25

A lot of you are probably aware of the new EU privacy law, but for those who are not, it basically means no site operated by a company resident in the EU can set cookies classed as 'non-essential to the operation of the website' on a visitors machine unless given express permission to do so.

So, the question becomes how to best deal with this?

Browsers obviously have the ability to block cookies from a specific website built in to them. My question is, is there a way of doing something similar using JS or PHP?

i.e. intercept any cookies that might be trying to be set (including 3rd party cookies like Analytics, or Facebook), and block them unless the user has given consent.

It's obviously possible to delete all cookies once they have been set, but although this amounts to the same thing as not allowing them to be set in the first place, I'm guessing that it's not good enough in this case because it doesn't adhere to the letter of the law.

Ideas?

3
  • 1
    You can't. It's as simple as that. Your Analytics cookies, for example, will probably come from another host (e.g. analytics.google.com) which you don't control. Regarding your own cookies, you can unset them again after setting them, but that ... doesn't really make any sense -- unless you're talking about third-party software running on your host.
    – caw
    Sep 21, 2016 at 2:41
  • Statement EU can set cookies classed as 'non-essential to the operation of the website' is not correct. GDPR directive: first is technologically neutral, and second it has scope only to personal data of natural persons. Therefore, if technology named as "cookies" is used to process data from which a natural person could be identified, then for this particular usage of "cookies" consent is mandatory. For example, If we use "cookies" to track user session, but server does not contain data from which could be identified natural person behind the user, then consent is not required.
    – ggghhhjjj
    May 19, 2019 at 8:10
  • JS Solution: stackoverflow.com/a/33064438/2068362 Nov 1, 2019 at 0:09

5 Answers 5

18

I'm pretty interested in this answer too. I've accomplished what I need to accomplish in PHP, but the JavaScript component still eludes me.

Here's how I'm doing it in PHP:

$dirty = false;
foreach(headers_list() as $header) {
    if($dirty) continue; // I already know it needs to be cleaned
    if(preg_match('/Set-Cookie/',$header)) $dirty = true;
}
if($dirty) {
    $phpversion = explode('.',phpversion());
    if($phpversion[1] >= 3) {
        header_remove('Set-Cookie'); // php 5.3
    } else {
        header('Set-Cookie:'); // php 5.2
    }        
}

Then I have some additional code that turns this off when the user accepts cookies.

The problem is that there are third party plugins being used in my site that manipulate cookies via javascript and short of scanning through them to determine which ones access document.cookie - they can still set cookies.

It would be convenient if they all used the same framework, so I might be able to override a setCookie function - but they don't.

It would be nice if I could just delete or disable document.cookie so it becomes inaccessible...

EDIT: It is possible to prevent javascript access to get or set cookies.

document.__defineGetter__("cookie", function() { return '';} );
document.__defineSetter__("cookie", function() {} );

EDIT 2: For this to work in IE:

if(!document.__defineGetter__) {
    Object.defineProperty(document, 'cookie', {
        get: function(){return ''},
        set: function(){return true},
    });
} else {
    document.__defineGetter__("cookie", function() { return '';} );
    document.__defineSetter__("cookie", function() {} );
}
2
  • Is there a way to block only specific cookies via JavaScript? Jan 20, 2021 at 12:46
  • You would have to move the native cookie function to another function name and then rewrite the cookie function to examine the contents before either rejecting the cookie or sending it to the new cookie function. I'm not even sure if moving the native function elsewhere would or could work...
    – Michael
    Jan 22, 2021 at 7:47
11

I adapted Michaels codes from here to come up with this.

Basically it uses the defineGetter and defineSetter methods to set all the cookies on the page and then remove the user specified ones, this role could of course also be reversed if this is what you are aiming for.

I have tested this with third party cookies such as Google Analytics and it appears to work well (excluding the __utmb cookie means I am no longer picked up in Google Analytics), maybe you could use this and adapt it to your specific needs.

I've included the part about if a cookies name is not __utmb for your reference, although you could easily take these values from an array and loop through these that way.

Basically this function will include all cookies except those specified in the part that states if( cookie_name.trim() != '__utmb' ) { all_cookies = all_cookies + cookies[i] + ";"; }

You could add to this using OR or AND filters or pull from an array, database, user input or whatever you like to exclude specific ones (useful for determining between essential and non-essential cookies).

function deleteSpecificCookies() {

var cookies = document.cookie.split(";");
var all_cookies = '';

    for (var i = 0; i < cookies.length; i++) {

        var cookie_name  = cookies[i].split("=")[0];
        var cookie_value = cookies[i].split("=")[1];

        if( cookie_name.trim() != '__utmb' ) { all_cookies = all_cookies + cookies[i] + ";"; }


    }

if(!document.__defineGetter__) {

    Object.defineProperty(document, 'cookie', {
        get: function(){return all_cookies; },
        set: function(){return true},
    });

} else {

    document.__defineGetter__("cookie", function() { return all_cookies; } );
    document.__defineSetter__("cookie", function() { return true; } );

}

}
2
  • 1
    How did you test whether third-party cookies such as GA were blocked? I don't seem to be able to tell apart only with GA debug.
    – nunop
    May 2, 2018 at 15:48
  • document.cookie
    – Juan Vilar
    Sep 25, 2020 at 23:27
3

A little bit old but I think you deserve a answer that works:

Step 1: Don't execute the third party script code.

Step 2: Show the cookie banner.

Step 3: Wait until user accepts, now you can execute the third party script code..

Worked for me.

2

You can not disable it completely but you can override the default setting with .htaccess

Try

 SetEnv session.use_cookies='0';

If it is optional for some users don't use .htaccess

if(!$isAuth)
{
    ini_set('session.use_cookies', '0');
}
6
  • 1
    hadn't considered .htaccess - however, if I'm right: 1. this will apply to every single user & 2: there's no way of then allowing cookies if permission is given?
    – freestate
    Apr 24, 2012 at 21:58
  • you are correct .. i can update the answer to include optional permission
    – Baba
    Apr 24, 2012 at 22:00
  • interesting approach... would this stop the 3rd party cookies (i.e. google analytics) from being set too?
    – freestate
    Apr 24, 2012 at 22:03
  • 1
    This method only stops session cookies, and not other cookies (including 3rd party cookies) or javascript cookies (including 3rd party javascript cookies).
    – Michael
    Dec 14, 2013 at 23:45
  • "This method only stops session cookies" - this method only stops the built-in session handler from setting a cookie, it doesn't stop "session cookies" (or any other cookies). Code can still call setcookie() to set a session cookie. Also, calling SetEnv in .htaccess to set an environment variable called session.use_cookies has nothing to do with PHP's session.use_cookies config option.
    – DocRoot
    Jun 19, 2018 at 22:09
-5

How about not paying attention to hoaxes?

Aside from the fact that this is old news, the text clearly says that it only applies to cookies that are not essential to the site's function. Meaning session cookies, a shopping basket, or anything that is directly related to making the site work is perfectly fine. Anything else (tracking, stats, etc.) are "not allowed" without permission.

3
  • It is not your responsibility to stop Google's (or anyone else's but your own) cookies from being set. Apr 24, 2012 at 22:15
  • 12
    But that's the exact point - in the EU it now is, and the law will start to be enforced on 25th May this year. Any site that CHOOSES to host 3rd party cookies is responsible for explaining to the user what they do, and giving them the option to block these cookies. Binning Analytics etc. is obviously not a feasible option, so I'm looking for some other technique
    – freestate
    Apr 25, 2012 at 7:36
  • 2
    It is your responsibility.
    – Juan Vilar
    Sep 25, 2020 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.