Barclays web analytics using cookies?

Associate
Joined
30 Aug 2009
Posts
467
Here is the javascript from the bottom of the Barclays Online Banking website.

What I would like to know is if it seems to be setting a cookie?

I'd like to know this as I am planning on reporting Barclays to the ICO if Barclays don't comply with cookie legislation as of the 26th May this year.
The reason that I want to take that action is the following thread over at the Ghostery plugin discussion forum: here

Code:
var gDomain="statse.webtrendslive.com";var gDcsId="dcssxcr8i00000stlemt7jpvp_8c9t";var gFpc="WT_FPC";var gConvert=true;var gFpcDom=".barclays.co.uk";if((typeof(gConvert)!="undefined")&&gConvert&&(document.cookie.indexOf(gFpc+"=")==-1)&&(document.cookie.indexOf("WTLOPTOUT=")==-1)){document.write("<SCRIPT TYPE='text/javascript' SRC='http"+(window.location.protocol.indexOf("https:")==0?"s":"")+"://"+gDomain+"/"+gDcsId+"/wtid.js'></SCRIPT>")};
Code:
var gService=true;var gTimeZone=0;function dcsCookie(){if(typeof(dcsOther)=="function"){dcsOther()}else{if(typeof(dcsPlugin)=="function"){dcsPlugin()}else{if(typeof(dcsFPC)=="function"){dcsFPC(gTimeZone)}}}}function dcsGetCookie(b){var d=document.cookie.indexOf(b+"=");if(d!=-1){var c=d+b.length+1;var a=document.cookie.indexOf(";",c);if(a==-1){a=document.cookie.length}return unescape(document.cookie.substring(c,a))}return null}function dcsGetCrumb(d,c){var b=dcsGetCookie(d).split(":");for(var e=0;e<b.length;e++){var a=b[e].split("=");if(c==a[0]){return a[1]}}return null}function dcsGetIdCrumb(c,b){var e=dcsGetCookie(c);var f=e.substring(0,e.indexOf(":lv="));var a=f.split("=");for(var d=0;d<a.length;d++){if(b==a[0]){return a[1]}}return null}function dcsFPC(g){if(typeof(g)=="undefined"){return}if(document.cookie.indexOf("WTLOPTOUT=")!=-1){return}var a=gFpc;var l=new Date();var j=(l.getTimezoneOffset()*60000)+(g*3600000);l.setTime(l.getTime()+j);var e=new Date(l.getTime()+315360000000);var k=new Date(l.getTime());WT.co_f=WT.vt_sid=WT.vt_f=WT.vt_f_a=WT.vt_f_s=WT.vt_f_d=WT.vt_f_tlh=WT.vt_f_tlv="";if(document.cookie.indexOf(a+"=")==-1){if((typeof(gWtId)!="undefined")&&(gWtId!="")){WT.co_f=gWtId}else{if((typeof(gTempWtId)!="undefined")&&(gTempWtId!="")){WT.co_f=gTempWtId;WT.vt_f="1"}else{WT.co_f="2";var m=l.getTime().toString();for(var h=2;h<=(32-m.length);h++){WT.co_f+=Math.floor(Math.random()*16).toString(16)}WT.co_f+=m;WT.vt_f="1"}}if(typeof(gWtAccountRollup)=="undefined"){WT.vt_f_a="1"}WT.vt_f_s=WT.vt_f_d="1";WT.vt_f_tlh=WT.vt_f_tlv="0"}else{var b=dcsGetIdCrumb(a,"id");var d=parseInt(dcsGetCrumb(a,"lv"));var n=parseInt(dcsGetCrumb(a,"ss"));if((b==null)||(b=="null")||isNaN(d)||isNaN(n)){return}WT.co_f=b;var f=new Date(d);WT.vt_f_tlh=Math.floor((f.getTime()-j)/1000);k.setTime(n);if((l.getTime()>(f.getTime()+1800000))||(l.getTime()>(k.getTime()+28800000))){WT.vt_f_tlv=Math.floor((k.getTime()-j)/1000);k.setTime(l.getTime());WT.vt_f_s="1"}if((l.getDay()!=f.getDay())||(l.getMonth()!