Cookie Guidelines

C) Guidelines

If cookies are used on your site, there are certain procedures that must be followed under current legislation and these are indicated in the guidelines.

The Guidelines follow a chronological order in checklist format starting with a review of your current practices.

Step One: Review current practices

Designate an Official Responsible for Cookies: Consider appointing an official within your institution who will oversee and co-ordinate the appropriate use of cookies within your institution. The official should establish a procedure requiring his or her approval for all uses of cookies (and other related tracking technologies) and ongoing monitoring of their use.

Analyze and document all cookie contact points: This activity will show every point of contact on your Web site where cookies are presently being used and where they will appear in Web sites under development. Be sure to also look for cookies that have been added by contractors, Web publishers, partners, sponsors and advertisers (if your site accepts advertising). Cookies are a common tool for Web designers. It is possible for Web sites to have cookies without departmental knowledge and for a partner, sponsor or advertiser to embed a cookie into an ad or logo on your site.

Assess relationships: Review the practices of all contractors, partners and third parties to assess their plans to protect privacy. You will use these assessments to ensure other organizations contributing to your Web site follow these guidelines. Your organization could be open to adverse publicity risks if a linked or "partnership" Web site has questionable privacy practices.

Step Two: Determine if cookies are necessary

Government of Canada Web sites should use cookies only when their use is necessary to provide an important value-added service that cannot be reasonably provided through a less privacy-invasive means.

Wherever possible, government Web sites should facilitate anonymous collection of information by visitors. Always ask the question and carefully assess whether the desired service can be provided in a way that does not require the collection of personal information.

Departments and agencies should try to avoid using persistent cookies if possible because they are stored on a visitor's hard drive and are viewed by the public as more intrusive and worrisome.

Step Three: Provide visitors with an option to access resources without cookies

Government programs should ensure that visitors who do not wish to access Government of Canada Web pages with cookies can obtain the government service in some other way. This may involve providing duplicate online access that does not use cookies or informing visitors how they can obtain the same services through another service channel such as a toll-free phone number, in-person, fax and direct mail (if no on-line alternative is reasonably available). Off-line access can include toll-free phone numbers, faxing, direct mail and in-person.