04-Apr-2026 — Privacy, Cookies and PECR Compliance #214

This article explains what NGX Ramblers stores on users' devices, why no cookie consent banner is needed, and how the platform remains compliant with PECR (Privacy and Electronic Communications Regulations) and UK GDPR. It also covers the available analytics options and their privacy implications.

What Gets Stored on the User's Device?

NGX Ramblers does not set any HTTP cookies from application code. Instead, it uses browser localStorage for two categories of data:

No personal data, analytics identifiers, or tracking information is stored in localStorage.

flowchart LR
    USER@{ icon: "ngx:user", label: "User", pos: "b", h: 48 }
    SPA@{ icon: "logos:angular-icon", label: "Angular SPA", pos: "b", h: 48 }

    subgraph ls["Browser localStorage"]
        JWT["Auth Token (JWT)"]
        PREFS["UI Preferences"]
    end

    USER -->|"Login"| SPA
    SPA -->|"Stores"| JWT
    USER -->|"Sets preferences"| SPA
    SPA -->|"Stores"| PREFS

    style ls fill:#E8F5EE,stroke:#9BC8AB,stroke-width:2px,rx:12,ry:12,color:#404143

Why No Cookie Consent Banner?

This is a deliberate design decision, not an oversight. Here's the legal reasoning.

PECR Regulation 6

PECR requires prior consent before storing information on a user's device — but provides an exemption in Regulation 6(4) for storage that is "strictly necessary for the provision of an information society service explicitly requested by the user".

How Our Storage Qualifies

JWTs (JSON Web Tokens) — The user explicitly requests to log in. The token is essential to provide that service. This is the same exemption that covers session cookies on every website with a login form. Without the token, the login function cannot work.

UI preferences — The ICO's guidance specifically states that storage used to "remember choices the user has made" qualifies as strictly necessary, provided:

1. The user actively made the choice (they set the filter, picked the map zoom, chose the sort order)
2. The storage is needed to give them what they asked for (without it, preferences reset on every page load)
3. It is not used for any other purpose (no tracking, no profiling, no analytics)

All of our localStorage values satisfy these three conditions.

What Would Require Consent

The PECR consent requirement applies to non-essential storage — things that serve the site operator's interests rather than the user's:

Since NGX Ramblers (with no analytics tracking ID configured) stores nothing that falls in the left column, no consent mechanism is required.

The Cookie Banner Paradox

Cookie banners exist because PECR requires them when non-essential cookies are set. They have no useful purpose on a site that sets no non-essential cookies. Adding a banner to a cookie-free site would:

• Imply to users that non-essential tracking is occurring (when it is not)
• Degrade the user experience for no compliance benefit
• Create a false impression of transparency by asking consent for something that doesn't happen

The stronger privacy position is to simply not set non-essential cookies in the first place — then state clearly in your privacy policy what is stored and why.

Analytics Options

NGX Ramblers provides two analytics paths, each with different privacy implications.

Option 1: Google Analytics (Built-in)

Google Analytics is configurable per-instance via System Settings > Google Analytics in the admin panel. When a tracking ID is set, the platform dynamically loads Google Tag Manager which sets analytics cookies.

flowchart LR
    USER@{ icon: "ngx:user", label: "User", pos: "b", h: 48 }
    SPA@{ icon: "logos:angular-icon", label: "Angular SPA", pos: "b", h: 48 }
    GTM@{ icon: "logos:google-analytics", label: "Google Tag Manager", pos: "b", h: 48 }

    USER --> SPA
    SPA -->|"Loads if trackingId configured"| GTM
    GTM -->|"Sets _ga, _gid cookies"| USER

    style GTM fill:#FFF3E0,stroke:#F6821F,stroke-width:2px,rx:12,ry:12,color:#404143

Option 2: Cloudflare Web Analytics (Planned)

Cloudflare Web Analytics is a cookieless, privacy-first analytics solution. It collects page views and visitor metrics without storing anything on the user's device.

flowchart LR
    USER@{ icon: "ngx:user", label: "User", pos: "b", h: 48 }
    SPA@{ icon: "logos:angular-icon", label: "Angular SPA", pos: "b", h: 48 }
    CF@{ icon: "ngx:cloudflare", label: "Cloudflare Analytics", pos: "b", h: 48 }

    USER --> SPA
    SPA -->|"Beacon (no cookies)"| CF

    style CF fill:#E8F5EE,stroke:#9BC8AB,stroke-width:2px,rx:12,ry:12,color:#404143

This follows the same operational model as email routing — the platform manages the Cloudflare API centrally, while group administrators configure and view their own analytics through the admin panel.

Comparison

flowchart TB
    subgraph ga["Google Analytics"]
        GA_PROS["Self-service setup<br/>Rich reporting<br/>Industry standard"]
        GA_CONS["Sets tracking cookies<br/>Consent mechanism needed<br/>Data shared with Google"]
    end

    subgraph cfa["Cloudflare Web Analytics"]
        CF_PROS["Zero cookies<br/>No consent needed<br/>Privacy-first<br/>Free"]
        CF_CONS["Platform-managed setup<br/>Simpler metrics<br/>Built-in dashboard only"]
    end

    style ga fill:#FFF3E0,stroke:#F6821F,stroke-width:2px,rx:12,ry:12,color:#404143
    style cfa fill:#E8F5EE,stroke:#9BC8AB,stroke-width:2px,rx:12,ry:12,color:#404143

Writing a Privacy Policy

Based on the above, an accurate privacy policy for an NGX Ramblers site should state:

1. Browser storage — The site uses browser localStorage to maintain login sessions (JWTs) and remember display preferences. These are strictly necessary for site functionality and are not shared with third parties.

2. If Google Analytics is enabled — The site uses Google Analytics which sets cookies to collect anonymous usage data. Explain which cookies are set and their duration.

3. If Cloudflare Web Analytics is enabled — The site uses Cloudflare Web Analytics to collect anonymous page view statistics. No cookies or device storage is used.

4. What is NOT collected — No advertising trackers, no behavioural profiling, no third-party data sharing beyond the analytics provider (if configured).

New instances automatically receive a default privacy policy during environment setup, pre-populated with the group name and site URL. This can be edited in site-edit mode at /privacy-policy. See EKWG's privacy policy for an example of an accurate, up-to-date policy.

Clarification: Issue #43

Cookie Banner Breaks Automated Ramblers Upload (#43) is sometimes referenced in the context of cookies on NGX Ramblers sites. This issue is unrelated — it refers to a server-side automated process that uses a headless Chrome instance to publish walks to the Ramblers Walks Manager. The cookie banner in that issue is on the Ramblers Head Office website (ramblers.org.uk), not on any NGX Ramblers instance.

Summary

The platform is designed to be PECR-compliant by default. With no analytics tracking ID configured, no non-essential storage is set on users' devices, and no cookie consent mechanism is required.

Related Issues

• #214 — Privacy Policy
• #217 — Cloudflare Web Analytics integration for per-group cookieless analytics
• #43 — Cookie Banner Breaks Automated Ramblers Upload (unrelated server-side issue)