A new report reveals that the vast majority of EU member state websites are laden with third-party cookies that are not disclosed to visitors.
Cookiebot, a service to make websites GDPR and EPR compliant, scanned more than 180,000 EU government web pages over the course of two days to analyze cookie behavior on these sites.
It discovered that only three government websites out of of 28 did not contain any third-party tracking cookies. All in all, it discovered 112 different ad tracking companies on EU public sector websites.
Government sites in Germany, the Netherlands and Spain did not contain commercial cookies. France, Latvia, Belgium and Greece sites had more than 15 cookies each during scans, with France taking the crown with 52 different ad trackers found on government web pages.
The findings come as a surprise for two main reasons. First, because one would expect that official government websites follow regulations in regards to cookie usage and tracking to the letter, especially since they expect public sites to do so. Second, because these sites don't depend on advertising revenue as they are publicly funded.
Cookiebot analyzed public health service sites in six member states in the UK, Germany, France, Italy, Ireland, and Spain, as well and found a large number of ad trackers in most cases.
The percentage of landing pages with ad trackers ranged from 73% in Ireland to 33% in Germany. A German public health service site loaded trackers by 63 different tracking companies alone.
The company identified 112 different companies that tracked citizens from the EU that visited the analyzed government or public health service sites. Ten of these could not be identified as they masked their identity according to Cookiebot.
Google dominates the tracking on government and public health sector sites. Three of the top five domains with government site trackers are owned by Google, and two of the top five domains with public health site trackers are owned by the company as well.
Google tracks visits to 82% of the scanned government websites and 43% of the scanned Public Health sector sites.
Top 5 trackers on EU government sites:
Top 5 trackers on Public Health Service landing pages:
Why are these trackers on these sites?
Third-party service plugins and embeds are the main way in which trackers landed on government and public health sector websites according to the report.
Examples given include use of analytics software or share plugins, third-party media embeds, or use of third-party galleries or comment plugins.
What can you do about it?
One of the easier options is to block third-party cookies in your browser of choice. In Firefox, you can disable all third-party cookies, or configure Firefox to clear cookies on exit.
Content blockers like uBlock Origin help as well as they block connections to many of these sites automatically and come with options to add undetected connections as well.