Scottish council websites sharing residents’ data via advertising cookies

High-interest credit cards and Black Friday deals are among the adverts targeted at people seeking benefits advice on local authority websites, an investigation has uncovered.

More than a third of Scottish council sites were found to be using advertising trackers

More than a third of Scottish council sites were found to be using advertising trackers which allow private third party companies to track residents’ data.

Research by the BBC Shared Data Unit found more than 950 advertising cookies - small text files that track people on the internet - embedded in council benefits pages across the UK.

Examples of targeted adverts on benefits pages seen by the BBC include high-interest credit cards, Black Friday deals, sports cars with features for disabled people and private funeral care plans.

Many cookies are essential and are used to improve the browsing experience, typically being used for audience measurement, hosting and website design.

Third-party advertising cookies help companies deliver ads that are relevant to an individual’s browsing habits.

Some 41 per cent (13 out of 32) of Scottish councils showed evidence of advertising trackers loaded from their benefits pages.

Data on residents in Scotland is sent to at least two companies in two countries through advertising trackers on benefits pages.

Some of the councils allowing third party advertising companies to track residents through their benefits pages include South Lanarkshire, Aberdeen City, City of Edinburgh and Glasgow City.

A spokesman for the Convention of Scottish Local Authorities (COSLA) said: “Councils take their data protection responsibilities extremely seriously.

“If necessary, council data protection officers will liaise with the Information Commissioner’s Office to establish what, if any, additional actions might be needed to fully comply with the GDPR privacy legislation.

“The use of cookies is a common and established feature on websites and is used to improve the performance or usability of these sites and to assist members of the public in finding content relevant to them.”

They added: “Council websites have published guidance on the use of cookies mentioned by the BBC and members of the public are encouraged to review that guidance on their Council website.

“If they have any concerns, or they are still in any doubt, they can seek further advice from their council.

“Councils will ensure that they comply quickly with any further recommendations identified by the ICO in relation to GDPR compliance.”

Lloyd Clark, managing director, the Council Advertising Network (CAN), said: “We do not specifically target vulnerable people via council advertising. If there are more trackers on benefit pages than the home page, this is because a minority of our council partners choose not to have advertising on their home pages at all.

“But all their other webpages, like for waste and recycling or planning, will have the same number of trackers as their benefit pages.

“In addition, we automatically block all categories of advertising that could be used to target vulnerable groups. This includes ads for payday loans, gambling and alcohol.”

EU law, adopted in Scotland and the rest of the UK, has banned the sharing of personal data to third parties without freely given, informed and explicit consent.

The law comes from the Privacy and Electronic Communication Regulations (PECR), which sit alongside the Data Protection Act and the GDPR.

The regulations require that before tracking technology is used, “clear and comprehensive” information about its purpose must be given to the user.