Privacy
Cookies the site sets are explained somewhere on it
privacy.no-cookie-policy
Why this matters
Anyone whose site stores cookies has to tell visitors what is stored, who by and how long it lasts, in language an ordinary person can follow. It is a standing obligation rather than a one-off, and it applies to cookies that needed permission and to the ones that did not. A site with tracking on it and nothing anywhere explaining that tracking is the clearest version of getting this wrong, and it is also the easiest to put right.
Who fixes it
You can, usually
Roughly how long
2–3 hours
Care needed
Low risk to change
How to fix it
Write a cookie page listing what is stored, which company sets it, what it is for and how long it lasts — the table in this finding is most of the content already. Link it from the footer of every page. If you have a privacy policy, the cookie section can live inside it rather than on its own page.
How we score it
Failing this check takes up to 15 points off your privacy score. It is a fact about your site rather than a measurement, so it reads the same on every scan until you change something.
Does your site pass this one?
This check runs on every scan, along with the other 106. Free, no account, and you see the evidence for each result.
Check my siteOther privacy checks
- Every company your site shares visitors with is one you know aboutA cookie stored against another company's domain means that company saw the visit — the address of the page, the browser, the address it came from — and can recognise the same person on any other site it is embedded in. Under UK data protection law the site owner is responsible for that sharing and has to tell people it happens, whether or not the cookie itself needed consent. Most owners are unaware of half the list, because the companies arrive attached to a plugin or an embedded video rather than by decision.
- Nothing is stored on a visitor's device before they agree to itUK law treats putting anything on a visitor's device — a cookie, or a record kept in the browser's own storage — as something that needs permission first, unless it is genuinely required to deliver what the visitor asked for. Analytics does not count as required, however anonymous it is, and the Information Commissioner's Office has said so repeatedly. This is one of the few things a website audit finds where the risk is a regulator rather than a lost sale.
- Tracking cookies do not outstay the consent behind themA tracking cookie carries the permission it was set under, and permission does not last forever. Regulators across Europe have converged on around thirteen months as the point at which a site should ask again, on the reasoning that somebody who agreed to be measured last year has not agreed to be measured indefinitely. Several popular analytics tools still default to a two-year lifetime, so this is usually a setting nobody chose rather than a decision. Browsers now cap what they will store at a little over a year regardless, which hides the difference between a long setting and an absurd one.