Skip to main content
CAROClimate Action Regional Offices
An accessible timber boardwalk with handrails crossing dunes and marram grass towards an Atlantic beach.

Governance

Privacy and cookies

The proposed build loads no non-essential script before consent is recorded, and removes behavioural session-replay tooling entirely.

Findings from the current site

  • Analytics and three separate session-replay tools were observed firing before any consent choice was made.
  • Replay tooling also loaded on the portal login page, an authenticated surface.
  • The consent management platform was present but not configured to gate tag execution.

Proposed posture

  • Strictly necessary cookies only until explicit, granular consent.
  • No session replay, heatmapping or behavioural tracking on any page.
  • Analytics configured with IP truncation and no advertising signals.
  • Consent state auditable, revocable and re-presented on policy change.
  • Data Protection Impact Assessment prepared with the data controller.
  • Records of processing, retention schedules and processor list documented at handover.

Manage your choices

This prototype implements the proposed consent model in full: four independent purposes, equal-weight accept and reject, an auditable record with policy version and timestamp, and withdrawal at any time.

Cookie and storage purposes
PurposeLawful basisRetention
Strictly necessarySecurity, routing, accessibility preferences and portal sign-in.Exempt under Regulation 5(5), S.I. 336/2011 — technically required.Session, or 12 months for the consent record itself.
Audience measurementAggregate page and search analytics used to improve the service.Consent.14 months, aggregated thereafter.
Embedded mediaPlay video and mapping embeds inline instead of opening the provider.Consent.Set by the provider once loaded.
Functional preferencesRemember your region, filters and reduced-motion choice between visits.Consent.6 months.

ProvenanceObservations above are behaviours recorded during Stage 0 read-only inspection of the live site (see docs/integration-register.md and docs/risk-register.md). They are technical observations, not legal conclusions; the data controller’s DPO should confirm impact.