SIX out of seven councils in Cumbria are not asking for the correct form of consent under privacy law when using cookies on their websites.

An investigation by the BBC Shared Data unit revealed that Carlisle, Copeland, Eden, South Lakeland and Barrow district councils, as well as Cumbria County Council were not asking users for express consent for cookies on their websites.

Allerdale council was the only district authority that did.

Cookies are small files of text that are often used to track users around the internet. They are the main technology used to gather data for targeted and behavioural advertising.

Many cookies are essential and are used to improve the browsing experience. They are used for audience measurement, hosting and website design.

Third-party advertising cookies help companies deliver ads that are relevant to users’ browsing habits.

Before cookies are placed on a user’s browser, a publisher must ask for and be given legal consent from the user under the PECR (Privacy and Electronic Communications Regulations).

Simon McDougall, the Information Commissioner’s Office’s executive director for technology policy and innovation, said: “The ICO has made looking at the use of ad-tech a priority. This investigation further highlights our concerns about the lack of transparency and consent when ad-tech is used.

“While the ICO is keen to promote innovative uses of technology, that cannot be at the expense of people’s fundamental legal rights.”

South Lakeland council said it was aware changes were needed to make it fully compliant with privacy law.

A spokesman for said: “We are aware changes are needed to our website to make it fully compliant with GDPR and are acting accordingly. We are in the process of setting up a new system whereby cookies will be turned off as a default setting and users of our website will have to give their consent for their use. This will come into operation imminently.

“We use cookies to help us improve how our website operates and to provide residents with a more personalised experience, for example in the area of web mapping to allow us to show maps as users left them after they have exited and returned to the site.

“We do not use advertising cookies on our website.

“We will not (and will not allow any third party) to use the statistical analytics tools we employ to track or to collect any personally identifiable information about visitors to our site."

Copeland councils said changes had already been made to ensure it complies with rules.

A spokesman for the authority said: “We have now updated the wording around cookies and consent on our website to ensure we are compliant with privacy laws.

“The cookies used on our site are for technical purposes only and are needed in order for our website to function.

“We do not use third party advertising, or tracking cookies.”

Other councils said they were in the process of reviewing their policy.

A spokesman for Carlisle City Council said: "We are committed to respecting the rights of individuals whilst providing them with a high level of service and website functionality.

“We have recently reviewed our use of cookies and advertisements and are in the process of further ensuring compliance with guidance and best practice. When someone visits our website, they have the option to accept cookies or to receive more information, which advises them how to change their settings. We have however identified that this process can be made more user friendly and we are working with our suppliers to make the necessary changes.”

The county council said it was compliant with privacy law and did not feature third party advertisement.

"Cumbria County Council has a cookie pop-up alert in place on our corporate website, however based on customer feedback this was set to be disabled for returning visitors for a 12 month period. This setting has now been amended so that it will now pop-up once daily when using the council website. People can now also choose to disable cookies as a personal preference. Having identified and implemented these improvements during the last year, the county council’s website is compliant with privacy law. The council website does not feature third party advertising and does not collect user information for anything other than tracking which council website pages have been visited. More information on the council’s cookie policy is available here: https://www.cumbria.gov.uk/admin/cookies.asp."

Eden council said its website directs users to a full list of cookies used, which are there only to monitor and improve the digital service.

A spokesman said: "Our website lists all the cookies and includes information on why they are used, how long the data is stored and how to disable them. It should be noted that the vast majority of the cookies expire when the user leaves our website. We have no advertising.

"If anyone is using our revenues and benefits pages there is GDPR information on the payment form. Our information on cookies was updated in December and we will continue to review it to ensure people can understand how we use cookies and how they can control them."

Allerdale council said it used the same system used by the ICO for cookies.

"We take the privacy of our web users extremely seriously and last year we introduced the same system used by the Information Commissioner’s Office to give users control over the cookies on the site. We keep this under review and recently improved the user controls over cookies placed by advert vendors."

Councillor Lee Roberts, Barrow Borough Council's spokesman for human resources, said: "We take the privacy of users very seriously and have always been transparent about cookies and their purpose on the council's website.

"Cookies have only ever been used to allow members of the public to access the website fully. We do not run any third party advertising.

"We have now updated the wording around our cookies and consent policy on our website and are reviewing all our cookies to ensure we are compliant with privacy laws."

The investigation by the BBC had found that some councils around the country allowed high-interest credit card ads targeted at people seeking benefits advice on UK local council websites.

There is no suggestion this was happening on local authorities' websites in Cumbria.