Third-party cookies found on Scarborough Council's website

The investigation revealed more than 950 advertising cookies - small text files that track people on the internet - embedded in home pages and benefits pages for councils around the UK.

On Scarborough Council's website, eleven third-party domains - all hosted by websites in the US - were detected on the homepage and benefits page.

The BBC's Shared Data Unit used open source software webXray and took a snapshot over two days in October 2019 of more then 400 council benefit pages.

The investigation also looked at if councils were asking for the correct form of consent for these cookies under privacy laws and found Scarborough Council assumed user consent with a pop up.

Experts have said the use of third-party cookies on benefits' pages was 'unexpected'.

Professor Tim Libert of Carnegie Mellon University, creator of the Webxray programme, said: “I’ve been a web developer since the late 1990s and a privacy researcher for the past seven years and this may be the most unexpected place I’ve seen an ad online.

“First and foremost, it is important to note that there is no way for a tracker to force their code onto a site short of hacking it - the site itself must place the code there. So the biggest party of responsibility is the website owner [councils] without question.

“In my view, targeting residents through benefits pages is utterly reprehensible as the most protections should be extended to those most in need.”

Lloyd Clark, managing director of the Council Advertising Network (CAN), which works with public bodies including around 50 UK councils, said: "We do not specifically target vulnerable people via council advertising. In addition, we automatically block all categories of advertising that could be used to target vulnerable groups. This includes ads for payday loans, gambling and alcohol.

“What’s been built up is for the purpose that relevant information goes towards serving individuals’ relevant advertisements.

“People appreciate relevant advertising. People don’t like irrelevant adverts."

The Information Commissioner's Office (ICO), an independent body set up to uphold information rights, said the setting of non-essential cookies without consent would be illegal and is looking into the findings of the BBCs investigation.

ICO executive director for technology policy and innovation Simon McDougall said: "This investigation by the BBC further highlights our concerns about the lack of transparency and consent when adtech is used.

"While the ICO is keen to promote innovative uses of technology, that cannot be at the expense of people's fundamental legal rights. We will be assessing the information provided by the BBC."

A spokesman for Scarborough Borough Council said: “We manage cookie provision on our websites in accordance with the EU Cookie Directive and ensure they meet this directive.

“As a result of the research carried out by the BBC Shared Data Unit, we immediately undertook a further, more detailed review of all third party cookie use on our website and associated web services before Christmas with a specific focus on our benefits page.

"The eleven cookies identified on our benefits page were five essential cookies required to be able to provide an online service to people accessing the pages and six non-essential but

legitimate cookies that come with the functionality we have ‘plugged in’ to the web pages (e.g. Google analytics). None of these were identified as advertising cookies.

“We encourage anyone who wants to know more about our use of cookies to refer to our comprehensive Cookie Policy at scarborough.gov.uk/cookie-policy”

The national picture

Cookies help companies deliver ads that are relevant to people's habits on the internet.

Across England, 56 per cent of councils hosted third party advertisers on benefits pages with an average of five cookies found on each.

More than two-thirds did not appear to ask for the correct form of consent under privacy laws.

The investigation also found examples of targeted ads on benefits pages around the country included high-interest credit cards, Black Friday deals, sports cars with features for disabled people and private funeral care plans.

What are cookies?

Cookies are small text files that track internet users and collect data on them.

Many cookies - such as those for audience measurement and web design - are essential and used to improve the browsing experience.

Third-party advertising cookies help companies deliver ads relevant to a user's browsing habits.

What does the law say about consent?

British and EU law has banned the sharing of personal data to third parties without freely given, informed and explicit consent.

The General Data Protection Regulation (GDPR) came into force in 2018, and brought in stricter rules around handling and sharing data that could identify people.

As well as GDPR, the Privacy and Electronic Communications Regulations, demand full active consent from users before tracking cookies are embedded.

Consent for tracking technology must be freely given, specific and informed, and involve “unambiguous, positive action” - such as ticking a box or clicking a link.