Cookies: a legacy of controversy

Abstract

Cookies are a legacy of the early commercial web. Developed and deployed by Netscape in 1994, debated by developers since 1995, and subject to political scrutiny since 1998, cookies have grown in visibility as they have become more mundane. While the United States was able to push for a consumer framing supported by self-regulation, it rested on effective notice and choice. As the European Union sought to establish a successful Single Market, consent in European data protection law grew in use, prominence, and strength over iterations. Although cookies were chosen as a privacy preserving mechanism for establishing state in web based interactions, they became a lightning rod for privacy concerns that have never been resolved. This article details the history of cookies as an exploration of the normative cultural constructions of a simple, unremarkable, entrenched technology using www-talk archives, IETF working group archives, browser versions, and trade literature, as well as U.S., UK, and EU government reports, caselaw, and legislative history.