>[...]
>Nothing out of the ordinary here
looks like you're not picking up a bunch of requests. maybe you have ublock? Here are some domains that aren't on your list:
www.google-analytics.com
script.hotjar.com
cse.google.com
vars.hotjar.com
www.facebook.com
stats.g.doubleclick.net
static.hotjar.com
connect.facebook.netGoogle Analytics, Hotjar are measurement tools. CSE is google's custom search endpoint, stats.*.doubleclick.net is a doubleclick for publishers endpoint (Google's ad server) and doesn't mean much by itself, it doesn't automatically show ads from third parties or send your data to anyone.
The Facebook tags are sadly quite popular these days, I do agree those are not ideal but they are literally all over the net with like buttons, share buttons and "sign in with facebook"
Both Facebook and Google are advertising companies. Both of them have littered the web with their scripts and GIFs making it possible for them to track everything we do. The only difference is how we trust them with our data, and honestly I think they are very equal in this regard. Both of them will track us as much as possible within applicable legislation and their own terms.
- https://static.hotjar.com/c/hotjar-1043047.js?sv=5
- https://cse.google.com/adsense/search/async-ads.js
- https://connect.facebook.net/en_US/fbevents.js
Also, the site is setting a cookie even though I've not consented.
EDIT: Also, one of the lambeth.gov js scripts was written by "rob" in 2015. Hi Rob!
However that's how the vast majority of sites implement the cookie consent regulation, and authorities (like ICO in UK) has decided to not do anything about it.
not up on cookies and Gdpr tbh, I deal with other types of data normally.
[1] https://www.eff.org/privacybadger/faq#What-do-the-red,-yello...
Other than that, you are right that it's hard to find what's wrong with that Lambeth website. However the GTM could be a gateway to any kind of data tracking (visited pages, button clicked, etc.) idk if you can actually find out from the console.
Ah I see. Agreed there.
The report says Lambeth shows 1 real time bidding, 1 social and 5 Google "trackers".
From my network requests I see:
-> Google Translate and its resources (CSS etc.)
-> Google Font
-> jQuery and a bunch of various modules
-> leafletjs (OSS Map library)
-> Google tag manager
-> The social links at the bottom are just links, no requests or trackers.
Note: None are blocked by PB, only cookies are denied)
Nothing out of the ordinary here (although you could argue against GTM on a council website). I'm not seeing what's at risk here? And according to the report, the above requests should be ignored in the results?
Caveat 1:
> This is not a complete study. Third party tools commonly used by websites for chat bots, designing the page, soliciting email subscription, profiling visitors for the Council’s own user data base, text to speech, CDN, fonts, non-Google analytics, etc. are not counted in this study. (See “table notes” on page 20 for a list of what is counted).
> While these do expose a user’s behaviour to the companies concerned, we exclude them here in order for simplicity.This study highlights what we view as the most dangerous third party data collection and profiling.
To compare, the landing page that this report is hosted on has the following "trackers"/requests:
-> Brave.com Analytics request that is blocked
-> Google Fonts
-> Google Tag Manager
-> Google Analytics (blocked by PB)
-> Mapbox
-> Scorecard research (blocked by PB)
-> Newrelic
-> Slideshare (blocked by PB)
-> Leaderapps
-> Tableau
-> Vimeo (cookies blocked by PB)
Edit: Sorry - PB is Privacy Badger.
As for my personal feelings, "widespread surveillance" makes it appear as though there is some sort of malicious intent here. I have a few friends (and mother) who have previously or currently work for local councils, there is no money for this sort of thing. At worst I believe any actual issues are due to ignorance (which isn't an excuse) but could be easily remedied. This is way too dramatic for what should be a "Hey ICO, these councils are potentially not doing things properly, could you have a look?". Instead you'd think Brave have uncovered a PRISM level conspiracy on the local government level.
Poor taste IMO.