=f.getMonth())||(l.getYear()!=f.getYear())){WT.vt_f_d="1"}}WT.co_f=escape(WT.co_f);WT.vt_sid=WT.co_f+"."+(k.getTime()-j);var c="; expires="+e.toGMTString();document.cookie=a+"=id="+WT.co_f+":lv="+l.getTime().toString()+":ss="+k.getTime().toString()+c+"; path=/"+(((typeof(gFpcDom)!="undefined")&&(gFpcDom!=""))?("; domain="+gFpcDom):(""));if(document.cookie.indexOf(a+"=")==-1){WT.co_f=WT.vt_sid=WT.vt_f_s=WT.vt_f_d=WT.vt_f_tlh=WT.vt_f_tlv="";WT.vt_f=WT.vt_f_a="2"}}function dcsMultiTrack(){if(arguments.length%2==0){for(var b=0;b<arguments.length;b+=2){if(arguments[b].indexOf("WT.")==0){WT[arguments[b].substring(3)]=arguments[b+1]}else{if(arguments[b].indexOf("DCS.")==0){DCS[arguments[b].substring(4)]=arguments[b+1]}else{if(arguments[b].indexOf("DCSext.")==0){DCSext[arguments[b].substring(7)]=arguments[b+1]}}}}var a=new Date();DCS.dcsdat=a.getTime();dcsFunc("dcsCookie");dcsTag()}}function dcsAdv(){dcsFunc("dcsET");dcsFunc("dcsCookie");dcsFunc("dcsAdSearch");dcsFunc("dcsTP")}var gImages=new Array;var gIndex=0;var DCS=new Object();if(typeof(WT)=="undefined"){var WT=new Object()}var DCSext=new Object();var gQP=new Array();var gI18n=false;if(window.RegExp){var RE={"%09":/\t/g,"%20":/ /g,"%23":/\#/g,"%26":/\&/g,"%2B":/\+/g,"%3F":/\?/g,"%5C":/\\/g,"%22":/\"/g,"%7F":/\x7F/g,"%A0":/\xA0/g};var I18NRE={"%25":/\%/g}}function dcsVar(){var b=new Date();WT.tz=b.getTimezoneOffset()/60*-1;if(WT.tz==0){WT.tz="0"}WT.bh=b.getHours();WT.ul=navigator.appName=="Netscape"?navigator.language:navigator.userLanguage;if(typeof(screen)=="object"){WT.cd=navigator.appName=="Netscape"?screen.pixelDepth:screen.colorDepth;WT.sr=screen.width+"x"+screen.height}if(typeof(navigator.javaEnabled())=="boolean"){WT.jo=navigator.javaEnabled()?"Yes":"No"}if(document.title){WT.ti=gI18n?dcsEscape(dcsEncode(document.title),I18NRE):document.title}WT.js="Yes";WT.jv=dcsJV();if(document.body&&document.body.addBehavior){document.body.addBehavior("#default#clientCaps");WT.ct=document.body.connectionType||"unknown";document.body.addBehavior("#default#homePage");WT.hp=document.body.isHomePage(location.href)?"1":"0"}else{WT.ct="unknown"}if(parseInt(navigator.appVersion)>3){if((navigator.appName=="Microsoft Internet Explorer")&&document.body){WT.bs=document.body.offsetWidth+"x"+document.body.offsetHeight}else{if(navigator.appName=="Netscape"){WT.bs=window.innerWidth+"x"+window.innerHeight}}}WT.fi="No";if(window.ActiveXObject){for(var d=10;d>0;d--){try{var c=new ActiveXObject("ShockwaveFlash.ShockwaveFlash."+d);WT.fi="Yes";WT.fv=d+".0";break}catch(g){}}}else{if(navigator.plugins&&navigator.plugins.length){for(var d=0;d<navigator.plugins.length;d++){if(navigator.plugins[d].name.indexOf("Shockwave Flash")!