The cookie crumbles for central government

• Tweet

Learn more about ICO and the Cookie Law

Well it’s the eve before the Information Commissioner’s Office (ICO) starts enforcing the new EU cookie law (e-Privacy Directive); the law which applies to how you use cookies and similar technologies for storing information on a user’s equipment such as a PC or mobile device.

But what sort of shape is the government in? How are they treating cookies and privacy concerns?

The ICO has had nearly one year to warn them to get in line with the new law.

So we decided to investigate…

We ran through Direct.gov.uk’s list of central government websites which include government departments, executive agencies and non-departmental public bodies… 122 sites in all.. Then we ran through all 122 to see how they conform according to the 3 main principals of setting cookies for being within the law:

1. tell people that the cookies are there,
2. explain what the cookies are doing, and
3. obtain their consent to store a cookie on their device

Not all bodies are included as they may share the same domain or not distinct enough to warrant being its own site. You can view the full table of websites below.

Statistics we found…

11 Sites where it was impossible to find information regarding cookies or having a privacy policy at all.

2 Sites chose to use exactly the same method as ICO for not allowing any cookies to form (only allowing consent first).

4 Sites chose to use the ICO method but with session cookies being stored first.

6 Sites in total chose to obtain consent; visibly warning users about cookies. 4 of which were Scottish sites.

11 Sites mentioned cookies were being used when entering their homepage.

14 Sites that used cookies failed to mention their policy on cookies.

8 Sites do not set cookies when entering their site by their main/root domain.

47 Sites chose to display their policy via a link mentioning the word ‘cookies’. Of those only 1 site offered to turn off cookies via its own settings such as a cookie control panel (The Forestry Commission).

4 Sites were found to have misleading or incorrect information regarding their cookies.

1. The Serious Fraud Office uses Google Analytics and states on their page “We do not use cookies for collecting information from the site.”
2. The British Waterways states “Once the user closes their browser, the cookie terminates.” Which is true to a point, but their analytics uses persistent cookies.
3. The Care Quality Commission (CQC) fails to signal any use of cookies from using their site but states “Please be aware that some systems on our website require the use of cookies, but we will always state if this is the case.”
4. It might be picky but The Crown Estate site intends to use Analytics which uses persistent cookies but states, “Where we intend to use a cookie, explanatory text will be provided to tell you what the cookie does, and you will be given a specific opportunity to accept the cookie or refuse it.”

Below is the list we have compiled of central government websites taken from Direct.gov.uk such as government departments, executive agencies and non-departmental public bodies.

What the columns represent:

Conclusion…

If the sites listed do not change by tomorrow this means that 90% of those government sites will be breaking the law.

This is not a list to poke holes at privacy issues, but to show the confusion… what is the right method in being open/honest about cookies? And why is the UK government so lacklustre in this department.

Should there be a prompt about consent and cookie usage? According to The ICO and the law it does, but only 6 sites actually complied with this rule… And only 2 of those used the same method as The ICO by not allowing any cookies when first visiting their sites.

Hopefully we’ll see more sites changing in the coming days; not expecting any miracles though.