This article explains what NGX Ramblers stores on users' devices, why no cookie consent banner is needed, and how the platform remains compliant with PECR (Privacy and Electronic Communications Regulations) and UK GDPR. It also covers the available analytics options and their privacy implications.
NGX Ramblers does not set any HTTP cookies from application code. Instead, it uses browser localStorage for two categories of data:
| Category | Examples | Purpose |
|---|---|---|
| Authentication tokens | JWT, refresh token | Maintains logged-in sessions for members |
| UI preferences | Map zoom, search filters, sort orders, view modes, grid layout | Remembers display choices the user has actively made |
No personal data, analytics identifiers, or tracking information is stored in localStorage.
flowchart LR
USER@{ icon: "ngx:user", label: "User", pos: "b", h: 48 }
SPA@{ icon: "logos:angular-icon", label: "Angular SPA", pos: "b", h: 48 }
subgraph ls["Browser localStorage"]
JWT["Auth Token (JWT)"]
PREFS["UI Preferences"]
end
USER -->|"Login"| SPA
SPA -->|"Stores"| JWT
USER -->|"Sets preferences"| SPA
SPA -->|"Stores"| PREFS
style ls fill:#E8F5EE,stroke:#9BC8AB,stroke-width:2px,rx:12,ry:12,color:#404143
This is a deliberate design decision, not an oversight. Here's the legal reasoning.
PECR requires prior consent before storing information on a user's device — but provides an exemption in Regulation 6(4) for storage that is "strictly necessary for the provision of an information society service explicitly requested by the user".
JWTs (JSON Web Tokens) — The user explicitly requests to log in. The token is essential to provide that service. This is the same exemption that covers session cookies on every website with a login form. Without the token, the login function cannot work.
UI preferences — The ICO's guidance specifically states that storage used to "remember choices the user has made" qualifies as strictly necessary, provided:
All of our localStorage values satisfy these three conditions.
The PECR consent requirement applies to non-essential storage — things that serve the site operator's interests rather than the user's:
| Requires consent | Does not require consent |
|---|---|
Analytics cookies (_ga, _gid) |
JWTs (authentication) |
| Advertising/tracking pixels | UI preferences set by the user |
| Third-party behavioural profiling | Session state for requested features |
Since NGX Ramblers (with no analytics tracking ID configured) stores nothing that falls in the left column, no consent mechanism is required.
Cookie banners exist because PECR requires them when non-essential cookies are set. They have no useful purpose on a site that sets no non-essential cookies. Adding a banner to a cookie-free site would:
The stronger privacy position is to simply not set non-essential cookies in the first place — then state clearly in your privacy policy what is stored and why.
NGX Ramblers provides two analytics paths, each with different privacy implications.
Google Analytics is configurable per-instance via System Settings > Google Analytics in the admin panel. When a tracking ID is set, the platform dynamically loads Google Tag Manager which sets analytics cookies.
flowchart LR
USER@{ icon: "ngx:user", label: "User", pos: "b", h: 48 }
SPA@{ icon: "logos:angular-icon", label: "Angular SPA", pos: "b", h: 48 }
GTM@{ icon: "logos:google-analytics", label: "Google Tag Manager", pos: "b", h: 48 }
USER --> SPA
SPA -->|"Loads if trackingId configured"| GTM
GTM -->|"Sets _ga, _gid cookies"| USER
style GTM fill:#FFF3E0,stroke:#F6821F,stroke-width:2px,rx:12,ry:12,color:#404143
| Aspect | Detail |
|---|---|
| Setup | Self-service — enter your Google Analytics tracking ID in admin panel |
| Data access | Direct — log in to Google Analytics with your own Google account |
| Cookies set | _ga (2 years), _ga_* (2 years), _gid (24 hours) |
| PECR impact | These are non-essential cookies — strictly speaking, a consent mechanism is required |
| Default state | Disabled — no tracking ID is configured by default, so no cookies are set |
Cloudflare Web Analytics is a cookieless, privacy-first analytics solution. It collects page views and visitor metrics without storing anything on the user's device.
flowchart LR
USER@{ icon: "ngx:user", label: "User", pos: "b", h: 48 }
SPA@{ icon: "logos:angular-icon", label: "Angular SPA", pos: "b", h: 48 }
CF@{ icon: "ngx:cloudflare", label: "Cloudflare Analytics", pos: "b", h: 48 }
USER --> SPA
SPA -->|"Beacon (no cookies)"| CF
style CF fill:#E8F5EE,stroke:#9BC8AB,stroke-width:2px,rx:12,ry:12,color:#404143
| Aspect | Detail |
|---|---|
| Setup | Platform-managed — enabled per group via admin settings |
| Data access | Built-in analytics dashboard in the admin panel |
| Cookies set | None |
| PECR impact | No consent required — nothing stored on user's device |
| Metrics available | Page views, visits, top paths, countries, device types, web vitals |
| Cost | Free on all Cloudflare plans |
This follows the same operational model as email routing — the platform manages the Cloudflare API centrally, while group administrators configure and view their own analytics through the admin panel.
flowchart TB
subgraph ga["Google Analytics"]
GA_PROS["Self-service setup<br/>Rich reporting<br/>Industry standard"]
GA_CONS["Sets tracking cookies<br/>Consent mechanism needed<br/>Data shared with Google"]
end
subgraph cfa["Cloudflare Web Analytics"]
CF_PROS["Zero cookies<br/>No consent needed<br/>Privacy-first<br/>Free"]
CF_CONS["Platform-managed setup<br/>Simpler metrics<br/>Built-in dashboard only"]
end
style ga fill:#FFF3E0,stroke:#F6821F,stroke-width:2px,rx:12,ry:12,color:#404143
style cfa fill:#E8F5EE,stroke:#9BC8AB,stroke-width:2px,rx:12,ry:12,color:#404143
Based on the above, an accurate privacy policy for an NGX Ramblers site should state:
Browser storage — The site uses browser localStorage to maintain login sessions (JWTs) and remember display preferences. These are strictly necessary for site functionality and are not shared with third parties.
If Google Analytics is enabled — The site uses Google Analytics which sets cookies to collect anonymous usage data. Explain which cookies are set and their duration.
If Cloudflare Web Analytics is enabled — The site uses Cloudflare Web Analytics to collect anonymous page view statistics. No cookies or device storage is used.
What is NOT collected — No advertising trackers, no behavioural profiling, no third-party data sharing beyond the analytics provider (if configured).
New instances automatically receive a default privacy policy during environment setup, pre-populated with the group name and site URL. This can be edited in site-edit mode at /privacy-policy. See EKWG's privacy policy for an example of an accurate, up-to-date policy.
Cookie Banner Breaks Automated Ramblers Upload (#43) is sometimes referenced in the context of cookies on NGX Ramblers sites. This issue is unrelated — it refers to a server-side automated process that uses a headless Chrome instance to publish walks to the Ramblers Walks Manager. The cookie banner in that issue is on the Ramblers Head Office website (ramblers.org.uk), not on any NGX Ramblers instance.
| Component | Device storage | Consent required? |
|---|---|---|
| NGX Ramblers app | localStorage (JWTs + preferences) | No — strictly necessary |
| Google Analytics | Cookies (_ga, _gid) |
Yes — if tracking ID configured |
| Cloudflare Web Analytics | None | No |
| Font Awesome CDN | None | No |
The platform is designed to be PECR-compliant by default. With no analytics tracking ID configured, no non-essential storage is set on users' devices, and no cookie consent mechanism is required.