=-1){WT.fi="Yes";WT.fv=navigator.plugins[d].description.split(" ")[2];break}}}}if(gI18n){WT.em=(typeof(encodeURIComponent)=="function")?"uri":"esc";if(typeof(document.defaultCharset)=="string"){WT.le=document.defaultCharset}else{if(typeof(document.characterSet)=="string"){WT.le=document.characterSet}}}WT.tv="8.0.2";DCS.dcsdat=b.getTime();DCS.dcssip=window.location.hostname;DCS.dcsuri=window.location.pathname;if(window.location.search){DCS.dcsqry=window.location.search;if(gQP.length>0){for(var d=0;d<gQP.length;d++){var h=DCS.dcsqry.indexOf(gQP[d]);if(h!=-1){var f=DCS.dcsqry.substring(0,h);var a=DCS.dcsqry.substring(h+gQP[d].length,DCS.dcsqry.length);DCS.dcsqry=f+a}}}}if((window.document.referrer!="")&&(window.document.referrer!="-")){if(!(navigator.appName=="Microsoft Internet Explorer"&&parseInt(navigator.appVersion)<4)){DCS.dcsref=gI18n?dcsEscape(window.document.referrer,I18NRE):window.document.referrer}}}function dcsA(b,a){return"&"+b+"="+dcsEscape(a,RE)}function dcsEscape(a,d){if(typeof(d)!="undefined"){var c=new String(a);for(var b in d){c=c.replace(d[b],b)}return c}else{return escape(a)}}function dcsEncode(a){return(typeof(encodeURIComponent)=="function")?encodeURIComponent(a):escape(a)}function dcsCreateImage(a){if(document.images){gImages[gIndex]=new Image;gImages[gIndex].src=a;gIndex++}else{document.write('<IMG ALT="" BORDER="0" NAME="DCSIMG" WIDTH="1" HEIGHT="1" SRC="'+a+'">')}}function dcsMeta(){var a;if(document.all){a=document.all.tags("meta")}else{if(document.documentElement){a=document.getElementsByTagName("meta")}}if(typeof(a)!="undefined"){for(var b=1;b<=a.length;b++){var c=a.item(b-1);if(c.name){if(c.name.indexOf("WT.")==0){WT[c.name.substring(3)]=(gI18n&&(c.name.indexOf("WT.ti")==0))?dcsEscape(dcsEncode(c.content),I18NRE):c.content}else{if(c.name.indexOf("DCSext.")==0){DCSext[c.name.substring(7)]=c.content}else{if(c.name.indexOf("DCS.")==0){DCS[c.name.substring(4)]=(gI18n&&(c.name.indexOf("DCS.dcsref")==0))?dcsEscape(c.content,I18NRE):c.content}}}}}}}function dcsTag(){if(document.cookie.indexOf("WTLOPTOUT=")!=-1){return}var a="http"+(window.location.protocol.indexOf("https:")==0?"s":"")+"://"+gDomain+(gDcsId==""?"":"/"+gDcsId)+"/dcs.gif?";for(var b in DCS){if(DCS[b]){a+=dcsA(b,DCS[b])}}for(b in WT){if(WT[b]){a+=dcsA("WT."+b,WT[b])}}for(b in DCSext){if(DCSext[b]){a+=dcsA(b,DCSext[b])}}if(a.length>2048&&navigator.userAgent.indexOf("MSIE")>=0){a=a.substring(0,2040)+"&WT.tu=1"}dcsCreateImage(a)}function dcsJV(){var h=navigator.userAgent.toLowerCase();var s=parseInt(navigator.appVersion);var f=(h.indexOf("mac")!=-1);var n=(h.indexOf("firefox")!=-1);var c=(h.indexOf("firefox/0.")!=-1);var i=(h.indexOf("firefox/1.0")!=-1);var d=(h.indexOf("firefox/1.5")!=-1);var g=(n&&!c&&!i&!d);var b=(!n&&(h.indexOf("mozilla")!=-1)&&(h.indexOf("compatible")==-1));var e=(b&&(s==4));var p=(b&&(s>=5));var r=((h.indexOf("msie")!=-1)&&(h.indexOf("opera")==-1));var j=(r&&(s==4)&&(h.indexOf("msie 4")!=-1));var q=(r&&!j);var m=(h.indexOf("opera")!=-1);var l=(h.indexOf("opera 5")!=-1||h.indexOf("opera/5")!=-1);var k=(h.indexOf("opera 6")!=-1||h.indexOf("opera/6")!=-1);var a=(m&&!l&&!k);var o="1.1";if(g){o="1.7"}else{if(d){o="1.6"}else{if(c||i||p||a){o="1.5"}else{if((f&&q)||k){o="1.4"}else{if(q||e||l){o="1.3"}else{if(j){o="1.2"}}}}}}return o}function dcsFunc(a){if(typeof(window[a])=="function"){window[a]()}}dcsVar();dcsMeta();dcsFunc("dcsAdv");dcsTag();
