Cookie consent and privacy notices for council websites

A council website collects more than people think. The contact form takes a name and an email address. Analytics, if you use them, can identify a browser. The minutes name councillors, and sometimes residents. Two sets of rules apply, and they are not the same rule.

UK GDPR, together with the Data Protection Act 2018, is about personal information. A privacy notice is how you tell people what you do with it. PECR, the Privacy and Electronic Communications Regulations 2003, is about storing information on a user’s device or reading information already stored there. Cookies are the usual example. The ICO’s guidance on storage and access technologies (opens in a new tab) is the current detailed guide, and it says the rules apply to public authorities. This page follows that guidance. It is not a privacy notice for your council.

The council is the controller

On the council’s own website, the council is the controller. The company that built or hosts the site is not. If we host a council site, our terms say the council is the controller and we are the processor, which is the split required by Article 28 of the UK GDPR. The council’s privacy notice should name the council, not Parish Digital, as the organisation deciding why the information is used.

Our privacy notice is different. It covers enquiries to parishdigital.co.uk, where Room Filler Ltd is the controller. Do not copy it onto a council site and change the logo. The purposes are not the same. You can read it as an example of the headings, then write your own.

A useful notice, following the ICO’s right to be informed (opens in a new tab) guidance, tells people:

• Who the controller is, and how to contact the clerk. Most parish councils do not have a data protection officer. Say so if that is the case, and give a real email address.
• What you collect. Contact forms, allotment waiting lists, newsletter sign-ups, councillor names you publish, and any analytics.
• Why you collect it, and the lawful basis. Publishing councillor names and meeting papers is often linked to a public task or a legal duty. That is a decision for the council. We will not pick a basis and drop it into your notice as if we were your solicitor.
• Who else sees it. Name the host, the email provider, and any form tool. If we host, Cloudways is the host named in our terms.
• How long you keep it. A contact form is not “kept indefinitely” and it is not “kept only as long as necessary” with no number. Pick a period the council can actually apply.
• The rights people have: access, correction, deletion, restriction, objection, and portability where the basis allows it. Say they can complain to the ICO, and link ico.org.uk/make-a-complaint (opens in a new tab).
• Whether they have to provide the information. A resident does not have to use the contact form. If they do not, you may not be able to reply.

Write it in the same plain English you would use in a letter. Link it from the footer. If you collect information on a form, link the notice next to that form, not only in the footer of the homepage.

Cookies and PECR

PECR sits on top of that. The ICO’s guide explains regulation 6: you must tell people about storage and access technologies, explain what they do, and get consent before you use them, unless an exception applies. Consent here is a UK GDPR standard of consent. It is a clear positive action. Carrying on to use the site is not consent. A box that is already ticked is not consent. You need to be confident the person knew what they were agreeing to.

The exception clerks actually need is the one for technologies that are strictly necessary to provide a service the person asked for. A cookie that remembers the consent choice itself is the usual example. A cookie that keeps a signed-in clerk inside the WordPress admin, while they are signed in, is another. Analytics cookies are not in that group. If you want numbers on how many people read the homepage, you ask first, and you do not set the analytics cookie on the first visit before they have chosen.

Say, in the notice or in the cookie information:

• The name of the cookie, or a clear description if the name is meaningless.
• What it does.
• Whether a third party sets it or receives the information.
• How long it lasts.

Our cookies page does this for parishdigital.co.uk. It is a model of the headings, not a list you can paste. Your site may use different tools. If you use no analytics and no embedded videos, say that. A banner for cookies you do not set trains people to ignore you.

The ICO updated its detailed guidance in 2026. Read the current storage and access guidance (opens in a new tab) rather than an old blog post that talks only about “cookie banners” in the abstract. The regulations themselves are the Privacy and Electronic Communications Regulations 2003 (opens in a new tab). The ICO’s wider UK GDPR guidance (opens in a new tab) covers the privacy notice side.

Publishing names is not a reason to skip the notice

The Transparency Code expects you to publish councillor names and, for payments, enough detail to see where money went. The older code text talks about data protection law not blocking the publication of decision-makers’ names. That does not mean the council can publish anything about anyone. A resident’s medical information in a grants minute, a staff home address, or a signature scanned at high resolution are the sort of things to stop and think about before they go on the web. Redact what you should not publish. The privacy notice should still exist, because you are publishing personal information and because the contact form collects it.

Marketing email is a separate PECR question. Our own privacy notice says we may email a council address about similar website services, and that we do not email a personal address for marketing unless that person has agreed. A council writing to its residents about a newsletter needs its own basis. Do not assume a precept payer has asked for email.

What to do this month

Read the notice you have, if you have one. Check it names the council as controller, gives the clerk’s contact, lists the forms you actually use, and links a way to complain to the ICO. Then look at what the site sets on a first visit, before anyone clicks anything. If a statistics cookie appears before a choice, turn that off or ask first.

We include a privacy page and a cookies page in a new council site, for the council to edit. We do not register the council with the ICO, and we do not answer subject access requests. Those stay with the controller.

The free website check looks at whether the public site has a privacy notice and a cookie choice, alongside the accessibility statement and HTTPS. It is a short look. It is not a data protection audit, and it is not a finding that your notice is sufficient.