TWO different investigations have revealed how users are tracked by third parties on council websites.

Councils across the region use social media sharing tools and Google Analytics to build a better user experience and access greater insight, in a trade-off with user data.

This is done through cookies, small text files that track people on the web, which log information like whether users have visited a webpage before. Without cookies, a website would not remember if a user is logged in or what is in an online shopping basket.

Every time a page is loaded, it sends data back to third parties that have cookies on that page.

Tracking on sensitive pages

The BBC investigation found more than 950 advertising cookies embedded in council benefits pages. Third party companies then use this data for targeted advertising, displaying the likes of high-interest credit cards and Black Friday deals.

Middlesbrough, Darlington, Redcar and Cleveland and Stockton councils all had one or more advertising cookies on their respective benefit page.

A Darlington Borough Council spokesman said: “Visitors to our website should not be concerned about privacy or security. All of the three third party trackers linked to the council’s website – Google Analytics, Google Translate and AddThis – can be turned off if the user wishes to do so.”

A Google spokesman said: “Google does not build advertising profiles from sensitive interest categories, including from sites offering benefits such as welfare or unemployment, and we have strict policies preventing advertisers from using such data to target ads."

Social media sharing tools also share user data, with Privacy browser Brave finding more than a third (38%) of council sites using plug-ins that tells social companies what people are reading online. This includes Darlington, Middlesbrough, North Yorkshire and Stockton.

How personal information is revealed online

A range of other things can reveal sensitive data, such as the web address (URL) of each page. A page URL gives an indication of what it is about.

For example, if a user looks at school information, it can be assumed they have a child. If someone looks for a disabled parking permit, the may be a disabled driver.

IP addresses, which are digital address, can be used to track geographical location while other unique ID codes associate a person with a specific page loaded at a specific time.

Details such as device, its type, whether it runs Android or iOS and what version, what web browser is being used and its version, as well as, apps, screen resolution and preferred language.

ID codes, timestamps and device details also tie together activity across multiple devices.

When snippets of information are accumulated, companies assume other things, as seen in the Cambridge Analytica Scandal, and create in depth personas of users.

Data brokers build up these portfolios of information, which Brave describes as “shadowy” due to little oversight.

Real-time bidding on council sites

Real-time bidding (RTB) is when someone visits a website and it triggers an advert bid request using various pieces of user data, including basic demographics like age, sex and location, to detailed behavioural profiles.

This data is automatically sent to multiple advertisers who then bid on impressions as the advert is served.

Middlesbrough, North Yorkshire, Stockton and Redcar and Cleveland are just some of 196 council websites, more than half, that use Google’s RTB system, which may share data such as race, sexuality, health status or political leaning with hundreds of companies and little oversight.

However, Cleveland and Redcar Council said it set up the technology but has never implemented it, while Stockton and North Yorkshire councils also say they do not allow real-time bidding.

Cookies and consent on council websites

General Data Protection Regulations (GDPR) prevents cookies from automatically tracking you. Instead, they require consent given by an unambiguous positive action, like ticking a box, so people shouldn’t be tracked by third parties unless they have consented to it.

Consent must also be freely given, specific and informed.

Middlesbrough Council was the only in the region to give a clear yes or no consent option to visitors. Darlington, North Yorkshire, Durham and Stockton assumed consent with an 'agree' and settings option, while Redcar and Cleveland was found not to have a consent pop up.

Alan Patrickson, Head of Digital and Customer services at Durham County Council, said: “We take the protection of our customers’ data very seriously and make every effort to ensure our website and online services are as secure as they can be.

“The cookies that we use on our website are the minimum required to make the site function properly. We do not allow our website to be used for advertising by third parties or for commercial purposes."

Robert Ling, Technology and Change Managing Assistant Director at North Yorkshire County Council, said: “We do not use cookies for advertising or allow advertising or real-time bidding on our website.

“While we do use Google Analytics cookies to track how our site performs, this is anonymous and used purely to identify any possible issues with the content as well as to enable us constantly to improve the experience for residents to make our services as easy to access as possible.”

Stockton Council confirmed a cookie consent pop-up is active on the website and allows users to change their preferences.

In response to calls for greater privacy controls, Google announced last month it would phase out third-party cookies in next two years on websites accessed via Chrome browser.