"If there is an exemption for cookies from Google"

I don't think its an actual "exemption", merely a statement that because Google isn't an EU company it doesn't have to comply with the legislation.

But if *you* are a EU company, then you do -- and surely nobody with a grain of common sense would agree that asking a third party to perform something on your behalf exempts you from your legal obligations. "It wasn't me that run you over on the pedestrian crossing, it was my car" isn't going to be accepted by any court. Similarly, if the code that *calls* some third party code (whether google or otherwise) is on your site, you *ought* to be accepting legal responsibility for what it does and making sure that what it does is legal. Which, quite possibly, means not using it if you cannot be certain.

Equally, I'd disagree that google is not subject to EU jurisdiction. The EU certainly seems to think it is. So why the ICO should think otherwise only goes to question the competence of the ICO.

Its OK to accept cheques, but ...

Why are there still businesses belonging firmly the 19th century that insist on cheque as the *only* possible method of remote payment?

Cheques are absolutely the most user-hostile payment method and should only be used by those over 75 that cannot get their head round other methods. And they should certainly not be involuntarily forced on people that are perfectly capable of using more convenient payment methods.

If you can accept cheques, then you can accept bank transfer and standing orders -- and can probably do it faster and cheaper than cheques.

Its high time that it became a legal requirement for businesses of all sizes to be able to accept bank transfer.

Re "and probably should, in certain scenarios."

In those certain scenarios, appropriate officials already can and do ask and get permission to monitor certain people. This doesn't require a change in the law. It is already legal and it is already happening.

The proposed change is that monitoring should not be restricted to "certain scenarios" but should allow monitoring even without the slightest suspicion that a person has or even might have committed an offence.

No change in the law is needed, except possibly to tighten up the rules and ensure that permission to monitor is only granted when a judge has examined the evidence for suspicion and agreed that there is a strong probability of guilt.

Google Analytics is NOT a first party

"we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action"

So -- if you are Google -- then you can use Google Analytics. Perhaps -- because even then, Google analytics is a completely separate domain to google.com so technically its a third party even when visiting one of google's own pages.

But -- if you are *not* Google -- then its definitely a third party, so not exempt from being "prioritised" so you'd better stop doing it if ICO ever gets round to working out what a third party cookie really is.

Plants can talk actual words

I know that for certain because I once overheard a theatre usher mentioning to the manager that tonights comedian was getting a lot of heckling. "You don't need to worry about that", the manager said, "its because there's a plant in the audience".

"Abuse of a dominant position"

Why is google allowed to get away with things like this?

This sort of thing *should* come fairly and squarely under Abuse of Dominant Position legislation.

However, I'm not sure that it's the supplier that should decide how customers should pay. The *customer* should always have a choice of payments and be able to use whichever is most convenient. There's nothing worse than the idiot company that decides the only acceptable payment method is obsolete, user-hostile cheques.

So, how about :

* A customer must have a choice of at least *three* reasonable and appropriate payment methods.

* One of them must be bank transfer, which must be free to the customer.

* The supplier may nominate one or more *additional* payment methods

* Where a third party (eg google or ebay) provides a significant contribution to the service, the third party may nominate one or more *additional* payment methods.

But above all else, neither the supplier or the third party should be allowed to influence which of the above the customer chooses to make payment through.

Of course it is confusing,

Terms and conditions are *meant* to be confusing.

If they were understandable, and anybody bothered to read them, nobody would accept them.

Re "regs already exist for brightness and clarity".

Regulations and enforcement are, sadly, two different things.

We already have a regulation which says (probably in more technical terms in the official version) that dipped headlights should not dazzle a person whose eyes are 3 feet from the ground. Yet many many times I've seen the bright and sharp silhouette of my head projected against the sun visor from the dipped headlights of the car behind. That clearly wouldn't be happening if the anti dazzle regulation had been enforced. But I've never heard of a single instance where a driver has been prosecuted for doing it.

We should be installing headlight sensors on stretches of straight road.

"Websites ... offer you free content and services because they are supported by advertising"

One major flaw in that argument is that many of the sites where they track visitors are *business* sites whose primary source of income ought to be the actual products and services they are selling or providing, not the sale of tracking information or advertising.

If tracking and displaying of adverts were restricted to sites where the owner has no other income whatsoever there would be less of a problem.

Re "They still bundle the toolbar with Firefox"

The toolbar that's bundled with Firefox is a *universal* search toolbar. Google is its default, but it is preconfigured to work with a number of other search sites (including yahoo) and you can add others with an addon.

That's one of the reasons why foisting unwanted yahoo toolbars on people is unlikely to have achieved more than aggravation. Anybody who wants yahoo as their search only has to click the *existing* dropdown and configure it there. Anybody who didn't want yahoo as their search engine is likely to keep on using the original firefox toolbar (and, if they don't know how to remove it, moaning about the space the unwanted toolbar is using).

Re "But I was hoping to go beyond"

I've never been there myself, but I'm told that if you go beyond infinity you might never look back.

