The cookie banner that appears at the top of the University website is being updated. Following some blog posts from the Information Commissioners Office during 2019 the University formed a GDPR and cookie consent task force. The group pulled in experts from around the University to explore what the next version of our cookie consent banner should be and what this might mean for you.

Towards the end of 2019 we started to review the EdWeb approach to getting website visitors consent to sharing their information with the University of Edinburgh. While this may seem a fairly boring subject it’s actually incredibly important. We should take privacy seriously and treat our website visitors data, whatever that may be, with the greatest of respect. Why? Because people trust the University of Edinburgh and we shouldn’t ever do anything to lose that trust.

What exactly is changing?

The main points

• No more pre-ticked checkboxes
• Clearer, less-technical language
• We can no longer interpret interaction with the site to imply consent

No more pre-ticked checkboxes

The current cookie banner has two pre-ticked checkboxes. One is for what we call performance cookies and one is to give consent for targeted advertising. We plan to remove both of these and concentrate more on getting explicit consent for advertising cookies.

Clearer, less-technical language

We need to be clearer about what information we are gathering, especially around analytics and advertising. Many people don’t fully understand what cookies are and while it’s important to use the appropriate language we can certainly make it easier for all our visitors to understand regardless of their technical knowledge. We need to make sure that people understand that they are consenting to our marketing advertising and what this can mean for them.

Interaction is not implicit consent

Currently we take interaction with the site to imply that a visitor has given their consent to us setting cookies and gathering information. We are stopping this approach and the new banner will not disappear until an option has been chosen. No advertising cookies will be set until explicit consent has been given.

Why the focus on advertising?

We use targeted advertising to help advertise events such as our open days. Adverts are a great way to remind people of these events and we try to target visitors who we feel are most relevant from the pages they have visited on our website. While we currently have an option for visitors to untick and opt out, user research shows that people don’t tend to carefully read and consider their interaction with cookie banners and tend to go with the default option. So we are making our use of advertising more explicit to make it easier for people to opt-out should they wish to do so.

What about Google Analytics?

For the time being we are sticking with Google Analytics and have moved this anonymised collection of data into our strictly necessary cookie section. We do recognise that this doesn’t give people the opportunity to remove their consent to analytics but we also recognise the importance of this data for the University. From user research and data we have from other sites who have presented the website visitor with the choice to opt-in to sharing analytics we have seen that most will ignore this which leads to a very substantial loss of data. As we’ve already said we definitely want to avoid any pre-ticked checkboxes which leaves our current approach as the only viable one. Having said that clarity on this subject will come soon and as a data driven University we should prepare for the possibility of the loss of all or nearly all of our analytical data.

Change is coming

We plan to update our cookie banner by April 2020 and development is on track to complete by this date.

It would be wrong to think that this current approach will stay the same for ever. Privacy laws, along with accessibility, are not totally clear cut issues. Privacy legislation is not the same as road traffic speeding laws where you can get points on your licence for doing 34mph in a 30mph zone. There are many more complexities and grey areas. However clarity will come and when it does we’ll be ready to respond and update our approach to be in line with any new recommendations, trends or to meet our target audience expectation.

Blog posts from the Information Commissioners Office

July 2019

Cookies – what does ‘good’ look like?

Guidance on the use of cookies and similar technologies