The full details are on http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/cookies.aspx but as I understand it we need a way to avoid setting any cookies on the OPAC until the user has been warned and consented. I intend to destroy the session and cookie in C4::Auth::get_template_and_user() just before it is sent back to the OPAC, as long as no cookie-using features are enabled; and to add a small notice to the OPAC login forms. I am marking this as critical because it means Koha should not be used in the UK (arguably the whole EU) in public until this bug is fixed. Koha admins should ensure that a cookie notification is included in their staff user agreements/policies, to cover the intranet interface. (You can also do that if your OPAC is not public, rather than apply this fix.) A patch, sponsored by software.coop, will be along shortly.
Created attachment 9775 [details] [review] bug 8155 - comply with UK Electronic Commerce (EC Directive) Regulations 2002 C4/Auth.pm: destroy the session and cookie if it is not needed installer/data/mysql/sysprefs.sql: change default for EnableOpacSearchHistory koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref: add note about this law koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt: add div#cookiewarning with consent request
Correcting assignment
oleonard has pointed out that I need to exempt the cart cookie and probably the KohaOpacLanguage cookie. Falling back while I code a new patch.
The responsible government agency has backed down at the last minute http://www.guardian.co.uk/technology/2012/may/26/cookies-law-changed-implied-consent so as long as libraries have a current privacy policy that mentions the cookies used by Koha (CGISESSID, KohaOpacLanguage, KohaOpacRecentSearches, bib_list... any others?), they should not be prosecuted for now. I still think we should avoid setting cookies until we need them, but with the imminent kohacon, I'm putting this onto a backburner.
lowering this bug to enhancement, as it's no more a CRI pb for UK
I wonder what the current status of this is? Since this has been filed we have added cookie documentation to the wiki and a coding guideline that new ones need to be documented: https://wiki.koha-community.org/wiki/Use_of_Cookies
I am undertaking enabling compliance with EU Cookie Legislation in Bug 27378. Given the age of this bug, the new bug may be considered a replacement.
*** This bug has been marked as a duplicate of bug 27378 ***