Privacy
Every company your site shares visitors with is one you know about
privacy.third-party-cookies
Why this matters
A cookie stored against another company's domain means that company saw the visit — the address of the page, the browser, the address it came from — and can recognise the same person on any other site it is embedded in. Under UK data protection law the site owner is responsible for that sharing and has to tell people it happens, whether or not the cookie itself needed consent. Most owners are unaware of half the list, because the companies arrive attached to a plugin or an embedded video rather than by decision.
Who fixes it
You can, usually
Roughly how long
1–2 hours
Care needed
Low risk to change
How to fix it
Go through the list and decide, for each one, whether you still want it. Embedded YouTube videos can use the youtube-nocookie.com address; social share buttons can be plain links instead of scripts; a tag left behind by an old agency can simply go. Whatever stays has to be named in your cookie policy, with what it does and how long it lasts.
How we score it
Failing this check takes up to 10 points off your privacy score. It is a fact about your site rather than a measurement, so it reads the same on every scan until you change something.
Does your site pass this one?
This check runs on every scan, along with the other 106. Free, no account, and you see the evidence for each result.
Check my siteOther privacy checks
- Cookies the site sets are explained somewhere on itAnyone whose site stores cookies has to tell visitors what is stored, who by and how long it lasts, in language an ordinary person can follow. It is a standing obligation rather than a one-off, and it applies to cookies that needed permission and to the ones that did not. A site with tracking on it and nothing anywhere explaining that tracking is the clearest version of getting this wrong, and it is also the easiest to put right.
- Nothing is stored on a visitor's device before they agree to itUK law treats putting anything on a visitor's device — a cookie, or a record kept in the browser's own storage — as something that needs permission first, unless it is genuinely required to deliver what the visitor asked for. Analytics does not count as required, however anonymous it is, and the Information Commissioner's Office has said so repeatedly. This is one of the few things a website audit finds where the risk is a regulator rather than a lost sale.
- Tracking cookies do not outstay the consent behind themA tracking cookie carries the permission it was set under, and permission does not last forever. Regulators across Europe have converged on around thirteen months as the point at which a site should ask again, on the reasoning that somebody who agreed to be measured last year has not agreed to be measured indefinitely. Several popular analytics tools still default to a two-year lifetime, so this is usually a setting nobody chose rather than a decision. Browsers now cap what they will store at a little over a year regardless, which hides the difference between a long setting and an absurd one.