Background
The app is operated by the University of Sheffield and used in the UK. Under the Privacy and Electronic Communications Regulations (PECR) 2003, websites must inform users about cookies and obtain consent — except where cookies are strictly necessary for a service explicitly requested by the user.
SORT currently sets two cookies:
| Cookie |
Purpose |
Category |
sessionid |
Maintains the user's authenticated login session |
Strictly necessary |
csrftoken |
Protects form submissions against cross-site request forgery attacks |
Strictly necessary |
No analytics, advertising, marketing, or tracking cookies are used.
Problem
A cookie consent banner is not legally required — both cookies fall squarely within the ICO's strictly necessary exemption (see ICO guidance on cookies).
However, the Privacy Notice (section 9) currently contains an inaccuracy:
"When you complete a SORT survey, we do not use cookies."
This is incorrect. Django sets sessionid and csrftoken for all visitors, including unauthenticated survey respondents. This claim exposes the University to risk if audited by the ICO, and erodes user trust if discovered.
Proposed changes
-
Correct the Privacy Notice (section 9): Replace the inaccurate "we do not use cookies" claim with an accurate description of the two strictly necessary cookies — name, purpose, duration — and explain why they do not require consent.
-
Create a standalone Cookie Policy page: A brief, accessible page (e.g. /cookies/) that lists the cookies set, their purpose and lifespan, and confirms no consent is needed because all cookies are strictly necessary. Link to it from the Privacy Notice and the site footer.
-
Footer link: Add a "Cookie policy" link to the site footer alongside the existing Privacy Notice link, so it is consistently accessible from every page.
Out of scope
- A cookie consent/accept banner is not required and should not be added — it would be misleading to ask for consent for cookies that don't legally require it, and would add unnecessary friction for NHS users.
References
Background
The app is operated by the University of Sheffield and used in the UK. Under the Privacy and Electronic Communications Regulations (PECR) 2003, websites must inform users about cookies and obtain consent — except where cookies are strictly necessary for a service explicitly requested by the user.
SORT currently sets two cookies:
sessionidcsrftokenNo analytics, advertising, marketing, or tracking cookies are used.
Problem
A cookie consent banner is not legally required — both cookies fall squarely within the ICO's strictly necessary exemption (see ICO guidance on cookies).
However, the Privacy Notice (section 9) currently contains an inaccuracy:
This is incorrect. Django sets
sessionidandcsrftokenfor all visitors, including unauthenticated survey respondents. This claim exposes the University to risk if audited by the ICO, and erodes user trust if discovered.Proposed changes
Correct the Privacy Notice (section 9): Replace the inaccurate "we do not use cookies" claim with an accurate description of the two strictly necessary cookies — name, purpose, duration — and explain why they do not require consent.
Create a standalone Cookie Policy page: A brief, accessible page (e.g.
/cookies/) that lists the cookies set, their purpose and lifespan, and confirms no consent is needed because all cookies are strictly necessary. Link to it from the Privacy Notice and the site footer.Footer link: Add a "Cookie policy" link to the site footer alongside the existing Privacy Notice link, so it is consistently accessible from every page.
Out of scope
References