Thread

The ExpressionEngine 2.5.0 release has been moved from late March so that we can incorporate a first party solution for the “Euro cookie” law in 2.5.0 instead of having two releases within a very short time frame.

For those unfamiliar with the “Euro cookie” law, here’s a brief summary of the situation and why its important that an official first party solution is available.

As part of the European Parliament’s Directive 2009/136/EC, storing information on a user’s computer (through cookies or other means) should require the informed consent of the users.  The member states of the European Union (EU) were supposed to implement laws in accordance with that directive by May 2011. Legislation, both its existence and its content, has varied among member states.  While much surrounding the legislation is murky, one thing that is clear is that ExpressionEngine needs to make it easy for our users to comply with regulations concerning cookies.  This is particularly time sensitive for our UK based users, where a fairly strict interpretation of the mandate will go into full effect May 26, 2012 (see the ICO’s section on cookies).

Thus 2.5.0 is being pushed out to allow the inclusion of a new Cookie Consent module.  The module will require consent before allowing any cookies to be set using ExpressionEngine’s native functions.  Login and registration will also be restricted to those who have granted consent for cookies.  Consent can be granted through the use of a link or through the inclusion of a form field on login and registration pages.  The module will include conditionals for user consent, providing maximum flexibility for designers, who are free to create a ‘cookie consent’ interface that complements their site.

In keeping with ExpressionEngine’s evolution as a platform, the module is ‘drop in’, relying on new hooks rather than being hard coded into the core code.  This means it will be easy for developers to take their own approach to the new regulations or simply integrate with existing third party options for cookie compliance if they so choose.

We are eager to get 2.5.0 into your hands so it pains us to delay our intended March release. Given all the options though, we concluded delaying versus beta releases, or multiple releases within a short time period was the approach that would serve the Community best.

Thanks for the update Robin - it’s great to see Ellislab doing this!

I presume this module can simply be used “out of the box” as well?

Hrm- I’m not sure, bluedreamer.  If you mean- just install it and it prevents the cookies from being set?  Then yes- as soon as it installs, no cookies can be set using EE’s set_cookie function in the functions class (unless permission is indicated).  Which all EE code (first and third party) should be using.

Of course- cookies could still be set by other code (google analytics, your own php not using the method, your own js cookie setting code, etc).  But it will shut down EE cookie setting. 

And expect a longer post on how to implement- implementing the EE module is super simple.  But we’ll want folks to understand they may well be doing other things on their sites that results in cookies being set.  Add servers, analytics, youtube/media….

But we want to make sure folks have the tools to make EE do what they want/need with regard to cookies.

Will there be hooks and/or an API for the Cookie Consent module? It’d be nice if cookie-generating add-ons can make use of the new module.

Yep- definitely new hooks.  We really wanted this module to work like any other third party module would (and thus allow third parties to take their own approaches to cookies if they so desire).  So we added hooks rather than hard coding new settings into core.

The obvious new hook is in functions->set_cookie().  There are a couple of other new ones as well- we wanted to throw an error if cookies were required and someone tried to login.  And then there’s the forums- we wanted folks to be able to keep the same ‘cookie consent’ interface site-wide, and that includes the forums.

So yep- expect new hooks to be included (and included in the dev preview).

And the module should be consistent w/existing third party add-ons without any changes- at least, as long as any cookies they’re setting use functions->set_cookie.  It stops basically anything coming in there via the hook.

Thanks Robin, so long as it gives us an easy way for allowing/disallowing EE cookies on the front end I couldn’t ask for more! Of course 3rd party cookies are another thing entirely 😊

Can we get an ETA as to when 2.5 will be released? I’ve been dreaming of this new text editor for weeks!

Sounds like you’ve definitely done the right thing here, Robin, especially as it means that EU persons will get the cookie controls at earliest possible date.

If I were producing for there at the moment I think what I’d most like to know is the interface to let me use EE’s setting to control those other possible cookies on a site.

How to access the state via php, but also Javascript, would think.

Best, and know you guys will let this go when it’s ready.

Clive

Hi Robin

This is fantastic news and another example of how Ellis Labs looks after it’s customers so well.

We’re currently developing an EE site for a UK public sector organisation, the cookie issue has been huge. I’ve just emailed the client project manager with a link to your blog post, it’s really validated their decision to follow my recommendation of using EE.