Code:
WT=new Object();DCS=new Object();DCSext=new Object();function dcsAjax(){var a=$("#_wt");if(a.length){var d=a.metadata(),e,b;for(b in d){e=d[b];if(b.indexOf("WT.")==0){WT[b.substring(3)]=(gI18n&&(b.indexOf("WT.ti")==0))?dcsEscape(dcsEncode(e),I18NRE):e}else{if(b.indexOf("DCSext.")==0){DCSext[b.substring(7)]=e}else{if(b.indexOf("DCS.")==0){DCS[b.substring(4)]=(gI18n&&(b.indexOf("DCS.dcsref")==0))?dcsEscape(e,I18NRE):e}}}}DCS.dcssip=window.location.hostname;if(_wt.dcsurl!==undefined&&_wt.dcsurl!==""){$.url.setUrl(_wt.dcsurl);var c=$.url.attr("query");if(c!==null){c="?"+c}DCS.dcsqry=c;DCS.dcsuri=$.url.attr("path");if(DCS.dcsuri===""){DCS.dcsuri=_wt.dcsurl}}if(_wt.dcsref===undefined||_wt.dcsref===""){DCS.dcsref=window.location.href}else{DCS.dcsref=_wt.dcsref}a.remove()}}function dcsPageComplete(){dcsVar();dcsAjax();dcsFunc("dcsAdv");dcsTag()};
Code:
iBarclays.WebAnalytics=(function(){function d(){b("DCS.dcsuri","TaskView/ModuleMenu","DCSext.TaskView-AccountManagement","ModuleMenu","WT.dl","11","WT.seg_1","Editor")}function f(){b("DCS.dcsuri","TaskView/ModuleMenu","DCSext.TaskView-AccountManagement","ModuleMenu","WT.dl","11","WT.seg_1","Editor")}function e(i,j){j=$.trim(j);b("DCS.dcsuri","TaskView/Modules","WT.seg_1","Editor","DCSext.ModuleAdded",j)}function h(i,j){j=$.trim(j);b("DCS.dcsuri","TaskView/Modules","WT.seg_1","Editor","DCSext.ModuleRemoved",j)}function c(){var j=$("meta[name=WT.dcsvid]").attr("content");var i=$("meta[name=WT.seg_2]").attr("content");dcsMultiTrack("DCS.dcsuri","Accounts/See Statements","WT.dcsvid",j,"WT.seg_2",i,"WT.ti","","WT.seg_1","Money Manager","DCSext.StatementsView","eStatements")}function b(){var k,j;if(arguments.length%2==0){for(k=0;k<arguments.length;k+=2){if(arguments[k].indexOf("WT.")==0){WT[arguments[k].substring(3)]=arguments[k+1]}else{if(arguments[k].indexOf("DCS.")==0){DCS[arguments[k].substring(4)]=arguments[k+1]}else{if(arguments[k].indexOf("DCSext.")==0){DCSext[arguments[k].substring(7)]=arguments[k+1]}}}}WT.dcsvid=$("meta[name=WT.dcsvid]").attr("content");WT.seg_2=$("meta[name=WT.seg_2]").attr("content");j=new Date();DCS.dcsdat=j.getTime();dcsFunc("dcsCookie");dcsTag();WT=new Object();DCS=new Object();DCSext=new Object()}}function a(){WT={};DCS={};DCSext={};dcsPageComplete()}function g(){$(document).bind("modal.open.complete.webtrends",a);$(document).bind("takeover.open.complete.webtrends",a);$(document).bind("modal.open.complete.webtrends",iBarclays.TouchClarity.log);$(document).bind("takeover.open.complete.webtrends",iBarclays.TouchClarity.log);$(document).bind("drawer.opened",d);$(document).bind("drawer.closed",f);$(document).bind("module.opened",e);$(document).bind("module.closed",h);$(document).bind("pdf.download.webtrends",c)}$(g)})();
 