"if they think a review is fake, say so"

I can see it now.

Reviewer: A magnificent place, fantastic staff, I enjoyed every minute of it.

Hotelier: You couldn't possibly have been staying at *our* hotel then.

"ASA are just folding to pressure from a moaning nonce."

I disagree. The ASA is, for once, doing what the ASA *should* be doing.

A shop doesn't have to publish customer reviews at all, but if it does then the reviews have to be genuine and representative of the true range of opinions of buyers.

"planning to sell off Comet for just £2"

Shouldn't that be £1.99 ?

But I shudder to think how much they will ask for the three year warranty that the salesman will try to insist on you having along with it.

"broadcast station or network"

A web site -- any network, even if it has only one user -- is part of a network.

If the web site has two or more users then that probably makes it a *broadcast* network..

"people were slightly more likely to leave praise ..."

Or more likely, the page hosts were very much "more than just slightly" likely to DELETE complaints than praise.

And on the facebook site I just looked at (no names, no pack drill) I notice that most of the people who have left positive comments are other members of the staff -- though you wouldn't know that as an ordinary user, unless you happened to know their names because they don't declare themselves as staff.

"paid to ebay directly who old them prior to both parties agreeing release of funds to the seller"

That option already exists, and has done for many years.

It's called escrow, and it costs an arm and a leg so very few sellers operate it. But realistically any such service is going to cost an arm and a leg. You can automate the payment mechanism, but it inherently doubles the cost of the transaction (because there are always two payments not just one). Then dealing with the problems that arise in a dispute needs an army of real people who don't work for peanuts.

"and a tendency to push problems to other groups"

That's exactly what BT always did, so splitting it up has probably had little effect.

You report a problem and an engineer comes to the house but "Its an outside fault mate" and the engineer isn't qualified to work outdoors at 15 degrees C

So you have to wait while somebody with a coat is sent from miles away. Who eventually arrives, decides the fault is inside but he can't come in because he's wearing a coat and not qualified to work inside.

Next day the original engineer comes back, does nothing much, goes away again. Two days later the line accidentally starts working again when somebody rebooted the exchange.

OK, I made all this up. But its based on numerous true stories nevertheless.

ps -- *no* joke alert, because its BT and we all know BT is a joke without having to be told.

"so the FCC deserves credit"

It deserves *some* credit, maybe, but not too much. Because its only half of the *sensible* answer.

Yes, a notice is better than nothing, but far far better would be for the FCC to require operators to cease those dishonest "our business model is based on fleecing the customer" tariffs.

That could be done at a stroke by insisting that the excess can never be charged at more than pro-rata (so if you use 10% more than estimated, you pay at most 10% more than you estimated).

Any fixed costs such as line rental and administration have to come out before performing that pro-rata calculation, even if they were not separately disclosed.

Less adverts, more visibility

With a 5 minute advert break, you can guarantee that most of the viewers will not be watching beyond the tenth second.

Cut down the breaks to a minute, and most people will stick around.

What's worth more to advertisers? Five minutes of adverts that will not be seen beyond the tenth second, or one minute of adverts that will probably be seen by most?

Chances are that the advertisers wouldn't have to pay 5 times as much for their adverts either. If all the faces that appear were paid 20% of what they presently get, most of them would *still* be overpaid relative to their true contribution to the world at large.

Some intelligence at last

Hopefully, it will become infectious and companies worldwide will start dropping unnecessary third-party-hosted material from their sites.

Browsers should be designed work round this sort of abuse.

Every browser should do several things, and it should be a legal requirement that they do so by default ...

a) By default, cookies should not never be supplied to third party sites.

b) If in a specific case the user chooses to allow a cookie to be supplied to a third party site, then that cookie should be unique depending on the first party site. So, if I'm visiting bbc,co.uk and there is a FB image in it, FB can at the most tell which other bbc.co.uk pages I've visited but if I subsequently visit itv.co.uk and that too has FB images in it, FB should not be able to tell that I am the same person.

c) Ideally, the browser should deliver different cookies depending on whether a person is logged in to the site.

Firefox can probably do most of the above with appropriate extensions, but setting them up is beyond the ability of many users and needs to be the default behaviour in all browsers.

If a new language is really needed, then ...

* it needs to be developed and controlled by an independent standards body, eg W3C

* it needs to be specifically designed to ensure that browser extensions can continue to detect and block any spyware, unwanted animations and other nuisances that unenlightened webmasters insist on using to clutter their sites.

* it needs to be easily supported unencumbered in all browsers

Google's aims are going to be the complete opposite of both of the above.

Google's slogan these days is fast becoming "Mainly do evil". Google constantly watches us, but nobody watches the watchers.

If you really can't do it NOW ...

... then at least make it retrospective -- ie, in December all auto-renew "service-only" contracts no matter when signed immediately become terminable without penalty and hardware contracts become immediately terminable if and when they have been in force for a year.