Hi Robin

this is really good news, as I have clients screaming for this now! Like Clive I’d like to know how we can determine the consent/not consented state for the current user from our templates - will there be a global variable?

Would love to be able to do this:

{if cookies_allowed}
 // insert google analytics tracking code etc 
{if:else}
 // show a consent required notice
{/if}

</code></pre>

Many thanks.

Good thinking on how to do it, Mark, as ever.

That pattern would cover anything at the JS/HTML level and also whatever needed touching via embedded PHP, and in an EE-natural way.

Presumably it’d be available early enough in the parse order to cover input as well as output stage embedded PHP, along with any other uses the Dev team imagines for it, like snippets our globals that could contain these.
.
Cheers,
Clive

In January, we were told:

ExpressionEngine 2.5 will ship 6-8 weeks after EE 2.4 ships. Yes, that’s two major releases fairly close together. We decided to take this approach because EE 2.5 will ship with a default Editor. We just code reviewed the Editor last week but haven’t had the chance to give it full testing or review. We don’t want to delay EE 2.4 but neither do we want you to have to wait any longer than necessary for the Editor. The solution is to give you EE 2.5 sooner rather than waiting out ExpressionEngine’s full twelve week release cycle.

... and now:

Given all the options though, we concluded delaying versus beta releases, or multiple releases within a short time period was the approach that would serve the Community best.

The community would be best served if we could trust and make plans based on your commitments with regards to bug fixes and upcoming features.

Smart notifications…  I really should turn them off!

AdamSmith  I can’t give a firm ETA.  As PressEnter Creative points out, we moved it back once.  I don’t want to risk moving it back again.  I will say it’s in the testing/polishing stage.  But we want the developer preview to have it’s usual 2 weeks of tire kicking.  So- 2 weeks after we turn it over to them.

As to the ‘how’- on the frontend it’s a really simple module- will parse like any other:

{exp:cookie_consent:message}

  {if cookies_allowed == 'yes'}
   Thanks for allowing cookies!

   Delete cookies: {clear_ee_cookies_link}
  {if:else}
   Please allow cookies:

   {cookies_allowed_link}
  {/if}
 
 {/exp:cookie_consent:message}

I’m pretty sure that’s final form.  Though I considered making it a simple conditional for other reasons.  That will parse in the member templates- including the login/register templates in the forum.  And then we added the ability to add new forum theme pages and parse them- so you can have a cookie_consent header in the forum or what have you. 

It’s not going to prevent cookies being set outside of EE- but education should take care of that.  For example- nest your google analytics inside the module conditional.  Which- makes me shudder with regard to what that would do to your stats, but it would work. 

Between the tool, the hooks and education, I think you’ll be able to come up with solutions you’re satisfied with.  I’m not sure anyone is going to be thrilled about the law as currently written.  But you’ll have the tools to comply.  (And on the plus side- I saw some pretty nice fees being charged for cookie audits and site updates in response to this law, so there’s likely the potential to pull in some clients by having a well planned solution for them.)

And Nick- we really didn’t like pushing the date back.  We just liked the alternatives even less.  But it wasn’t an easy decision to make.

As you note, Robin, the EU Privacy and Communications Directive was passed in 2009 and has been a hot topic of discussion for at least a year. How is it that you overlooked the need to come up with measures to comply with this law until now?

Brendon, I wonder how up-to-date you are on Chinese communications law, or Russian, or South African, or indeed Slovenian? Or how likely the roof is going to fall in tomorrow in the US, where amazing incantations are recited in quest for security on the internet or on anything else?

I know you live in Korea, where I did, even teaching graduate school, probably before you were born. And Robin lives in an intricate world of web software, where decisions have to be taken about the timeliness and authentic importance of various influences, or nothing gets done at all.

Please try to be thoughtful about who to and what about you complain. On Twitter, we can just nod and go on to the next. Here, it’s an embarrassment as if I wrote to the Chosun Ilbo on your legal activities, whatever the sensibleness of the complaint.

Ellis is not perfect, and it is focused for my thoughts a bit too internally, yes. And it continues to grow.

That, I believe, is what is important, most important, and I also believe we should support them in that growing. It’s the way one core of this conversation has gone, and I invite you to move with it.

Regards,
Clive