What are cookies?
A cookie is a small file stored on a user’s device when visiting a website. Many sites use cookies; some are necessary to make a site work, others are optional to help improve the user’s experience.
Any website that gathers user information must comply with the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR).
To comply, you must:
- tell people your site has cookies
- explain what the cookies are doing and why, and
- get the person’s consent to store a cookie on their device.
On the University's main site, www.cam.ac.uk we have a cookie management tool to do this. Now, when a user chooses to opt out of cookies, some changes will occur including:
- Google Analytics will no longer collect data
- Embedded YouTube videos will not load
There are two parts to ensuring cookies are managed correctly on your website:
- Install or configure cookie controls on your website
- Audit, improve or remove embedded code on your website which is introducing cookies
Installing and configuring cookie controls on your website
We recommend the use of CIVIC Cookie control for which we have a central licence for use on cam.ac.uk sites. UIS-hosted Drupal sites will have CIVIC Cookie Control automatically added. If your site is not on a cam.ac.uk domain, you will need to arrange a CIVIC licence for your site or organise an alternative solution.
Visit the CIVIK UK site to learn more about Cookie Control
View guidance for using CIVIC Cookie Control with WordPress (Word document)
Sites can install CIVIC using Google Tag Manager. You'll be asked for the API Key and Product, which you can find on the Web and Intranet programme site.
Here are some example sites with CIVIC already installed:
Once installed, you need to make sure that the cookie controls are configured to manage any third-party content on your site such as Google Analytics.
Checking cookie controls are working as expected
We recommend site owners regularly check that the cookie controls on their website are working as expected.
There are tools available to help you do this. CookieYes and CookieBot offer free reviews.
Content embedded using an iframe is likely to introduce cookies not recognised or managed by cookie control. Typical embeds that can cause problems include:
- YouTube or Vimeo videos
- Social media posts from X (formerly Twitter) or Instagram
- Maps from services like Google Maps
- Audio from platforms like Spotify or SoundCloud
- Forms like Google Forms
- Calendars like Google Calendar, Calendly or Eventbrite
As an example, if a user opts out of social and marketing cookies on the central cam.ac.uk site YouTube videos will not load.
UIS-hosted Drupal site owners can add a placeholder for YouTube and Vimeo by following our step-by-step guidance to adding a placeholder.
Shorthand have applied a similar update to their stories. If you have existing Shorthand stories with embedded iframe content you will need to republish them for the change to take effect. Follow our step-by-step guidance to republishing a Shorthand story.
Adding cookies to your site's cookie notice
You will need to create a 'Cookies' web page to clearly describe any cookies on your site. Please refer to https://www.cam.ac.uk/about-this-site/cookies as an example.
UIS-hosted site owners can follow our step-by-step guidance to creating a local cookie policy page in Drupal 7.