Say No To Cookies From Strangers

Mothers' advice from 50 years ago reappears, notes Ajit Balakrishnan.

I can't help remembering my dear long-gone mother each time I get adventurous and visit a Web site which I have never been to. Up comes a pop-up which thrusts itself in my face and screams loudly: 'Click yes to say you will accept cookies from us!' And my intuitive response is to click the browser shut as my mother's diktat flashes in my memory.

How did the word 'cookies', which through history has meant a small baked sweet-tasting snack, suddenly become a key element of the Internet world, the subject of much legislation and law-making, and an item of combat between proponents of 'privacy' and pursuers of website revenues?

A wee bit of research tells us that the sweet little snack originated in the seventh century in Persia and found its way to Europe when the Ottoman Empire extended its conquests there. I believe that by the 14th century it had gained immense popularity among both the common man and royalty there.

How come this sweet-tasting snack came to have such mysterious overtones? For this, we have to look past the ordinary little cookie and cast an eye on the fortune cookie.

The fortune cookie also was a sweet-tasting look-alike of our ancient Persian-origin cookie, but with a difference: Crack it open and you will get a piece of paper with cheerful messages like, 'A smile is your passport into the hearts of others' or 'Today, go out and create the peacefulness you desire', or even 'If you have something good in your life, don't let it go'.

I understand that the fortune cookie originated in California in the 19th century and was mainly created and popularised by Chinese and Japanese immigrants there.

And I understand that a fortune cookie was something you eagerly looked forward to whenever you bought Chinese food there.

Wikipedia tells us that even today one single manufacturer, Wonton Food Inc in Brooklyn, New York, makes over 4.5 million fortune cookies per day.

We can see that the perception of a cookie as merely a sweet snack had already subtly changed to a sweet and tempting snack with a secret message inside it.

But how did the little cookie make the leap from there to a mysterious tool in something as complicated as computer science?

That apparently was the work of the American computer programmer Lou Montulli, who in 1992, while at the University of Kansas and later Netscape, was busy creating the first Web browser.

He figured out that keeping user data in the user's Web browser was a better way than storing it, for example, on the e-commerce site which is trying to sell things to a user.

He called it a 'magic cookie', perhaps reflecting the anticipation with which people opened their fortune cookies.

How did this innocent creature, the Web Cookie, then become the bone of contention in the battle for 'privacy', the new slogan that has acquired an ideological connotation like phrases such as 'human rights', 'freedom from oppression', and 'democracy'?

The uproar started as people realised that a cookie with a little piece of text stored on your Web browser can identify what sites you have visited, to which sites you go too often, or even, under some circumstances, the details of the credit card that you used to shop at an e-commerce site.

The first uproar this realisation evoked was from Europe, much to everybody's surprise till somebody pointed out that perhaps such data recording evoked among Europeans memories of the 1930s system in Nazi Germany, where house-to-house censuses were done to identify the Jewish people and send them off to concentration camps (for an in-depth look: Hannah Bloch-Wehba's Confronting Totalitarianism at Home: The Roots of European Privacy Protections: https://brooklynworks.brooklaw.edu/bjil/vol40/iss3/1).

This disquiet soon led to the enactment of a new law, the European General Data Protection Regulation (GDPR), which became enforceable in May 2018.

The GDPR legislation requires all companies, whether European or from any other country in the world, to specifically ask the Web user's permission before using a Web cookie to store information about that user.

This law also provides for fines to be imposed on those Web sites which take user information without his explicit permission. This is what makes every Web site you visit ask your approval about storing their cookie on your browser.

The magnitude of the fines imposed under the GDPR is astounding: $823 million on Amazon, $249 million on WhatsApp, $9 million on Vodafone... to name just a few (the companies concerned are disputing these charges in court).

The United States, under President Joe Biden, is also said to be considering data privacy regulations along the lines of the European one.

Isn't it charming how our sweet little cookie has made its transition from a childhood endearment to something to be feared?

Or is it that my mother was right -- we have to be careful about anyone who offers you a sweet cookie?

Ajit Balakrishnan (ajitb@rediffmail.com), founder and CEO, Rediff.com, is an Internet entrepreneur.