Revealed: Northampton, South Northants councils allow advertisers to gather residents' data without their consent

The neighbouring councils do not ask visitors to their websites for permission for cookies - small text files that track people on the internet.

The BBC's Shared Data Unit's study, which this paper is a partner of, also raised questions about the cookies policy on Daventry district and Northamptonshire county councils' websites.

The Information Commissioner's Office (ICO) said the setting of non-essential cookies without consent would be illegal and would look into the probe's findings.

Both South Northamptonshire Council and Northampton Borough Council apologised for the failure and said a solution will soon be implemented but insisted visitors' data is not shared with third-parties.

The BBC study shows 54 per cent of councils hosted third-party advertising cookies on their benefits pages, with adverts including high-interest credit cards, Black Friday deals, sports cars with features for disabled people and private funeral care plans.

Professor Tim Libert, from Carnegie Mellon University in the USA, created the Webxray programme used in the BBC's investigation and was appalled by the results.

“In my view, targeting residents through benefits pages is utterly reprehensible as the most protections should be extended to those most in need," he said.

What are cookies?

Many cookies are essential and are used to improve the browsing experience while third-party advertising cookies help companies deliver ads that are relevant to your browsing habits.

Before cookies are placed on a user’s browser, a publisher must ask for and be given legal consent from the user under the Privacy and Electronic Communications Regulations (PECR)

A pre-ticked box on a website is not enough. The user must be offered an active decision to accept or decline cookies when they first land on a website.

Some websites make their pages unusable until the visitor makes a choice, while others have a 'pop-up' box or a button at the side of the page.

So what are the Northamptonshire councils doing?

The investigation discovered a variety of cookies on the Northamptonshire councils' websites, including advertisers, those linked to advertising, audience measurement and coding.

The companies involved ranged from well-known brands like Google and Amazon to more obscure firms based in the United States and Denmark.

Northampton borough and South Northamptonshire councils were found to have one advertiser on both homepages and benefits pages, as of October 2019, and no consent option.

A Northampton council spokesman said: “We are aware of the obligation to request permission for cookies to gather data on visitors to our website and a solution will soon be implemented.

“We would assure residents that at no time were their personal details passed on to third parties.

"The data we gather is used to improve the quality of our website – our data is not shared and Google do not sell this information to third parties.

“But this enquiry has highlighted that the cookie we use to gain analytics on the demographics of visitors to our website can be used for tracking outside of our website.

“We recognise that we must make website visitors aware that cookies are being used and the council apologises for failing to provide the ability to opt out or modify the information that is being recorded during their visit to the site.

“We are working to remove the demographic cookie from our website and implement all measures to make our website compliant.”

A South Northamptonshire Council spokesman added: “The council is aware of its obligation to request permission for cookies to gather data on visitors to its website and a solution will soon be implemented. We would assure residents that at no time were their personal details passed on to third parties.

“The council does employ the services of Site Improve, an analytics service which is used to improve the quality of its website (detecting broken links, spelling mistakes and identifying in-accessible content). This service has been wrongly categorised as ‘real-time bidding.’

“The data gathered is for internal use only and is not shared beyond the company which provides the service and the council.

“The council also utilises Google Analytics, which has been recorded as three google systems and is part of standard website practice to improve the ease with which the website is used.

"For example helping to locate people who are requesting information on when their bins are collected.

"Again this data is not shared and Google does not sell this information to third parties.

“Nevertheless SNC recognises that it must make website visitors aware that cookies are being used and the council apologises for failing to provide the ability to opt-out or modify the information that is being recorded during their visit to the SNC website.”

Daventry District Council did not have any advertising cookies on its website but it only has a pop-up at the top of the page that assumes consent from visitors.

“Visitors to our website are notified that cookies are used and that they can change or delete these at any time, with a link on how to do this," a spokesman said.

“The cookies currently used on the council's website are for Google Analytics, which are only used by ourselves to identify things such as our most viewed pages, the general locality of users by town or city, and the times they access our pages and services.

"This helps us to improve the customer experience by making sure our website remains relevant and convenient for our visitors.”

Northamptonshire County Council also had no advertising cookies and a pop-up at the bottom of the page that assumes consent but only when necessary and asks to confirm other types.

"The county council website has implemented a cookie consent tool called CookieBot to enable visitors to decide which types of cookies they give consent to.

"We monitor the success of this tool on an ongoing basis and will shortly be moving to a new configuration as a result of this monitoring, to ensure non-standard scripts are blocked.

“The site uses a ‘prior consent’ mode, meaning that the user should give prior consent before any non-essential cookies are set.

“The new ‘automatic’ configuration aims to automatically block all scripts and cookies other than those determined to be ‘necessary’ for the site to function, or have otherwise been granted consent by the user. This approach will be enabled in the coming days.

“We only use advertisers verified by the Council Advertising Network (CAN) and information is only used to display ads that are relevant to users.

“CAN does not pass on or sell information to third parties.”