How we are treating cookie consent

David Kindness
Wednesday 18 December 2019

Last year we implemented a mechanism for users to manage their cookie consent preferences on University websites that use the T4v7 and T4v8 content management systems. This mechanism uses the popular CIVIC Cookie Control product which we deploy using Google Tag Manager. This groups cookies into named categories that can be toggled on or off – loading specific content and scripts based on the user’s preferences.

With the deadline of the EU’s General Data Protection Regulation (GDPR) passing in May 2018, there was still a degree of uncertainty around which types of cookies require explicit opt-in consent before they are enabled. The Information Commissioner’s Office (ICO) finally released definitive guidance around cookies in July 2019, along with a helpful blog about acceptable use of cookies. The main takeaway was that almost all cookies require opt-in consent, including analytics cookies.

This new information meant that our initial implementation of cookie consent failed to meet the regulations. We had previously categorised any analytical cookies as ‘strictly necessary’ so that analytic tracking scripts could be set for every visit to the website. We made the recommended changes in July 2019, but it wasn’t until November 2019, when any cached cookie preferences had expired, that we could measure the impact on our analytics data.

It is unrealistic to imagine all visitors to University websites will choose to opt-in to analytics type cookies, so inevitably the total dataset will be diminished. Using Google Analytics to directly measure before and after the change in cookie consent implementation shows a noticeable drop in recorded traffic. Page views in a seven-day period compared to the same period the previous year shows an average drop of 34% in traffic.

Many other factors could contribute to this change, such as improved content and SEO reducing the number of pages users need to visit to find relevant information. Also, ongoing restructuring of site hierarchies and an overall reduction in the number of pages will also play a part in this lower value. Nevertheless, with a lower certainty on how many visitors will be tracked, we can no longer simply quote absolute values from Google Analytics. Indeed, we have avoided reliance on this for some time, instead using trends and user flow to influence how we design and build new web pages. Where we have reliance on any Goal Conversion measuring in Google Analytics, there will now be a higher chance that some users will complete a goal but not be tracked, so again trends rather than absolute values will need to be used.

How cookie consent looks in practice

When a new user arrives on the website, only a limited number of strictly necessary cookies are set, and any scripts or content that may require opt-in cookies are disabled by default. A popup notification gives users the option to accept our recommended settings, fine-tune their own preferences or dismiss the notice and continue to block all but the essential cookies.

University home page with cookie consent popup
Cookie notice shown as popup to new users.

If a user chooses to amend their preferences, then a panel overlays the website with simple toggle options for each category of cookie. There is also a link to a cookie notice that outlines the cookies managed by that particular implementation of Cookie Control.

University home page with cookie preferences overlay
Cookie control overlay to manage preferences.

Next steps for cookie consent

We realise that the cookies used across the diverse range of University websites and web applications will vary drastically, so a single instance of Cookie Control and one generic cookie notice will be insufficient. As we help roll this out across further systems, each will need to be audited to categorise and document all cookies, with the likely outcome being a separate instance of Cookie Control and cookie notice for each.

One limitation we have found is that some users may block Google Tag Manager from running in their browsers. In this situation, Cookie Control will not be accessible and therefore all content reliant on cookies will be unavailable to that user.

Related topics