely "interactive" thing some may do is fill in a contact form to be emailed to staff members of the commisioning organisation.

Nobody really knows what does and what doesn't comply. The guidelines are vague and while there are exemptions you could call on, that's very subjective and if the ICO would action on your site they could very well find a reason to deem you not complying.

The session cookie that is being set is essential for functioning of the site. Functioning of the server, if you will. It's default for session handling in PHP: http://justinmccormick.com/wp/programming/php-sessions-explained

Basically the session cookie makes sure there is a unique and secure way of identifying what data stored on the server matches the request, which could be a users' permissions on a site (anonymous users have a set of permissions, as well!). Really anything that PHP stores in the $_SESSION variable.


As far as I know, both Evo and Revo (out of the box) pretty much comply. I'm not a lawyer and there's lots of confusion on what is and what isn't strictly neccessary for a site to function so don't take this as legal advice, but I wouldn't worry about it too much.

As you touch on yourself, the moment you set a cookie yourself which is not essential (examples of essential are: storing a product in a users' cart, logging in etc) you could be in breach of the law. Also that includes analytics - they set cookies too. Tho as to be expected, they're quite vague on that too.. http://blog.silktide.com/2012/02/cookie-law-analytics-are-illegal-but-we-wont-prosecute-you-probably/

Thanks Mark. Not sure I'd agree the ICO guidlines are vague, although they are written in general terms. Having studied English law in a past life they are fairly meaningful to me, and I'd still take the view that the default MODx session cookie, based on the information you give, could fail to meet the criteria for essential, should the ICO ever become involved. Personally I wouldn't bet money on that happening, the sites are too low down in the food chain to interest the ICO.

However, I do have to persuade my clients that the sites will remain "legal" and they prefer certainties to probablilities. And to avoid nasty pop-ups and such like my preference would be to get rid of cookies altogether where possible.

To this end I have been trying out Zap's mod to index.php which I found on this thread https://forums.modx.com/thread/8229/modx-site-that-doesn-t-use-cookies#dis-post-48805 on a test site, and so far I have not run into many problems. Every public page on the test site is served correctly and contact forms work.

However the sites also have some private areas and this mod does appear to break webloginpe, but TBH I was half expecting this. In fact this is not a big issue as these private areas run in subdomains with their own MODx installs, so index.php in those installs can remain unmodified. We can deal with the consent issue easily as only registered users get access and consent can be built into the "sign-on" process.