Hello guys. I am writing to you in the hope of finding a solution and understanding something. I created a website with WordPress. The privacy policy lawyer required me to catalog all cookies used. However, I came across a situation that puzzled me. A few week ago, using the browser development tools (chrome and safari) I noticed that the presence of fifteen or more cookies, while at other times they seemed to disappear completely. This discrepancy also occurs when I check from different devices and can persist for weeks despite the cookie expiration date being years. I have tried to scan the site with various cookie scanning tools but can only detect one cookie and other times none. Recently, I asked the support of my hosting service to run a check, they identified about twenty cookies, all of which disappeared within a few minutes. I requested a re-verification today and they only found one. I even changed my browser settings to accept all cookies as I thought it was my problem, but that didn’t solve the mystery of these fluctuations. I no longer know which cookies to include in the privacy policy at this point. Does anyone have any idea what I can do to fix it? A thousand thanks.
Hi, do you have a link to the site where we can observe this happening?
Hi James, thanks for your reply, sure, it’s my friend’s/customers’ website: https://neurochirurgiaboari.it
I’ve just been navigating around the site in Firefox with no extensions installed (so not blocking anything). For me, the only cookie that was set from your client’s domain in this entire time was a cookie to say that I accept cookies when I accepted the cookie banner.
So really, this is your main question. Not so much “why are my cookies disappearing”, as “what do I need to tell the lawyer about, so that they can cover it in the privacy policy”.
I’m no legal expert, but I did notice a couple of things that would need to be covered.
Here, you are using embedding a YouTube video: https://neurochirurgiaboari.it/trattamento-multimodale-meningiomi-intracranici/
As a visitor to this site, this will send my IP to Google when I load the page, so it needs to be covered in your privacy policy. If you also inspect the browser console on this page, you will see several cookies from YouTube.
In Germany (where I’m based), this is not really legal. To be 100% compliant you would need to implement a “click to load” solution, with a small disclaimer that information will be sent to Google’s servers.
Same thing goes for these pages:
- https://neurochirurgiaboari.it/contatti-ambulatorio-milano-e-cremona/
- https://neurochirurgiaboari.it/prendi-un-appuntamento/
Here you are embedding Google Maps and Google is storing cookies on my machine.
You are also using some kind of booking widget that likely transmits information to the doc via a 3rd party. You will need to cover this in the privacy policy, too.
Privacy policies can be something of a nightmare, especially for doctors, so if I was you I would make a map of your site (just grab a plugin), then look at all of the external services you are embedding. These will definitely need covering. Then look at all of the WP plugins you are using and see if any of them is making use of client-side storage (it’s not just cookies you need to be aware of but local storage, Indexed DB etc). Technically required cookies are fine (e.g. to remember a user’s preference for dark mode), but anything involving personally identifying information needs covering.
As a final thought, you have the option “No” in your cookie banner, but clicking it makes no difference to whether cookies are stored or not.
Sorry I couldn’t really answer “where are my cookies”, but hopefully this still gives you something to go on.
P.S. In Germany, there are various privacy policy generators which will walk you through a set of questions like “Does your site do this?”, “Does your site use that?” before generating the document for you. Maybe try and find something like that which will give you a few more pointers to go on?
James, thank you so much for your detailed analysis. At this point I would say that it would be appropriate to carry out a more in-depth assessment. Thanks again! You are really very kind!
This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.