Privacy on your website: cookies, analytics, forms, and data retention

A university's marketing team adds an advertising pixel to the admissions site to measure a campaign. A few months later a parent asks why ads for the school follow them everywhere after they looked at the financial aid page. The pixel was sending page visits, including that one, to an advertising network. Nobody intended harm, but nobody had checked what the site was collecting either. Most website privacy problems look like this: tools added one at a time, each collecting a little more than anyone realized.

Start with an inventory

Privacy work begins with knowing what your site collects and where it goes. Open your site in a private browser window, open the browser's developer tools, and look at two things:

• Cookies and storage: under Application (or Storage), every cookie set by your domain and by others.
• Network requests: under Network, every outside service the page contacts, such as analytics, ad pixels, chat widgets, video embeds, maps, and fonts.

For each one, write down who it sends data to, what for, and who asked for it. Remove anything nobody can explain. This list is also the basis for your cookie notice and privacy policy.

Cookie consent and tracking

Cookies and trackers fall into two groups. Strictly necessary ones (keeping someone signed in, remembering a form in progress, load balancing) need no consent. Analytics, advertising, and social media trackers usually do, depending on where your visitors are.

• Visitors in Europe and the UK: GDPR and related rules require consent before non-essential cookies are set. A banner that sets trackers before anyone clicks does not meet that standard.
• Visitors in the US: a growing number of states have consumer privacy laws that give people the right to opt out of the sale or sharing of their data, including through ad pixels. Several honor the Global Privacy Control signal, a browser setting that tells sites "do not sell or share my data" automatically.
• Health, education, and children: pixels on pages about medical care, student records, or services for children carry higher risk under sector rules, and regulators have acted against organizations that sent this kind of page data to advertisers.

A consent tool should block non-essential trackers until consent is given, record the choice, honor Global Privacy Control, and offer a "consent preferences" link in the footer so people can change their mind.

Forms collect more than you think

Contact, registration, and application forms are where websites gather the most personal data. For each form, ask:

1. Do we need every field? Every field you remove is data you never have to protect.
2. Where do submissions go? Email inboxes, a CRM, a spreadsheet, the CMS database. Each copy needs protecting.
3. How long do we keep them? Set a retention period and delete on schedule. Many WordPress and Drupal form tools keep every submission forever by default.
4. Is anything sensitive collected? Identification numbers, health or financial details, and documents belong in a dedicated secure system, not a general web form.

A note for public agencies

Government agencies are often exempt from state consumer privacy laws but have obligations of their own. Federal sites must post a privacy policy and are expected to limit tracking. Many state and local agencies are subject to records-retention schedules that set how long data must be kept, and public-records laws that can make form submissions and emails disclosable. The safest pattern is the same as for everyone else, with more care: collect the minimum, avoid advertising trackers on service pages, and match retention to your records schedule.

Notes by platform

WordPress and Drupal: consent tools are available as plugins and modules, but check that they block trackers before consent rather than only showing a banner. Form plugins and modules usually store submissions in the database; set a retention or purge rule. Cascade: forms and trackers are added through templates and outside services, so the inventory step above is the place to start.

How eWay can help

Under the shared responsibility model, decisions about what data your site collects, your privacy policy, and data classification belong to your organization. eWay can help with the technical side: running a tracker and cookie inventory, setting up a consent tool that blocks trackers until consent, configuring form retention and purging, and making sure form data is encrypted in transit and at rest on the hosting platform.

What to include in a support ticket

• The site and the specific tool, form, or tracker involved
• What you want changed: removal, consent settings, retention, or an inventory
• Any deadline from your legal, privacy, or records team

eWay customers can open a ticket in the support portal or email support@ewaycorp.com. Related reading: email authentication for your domain and if your site is hacked: the first hour.