Report claims Buckinghamshire Councils are selling your data

Both councils have denied that they use cookies to learn information about website users, which can then be sold on, after a report named the authorities in a wide reaching document of national research.

We all use the council websites for a lot of things, for example when we get married, to look for advice when we get ill or cannot work, or when we move house.

Even when a loved one dies.

But companies embedded on council websites learn about you when you visit their pages.

Companies are embedded in cookies on Council web pages.

So, What are cookies?

● Cookies are small files of text that are often used to track users around the internet. They attach themselves to our browsers when we open web pages, and are the main technology used to gather data for targeted and behavioural advertising.

● Many cookies are essential and are used to improve the browsing experience. They are used for audience measurement, hosting and website design.

● Third-party advertising cookies help companies deliver ads that are relevant to your browsing habits.

● Before cookies are placed on a user’s browser, a publisher must ask for and be given legal consent from the user under the PECR (Privacy and Electronic Communications Regulations).

● A pre-ticked box on a website is not enough. The user must be offered an active decision to accept or decline cookies when they first land on a website.

The collection of this information from council websites takes place naturally in sensitive situations; for example when you might be seeking help from your council for a health disability, drug problem, or perhaps when you are in financial distress.

So when you visit these pages, companies that you have never heard of build dossiers about you.

They tie together your activity on websites and apps over time to calculate what you are interested in and what problems you struggle with.

In short, by spying on your browsing, they can understand what makes you tick.

The report found nearly all council websites permit at least one company to learn about the behaviour of people who visit them.

People seeking information about disability, poverty, drugs and alcoholism services are profiled by data brokers on some council websites.

Every single time you load a web page, private companies receive the following data from any council websites that they are embedded on:

● The URL (address) of each page you visit. This can reveal sensitive things about you. For example, visits to a council page to apply for school places, or find school term dates, suggests you are a parent. If your child has a disability, you might visit the specific council page where you can apply for a disabled parking permit at your child’s school. Similarly, the URLs of council pages for senior citizen parking, free public transport, home care, etc. reveal one’s circumstances.

● ID codes that are specific to you, and that identify you as the person who loaded a specific page at a specific time. ● Your location.

● Your device’s details, including its type, web browser and version, operating system and version, and in some cases the apps being used, screen resolution and preferred language.

● Your IP address (not always included in a real-time bidding broadcast).

● These ID codes, timestamp, and device details allow private companies to tie what you do on one website or app together with what you view across the Internet.

Worst of all Aylesbury Vale District Council was found to be using the controversial RTB, or 'real time bidding' and google systems projects.

Many councils use “RTB” online advertising auctions to run ads on their websites.

This is an enormous data breach, exposing people to profiling by innumerable companies, billions of times a day.

RTB faces multiple GDPR investigations for systematic data breaches, because it broadcasts people’s personal data to countless companies.

Often, this information is extremely sensitive: it can include unique ID codes to identify who is loading the page, their location, interests, and what they are reading or watching.

These data can be tied together over time to build detailed profiles.

Aylesbury Vale District Council, despite being named in the report as using RTB 'real-time bidding' software, denies the claims but said they would be reviewing their practices.

They said: "The report describes the potential threat from web advertising systems and real time bidding platforms that embed small pieces of data (cookies) into a visitor's browser.

"These cookies can then be used to track a visitor's behaviour on almost any website, including council websites.

"The report makes it clear that cookies do not directly capture personal data, such as data entered into online forms websites, but they can be used to build up a picture of an individual based on the websites and pages they visit across multiple websites.

"AVDC does not accept advertising on its website, does not embed advertising cookies and does not sell user behaviour data.

"However, we do use cookies to better understand users' behaviour on the website using a product called Google Analytics (GA).

"GA analyses how visitors use the site, for example the pages they visit, the path they take through the site, the pages they arrive and leave from etc. GA only provides aggregated data and does not provide any information about any individual visitors, or any data that can explicitly identify any individual user.

More information can be found in our Cookie Policy at https://www.aylesburyvaledc.gov.uk/cookies-0

"Nevertheless, we take privacy seriously and as a precaution have asked our website service provider to review the cookies on our site and their purpose and advise what remedial action, if any, is required."

Google operates systems used behind the scenes on many Council sites including Buckinghamshire County Council and Aylesbury Vale District Council.

Google owns all five of the top embedded elements loaded by council websites, giving it the power to know what virtually anyone in the UK views on council sites.

Some 56% (174 out of 312) of English councils host third party advertising cookies on their benefits pages.

The cookies were linked to at least 38 different companies in 10 countries.

Buckinghamshire County Council, have also denied the claims made in the report.

A spokesperson for them said:

"The privacy of people who use the Buckinghamshire County Council website is extremely important to us.

"Google Analytics is used within the council to help us understand how people use the website and how we can best provide them with the information they are seeking. All information collected in this way is anonymised and does not allow the identification of any individual.

"We do not sell any data or make money through web ads.

"As Buckinghamshire moves towards unitary status, we’re in the process of building a new website for the new Buckinghamshire Council. As a part of this we will be reviewing how we carry out analytics so that we strike the right balance between privacy and having data that helps us to improve what we do."

The Local Government Association (LGA) issued the following response to these findings: “Councils take legal compliance seriously and are looking into their use of cookies in relation to the findings.”