Last edited:
They already have a specific page on their use of cookies, I should imagine that a complaint wouldn't get you far as by using the site you will have implicitly agreed for them to use cookies. I'd imagine come May 26th they may have an additional link at the top of the page but I'd be very surprised if they'll ever have it so that you can opt-out of their cookies. However we'll see. Its a ridiculous bit of legislation.

http://blogs.webtrends.com/2012/04/more-on-the-eu-cookie-law-from-waw-london/
I have to applaud the regulator Dave Evans for his candour both during his presentation and throughout what was possibly the longest Q&A session for a WAW. He admitted that a technical review of the legislation was only done after the UK Government adopted the legislation and that the ICO has limited resources to investigate complaints. In debunking the FUD surrounding the directive, Dave frequently made reference to the ICO guidelines published in Dec 2011:

“Provided clear information is given about their activities, we are highly unlikely to prioritise first party cookies used only for analytical purposes in any consideration of regulatory action.”

That first part of the statement is very important at it refers to implied consent. The ICO now expects website owners to take the lead in educating users on the how, what and why of the data they collect. So, if you are a website owner using first party cookies for analytic purposes only, then you can expect the ICO to leave you alone, but only if you have taken positive steps to inform and educate your users, e.g.:

Conduct a cookie review and remove any unnecessary cookies from your site
Updated your cookie policy stating name of each cookie and what it does
Make it easy for your users to find and understand your cookie policy (implied consent), e.g.
Link at the top every page
No legalese, no jargon, no inflammatory terms (e.g. use ‘measure’ not ‘track’)
Explain why cookies benefit their experience
Remember the legislation came into force in May 2011 so by now you should have already completed the above. If you have done so but are still unlucky enough to have a complaint made against you then the ICO may well reject it on the grounds of implied consent.

One last thought, in Jan 2012, the EU commissioner for Justice, Viviane Reding, announced that she intends to overhaul data protection legislation across Europe. This could well mean that the E-Privacy Directive is amended or scrapped completely, but we live in the here and now and implied consent seems to be the solution at the moment for analytic first party cookies.
 
I wouldn't believe that if I were you.

The ICO have already published their guidelines that 'explicit consent' is required, and that implied consent is not enough.

You may want to try reading the following article as they seem to be going after high traffic sites that aren't doing anything to comply with the new law:
http://www.cookielaw.org/blog/2012/4/4/cookie-law-update-from-the-ico.aspx
 
Last edited:
Here is the javascript from the bottom of the Barclays Online Banking website.

What I would like to know is if it seems to be setting a cookie?

I'd like to know this as I am planning on reporting Barclays to the ICO if Barclays don't comply with cookie legislation as of the 26th May this year.

What do you think you'll gain from reporting them? It's not like you will get a reward, or any compensation.

They are a large company. Their web dev team will be much more intelligent that you, and will be fully aware of the impending rule change. They will probably even have an update ready to go.
 
Chris also re-iterated a point made in the guidlines published back in November about web analytics.* Although analytics are not exempt from the need to gain consent, they are low down on the priority list when it comes to enforcement.

Which we take to mean that if you are gaining consent for your more intrusive activity, and telling people about your analytics activity, then it will probably be OK to keep collecting information about what pages your visitors are looking at - at least for the short term.

That is quoted from the article that you supplied. Obviously I don't know all of the cookies that Barclays have in place but the ICO aren't going to be too bothered about analytics cookies in the short term. And as mp3duck say I'd be fairly confident that Barclays have something in place ready for 26th May of they need it.

I shouldn't imagine you are going to be able to make them change the way that they have implemented their analytics tools or remove them any time soon.
 
