UK Local Council Cookie Compliance

"We care about your privacy." This promise greets visitors to the London Borough of Harrow website. It is a common phrase. It is also, in this case, false.

A scan of the site reveals that Harrow sets Google Analytics trackers the moment a user arrives. No one has clicked "Accept." No one has given consent. The privacy banner is there, but it does nothing. The trackers have already started their work.

Harrow is not alone. Out of 241 council websites scanned, 88 failed for this exact reason. These sites claim to respect your choice while they ignore it. They drop cookies for marketing and analytics before a user can say no. For these public bodies, privacy is a legal disclaimer rather than a technical fact.

The failure is often a choice. Some councils use the same tools as Havant but get it right. Wirral Council and North Yorkshire Council use the "Civic Cookie Control" platform to block trackers until a user consents. They pass. Yet 24 other councils use that same software and fail. This shows that privacy depends on how a site is built, not just the software bought to protect it.

Does it matter? It certainly does, according to the (UK government and ICO guidance)[https://design-system.service.gov.uk/patterns/cookies-page/]:

The Information Commissioner’s Office (ICO) has guidance on what types of cookie are likely to be considered ‘strictly necessary’. For example, load balancing cookies are likely to be strictly necessary - but cookies that collect analytics data are not.

You must get the user’s consent before you set any cookies that are not strictly necessary.

Methodology

Scans were performed using ConsentScout with headless Chromium (Windows desktop user agent, en-GB locale). Each URL was loaded once in a fresh browser context (no stored cookies, no cached storage, no prior consent state) with no user interaction. A site is marked PASS only if, on first load, (1) no cookies classified as non-required (Analytics, Marketing, or Personalisation) are set, and (2) a recognised Consent Management Platform (CMP) is detected. FAIL indicates that one or more cookies were set on first load that are not typically considered "required" for delivering the requested service (e.g., analytics identifiers, marketing tags, cross-site IDs, or similar). WARN indicates cookies were set that ConsentScout could not confidently classify and therefore require manual verification. Sites returning HTTP errors, DNS failures, or timeouts are excluded from PASS/WARN/FAIL totals.