Ofcom should have seen these contracts were anti-competitive the day they came in and could and should have put a stop there and then to them. They cannot claim not to have complaints. That they have taken such an unreasonably long time to put a stop to them is nothing more than a tribute to Ofcom's incompetence.

That they have deliberately delayed implementing the change is evidence of just one thing -- that Ofcom listens too strongly to the vested interests of the industry and ignores the general public that they were theoretically set up to protect.

Re "What's wrong with DNT?"

There's nothing wrong with DNT but its not enough on its own.

Firstly, recognising and obeying DNT is not a legal requirement -- so to a spyware company intending to steal your personal data, its about the equivalent of putting a sign on your front door "please do not burgle here".

There's never going to be a total international acceptance of any privacy legislation, even if the more enlightened countries can be persuaded to adopt some. And those countries that are most likely to adopt any privacy legislation will write it with the primary intention of allowing companies to *invade* privacy rather than to ensure it. Just like they already did with the "you can spam" act.

So when DNT becomes widespread, will the worst sites unnecessarily redirect you to a "you have DNT so you can't come in" page -- just like some of them already do if you try to visit with javascript disabled?

Next, DNT is either on or off. OK, that's a start -- but that's a bit like saying everybody must choose whether or not to have sex. If they choose NO, then they can have sex with nobody whatsoever. If they choose yes, they must be willing have sex with everybody else who wants it. I'm guessing, but most people could not comfortably choose either of those two options.

Equally, there's a difference between tracking for the efficient operation of the site and tracking to obtain saleable data. I don't mind if a site knows I've visited the site before or even what pages I've seen there, but it absolutely should *not* be possible for some other site to know that I've been there, or to any other site for that matter.

Clearly, there's an argument for something in between. At the very least, a middle ground version of DNT that says "OK, but keep it totally confidential" when visiting the first party site, but gives an "absolutely not" when accessing third party sites whose content has been embedded in the page.

My feeling though is that an enhanced DNT isn't going to work -- if only because the worst of the data thieves would simply ignore it. So it is more important to work on technical standards that would require the browser not to deliver information in a form that allows third party tracking.

For example -- I visit abc.com and it uses some API from google. If google requests my cookie, then it should get one, but it should not be the same cookie that it gets when I visit google direct, so it should not be able to track me through any google log in. Then if I subsequently visit def.com and that also uses some API from google, google should get yet another cookie that prevents it knowing that I've visited abc.com. So, separate cookies for each third party site depending on where it is being visited from.

That's a bit simplistic and there are other spyware problems (eg Etag) that need to be similarly defeated. If there is no better way, then separately cache google's images for every site you visit it from.

Whatever is needed, the solution which would work best is the one which is controlled within the browser. It simply doesn't give trackable data to the third party site -- and it would be best for most people if that is what happened by default unless they choose to allow otherwise.

Maybe there's a part to be played by my ISP, which could be required to falsify my IP address in packets passed to third party sites. Or maybe all traffic, if there's no easy way to identify third party traffic.

But ... and here's where the W3C as a standards body could sensibly step in to the picture ... the standards should stipulate that users and their browsers are entitled to inhibit tracking and should require all sites to continue to work with proper third party anonymity (as well as with flash, javascript and similar all disabled in situations where there is no absolute functional need for them).

Ebay's search is better than most.

I've used it for years. It works and it doesn't throw up stupid and totally irrelevant results like some others.

With far too many sites, if you search for paper tiger, you get *everything* made of paper and everything about tigers. The first are *sometimes* more relevant than others, but the relevance breaks down as soon as you try to sort them in a sensible order, like price ascending. Stupid search -- if I wanted to search for *anything* made of paper, why would I have added the word tiger ???

I searched tesco for "drain cleaner" and it gave me nothing whatsoever of relevance and a whole lot of total garbage -- including RICE. Apparently it can't tell the difference between grains and drains.

No doubt they will want to patent it ...

... but there's a little matter of CD-RW as prior art.

OK, so that picture had a little more contrast than the average rewritable CD. But the *mechanism* is exactly the same.

You can get the same with burglar alarms

The one I was looking at yesterday says it can be set and unset by SMS.

Naturally, there is a user password which has to be part of the SMS. But it is just a simple user-defined string of digits and it is the same string of digits every time. So anybody who can capture SMS (which must include some of the staff at the telcos operating the sending and receiving devices, and possibly others with the right eavesdropping equipment) knows exactly how to disable your alarm.

Probably not a sensible feature to enable until somebody comes up with a reliable encrypted SMS replacement.

Simple answer ... change the law ???

Just because something is thought to be illegal under *present* law does not mean that it will still be illegal next month, next year or at some other future date.

OK, so changing the law isn't quite as simple as somebody in Ofcom or elsewhere deciding that the law needs to be changed, and nor should it be.

Nevertheless, if the conclusion is that the public would benefit from something that is presently illegal and enough MPs can be convinced of the merits of the change, then such a change is surely possible.