Audit reveals high degree of cookie use by public sector websites as new law kicks in

An audit of 603 public sector websites conducted for Socitm has found that all but six have cookies that will require their public sector owners to take action to comply with new legislation that came into force in late May.

A review of the main websites of all local authorities and 170 other public service organisations – including housing associations, fire services and the police – found that each had on average 32 cookies. One site had 1,346.

According to Socitm, many sites have cookies set by third party system suppliers and websites such as Twitter and Google made available through the website.

The revised Privacy and Electronic Communications Regulations came into force on 26 May this year. The changes to the regulations mean that website owners need to get consent from visitors if they are to store cookies on their users’ computers or mobile devices.

The Information Commissioner’s Office has given public sector organisations and businesses that run websites up to 12 months to “get their house in order” over their use of cookies.

Those who choose to do nothing over this time will have their lack of action taken into account when the regulator enforces the rules. Serious breaches will also be investigated before the deadline.

“Simply removing cookies from websites risks compromising usefulness and usability and is not a realistic option for organisations looking to shift more services online,” Socitm said.

“The law makes it clear that website owners must be aware of all cookies on their site, whether set by them, or as is often the case, where they have been set by third parties.”

Socitm said site owners would need to choose from a range of options for obtaining informed consent from website users, and should also consider if any of the cookies fall into an exemption for those that are considered strictly necessary for the purpose of a user’s visit to the website.

“Thereafter measures need to be put in place for monitoring cookies used on the website,” it added. “New cookies added to the site need to be flagged for site users and the site needs to be checked regularly for cookies ‘dropped’ by third parties.”

Martin Greenwood, Programme Director for Socitm Insight, said: “It is difficult and time-consuming to identify cookies by manual means and therefore easy to underestimate the scale of the use of cookies websites.

“We have compared the number of cookies found by our audit with those declared by some of the organisations that have already taken action on cookies. It is difficult to check for cookies and in every case we have found significantly more cookies that the site owners are aware of.”

Socitm has launched, in partnership with Cookie Reports, a cookie management service.