Updating Cookie policy and banner

Posted on: 28 February 2020 Tags: cookies

To adhere to The Privacy and Electronic Communications (EC Directive) Regulations 2003 - Confidentiality of communications - Regulation 6 the following is needed:

tell people the cookies are there
explain what the cookies are doing and why; and
get the person’s consent to store a cookie on their device.

We were meeting requirement 1 and 2 but failed to ask users for their consent before storing cookies on their device. Some cookies are needed by Google Analytics to track users through the service. Users have to consent to these cookies before we can start tracking them.

Technical implementation

4 Pull Requests showing implementation and code

The cookie banner is hidden by default using css. It does use a small amount of JavaScript to determine whether or not to show or hide the banner depending on whether or not the user has set their preference.

It was decided that this feature would rely on JavaScript (i.e if JavaScript fails to load or is disabled, no banner is shown) because the user might decide to accept cookies at any point of their journey through the service and we did not want to risk losing any of their existing data or having to playback their data once the page reloaded. Technically this would have been difficult to implement, and using JavaScript makes it less obtrusive.

If the user decides to accept the cookies then the following events happen:

Hides the banner without a page refresh
Installs Google Analytics/Google Tag Manager.
Enables event tracking on the page

There are various ways to implement this form. For example GOV.UK Notify uses JavaScript to set the radio buttons options and to show/hide any validation errors or success messages. We did not take this approach because it would need a lot of additional coding to make it accessible. We also discovered as a result of implementing it as a traditional form that submits data to the server, we would be able to report on the number of users who actively reject cookies by looking at the server logs.