I think a lot of sites will simply stop you using the site if you "opt out".

I really don't understand why people get hung-up about being "tracked". You are not being tracked personally. It's just so sites get statistical analytic's of the sites usage.

Virtually every large website in the world will us Google Analytic's for example. It doesn't ever log anything personal to you, just what browser you're using, your OS etc etc.
 
What I want to gain is the option not to be tracked and profiled by third party companies.

This should be a browser option. Then when people realise major parts of their Internet experience are missing due to their decisions they will feel slightly differently about their user experience being measured ultimately to improve it in the future.
 
This should be a browser option. Then when people realise major parts of their Internet experience are missing due to their decisions they will feel slightly differently about their user experience being measured ultimately to improve it in the future.

+1 to this.
Analytic's play a very important role in what companies decide to put on their sites.
 
I think a lot of sites will simply stop you using the site if you "opt out".

I really don't understand why people get hung-up about being "tracked". You are not being tracked personally. It's just so sites get statistical analytic's of the sites usage.

Virtually every large website in the world will us Google Analytic's for example. It doesn't ever log anything personal to you, just what browser you're using, your OS etc etc.

I already opt out, through my use of numerous browser plugins. My annoyance with Barclays is that they have purposefully made it impossible to opt out. A website should still work correctly if you opt out of analytics tracking.

This should be a browser option. Then when people realise major parts of their Internet experience are missing due to their decisions they will feel slightly differently about their user experience being measured ultimately to improve it in the future.
It already is. It's called the do not track header.
 
This should be a browser option. Then when people realise major parts of their Internet experience are missing due to their decisions they will feel slightly differently about their user experience being measured ultimately to improve it in the future.

I think that the ICO are working with the major browser's now to work out a solution for this. Obviously won't be ready for May 26th but hopefully a lot of these issues can be handled by the browser through clear user options as opposed to on a site by site basis.
 
That would be fine, but they're are using third party analytics. The two tracking companies that they are using are Omniture and Webtrends.

Although they are supplied by third party they are considered first party cookies as the information is only shared with the owners of the specific website that have set up the analytics (in this case Barclays).

The main thing that ICO has been set up to combat are cookies which track your behaviour and content preferences over a number of different websites without your knowledge. Google and Facebook do a lot of this as far as I am aware.
 
There are also a huge amount of websites offering up free information to everyone. They make a profit through advertising and click throughs which is tracked through cookies. If this causes that profit to decrease or disappear there will be no incentive to publish free information.

The problem is the huge amount of websites out there who offer up nothing useful but manage to rank highly in google and therefore get lots of traffic. These sites make it seems like affiliate marketing is just a big scam, but in reality the people doing it properly are giving you something for nothing.
 
I thought we were talking about the third party element? The do not track header doesn't solve all of the ICO regs does it?

I don't think that it addresses any of them. The law is about cookies. Do-Not-Track is a technology to be opted into by tracking cookies to abide by someone's browser privacy settings. In the end it will be like robots.txt, I guess, where the bad guys exploit, or ignore, it.

Although they are supplied by third party they are considered first party cookies as the information is only shared with the owners of the specific website that have set up the analytics (in this case Barclays).

The main thing that ICO has been set up to combat are cookies which track your behaviour and content preferences over a number of different websites without your knowledge. Google and Facebook do a lot of this as far as I am aware.

You're making the assumption that the analytics data isn't shared, although webtrends seems to be linked to their domain, whereas the Omniture script seems to be hosted by Barclays. I have found that these scripts don't matter on the mobile website, but that is pretty much functionless.

You're right that the ICO will focus on those sites that seem to be doing the most harm.
 
I really don't understand why people get hung-up about being "tracked". You are not being tracked personally. It's just so sites get statistical analytic's of the sites usage.

Virtually every large website in the world will us Google Analytic's for example. It doesn't ever log anything personal to you, just what browser you're using, your OS etc etc.

http://panopticlick.eff.org/

Online anonymous != definition of anonymous.

They definitely have the ability to track you personally.
 
Last edited:
Back
Top Bottom