Counseling programs share information about users of their websites – including those seeking help with disability or alcoholism claims – with dozens of private companies.
More than 400 local authorities allowed at least one third-party company to track people visiting their websites, the investigation revealed.
Some councils have found that they allow companies to track the use of sensitive parts of their websites, such as when people are seeking financial assistance or support for substance abuse.
The data obtained from tracking cookies about where users browse online can be sold by “data resellers” for profit.
Critics argued that city council websites serve a public purpose and should not allow outside companies to monitor their users' activity, particularly given the sensitive nature of some visits.
Wolfie Christl, a technologist and researcher who studies the ad-tech industry, said: “Websites and apps that serve a public domain should not use any invasive third-party tracking at all.”.
Johnny Ryan, the head of policy at the anonymous browser Brave, who analysed council websites and shared the findings with the Guardian, said: “Private companies embedded in council websites are learning things about you. This is happening even in the most sensitive cases, when you might be asking your council for help.”
Brave used open source tools to see which companies were present on certain websites. They found that 409 council websites in the UK allowed private companies to obtain data about their visitors.
The research showed:
- Twenty-three councils allow data brokers – businesses that collect personal information about consumers and sell that information to other organisations – to find out when someone visited one of their websites.
- On the Enfield council website, a page for people needing financial support for accommodation and food allowed 21 companies, including Google, to see who visited the website.
- A Sheffield council page for people seeking help for substance misuse shared data about visitors with at least 20 companies, including seven data buyers.
- Ealing's educational needs and disabilities website allowed at least 21 businesses to access data about visitors.
- Nearly 7 million people are served by boards that allow a data broker like LiveRamp to track people in their locations. The company was part of Acxiom, a group that sold election profiles to Cambridge Analytica.
Companies track online activity through cookies, pixels, and other trackers. When embedded in a browser, these pieces of code can allow users to be tracked across the web. While they don't identify personal information like a name or address, they do identify a user's browsing habits—like which page was loaded at a particular time.
While many websites, including the Guardian, use cookies, Ravi Naik, a data lawyer, said their use on consultancy websites was problematic because of the nature of the details they share. He said: “We have more of our conversations with the state through local authorities and because of that they involve more sensitive and personal information.”.
Companies are now prohibited from sharing data about protected categories without explicit consent. This means that before information about health, sexual orientation, ethnicity and political opinions is collected, the user must agree to the specific sharing of “special category” data.
Companies say they have consent from people who accept cookies. However, Brave's report found that while some websites may have stated they were using cookies, no users actually clicked the accept button.
The law states that consent must be informed and based on explicit positive action. The Information Commissioner’s Office (ICO) said: “To be valid, consent must be freely given, specific and informed. It must involve some form of explicit positive action – for example, clicking on a link – and the individual must fully understand that they are giving you their consent.”
Ryan said: “We used an automated system to load each council’s website. All it does is load the website. It is not able to click on buttons. All the tracking that was uncovered in our investigation happened without consent.”
Mark Gannon, director of business change and IT solutions at Sheffield City Council, said cookies were used on its website “and we require consent from all customers for storing or retrieving data on desktop, laptop, smartphone or tablet”.
The report states that when the Sheffield council website was loaded, companies could track someone without them doing anything.
Sheffield Council said they were using an online advertising tool provided to them by the Council Advertising Network. The network said: “No cookies are set for the purposes of data collection and resale – this means that data collected from the website is sold, which is not the case.”
The Ealing consultancy said it believed its approach was “in line with the requirements of GDPR”. However, it noted: “This is a complex and evolving area which needs to be monitored continuously.”.
LiveRamp said it was no longer part of Acxiom and had never “sold UK voter profile information to Cambridge Analytica.” It said it operates in accordance with jurisdictional laws and worked “diligently to detect and prevent data misuse.”
Another 198 consulting centers use real-time bidding (RTB) – when a web user loads a page, thousands of potential advertisers bid to serve them an ad. It means people’s data is transmitted across the internet to hundreds of companies.
Naik said it was difficult to say whether the councils had made any money from this. “But I imagine in the syndicates it seems to be a win-win situation.”
A Google said that no advertising profiles were created “from sensitive interest categories, including websites that offer help with personal difficulties, and we have strict policies that prevent advertisers from using such data to target ads.”
They told the Guardian that third-party cookies could be used to make basic website functions work better or to serve and measure ads.
