Cookie Consent on Careers Pages: The Recruitment Trackers Nobody Told Compliance About
The careers section is the part of the site marketing forgets and compliance never visits. It is often a separate template, sometimes a separate subdomain, and it runs a stack chosen by the talent team: an applicant tracking system embedded as a widget, advertising pixels to retarget job viewers, video platforms for culture films, and chat tools for candidate questions. Each arrived with a contract and good intentions. Few arrived with a consent review.
That gap matters more than it used to. Candidates are data subjects, regulators have fined mishandling of applicant data, and the people browsing job pages include current employees of competitors, journalists, and your own staff, all being profiled by recruitment advertising. This guide maps what runs on careers pages, the specific risks, and the governance that brings them under the same rules as the rest of the site.
A separate stack on a separate template
Careers pages escape the main consent setup mechanically, not just administratively. The applicant tracking system often serves the whole application flow from its own domain inside an iframe or a reverse proxy, with its own cookies for session and source tracking. The banner configured for the marketing site may not load in the careers template at all, or may load without the recruitment tools in its categories. Meanwhile the talent team measures campaign performance with pixels from the same advertising platforms the main site carefully gates, placed here through the ATS or a careers page builder that nobody audited. Inventory the careers stack separately; assuming it inherits the main site's discipline is the error everything else follows from.
What candidate tracking actually collects
Beyond ordinary analytics, recruitment tooling collects source attribution that follows a candidate into the application, which jobs they viewed, and sometimes video engagement and chat transcripts. Retargeting pixels mean a person who viewed a nursing role or an executive opening carries that signal into advertising auctions, which can reveal health, seniority, or job seeking status to anyone watching the bid stream, including their current employer if devices or accounts overlap. None of this is automatically unlawful, but all of it is processing that belongs in the privacy notice, the consent categories where required, and the retention schedule. Candidate data kept indefinitely in an ATS is the other quiet problem this audit usually surfaces.
The application flow is not a consent free zone
Teams sometimes reason that applying is a transaction, so tracking within the flow is necessary and exempt. Necessary covers what the application technically needs: session integrity, security, the form itself. It does not cover analytics beacons, advertising pixels, or A/B testing tools running inside the application, which are optional by definition and follow the ordinary rules. The iframe problem is practical: if the ATS flow cannot read the parent page's consent state, the defaults matter, and the default inside most embedded flows is to run everything. Test the full application as a candidate who declined everything and watch what fires before believing the setup works.
Governance that survives the talent team's roadmap
Bring careers tooling into the same intake process as marketing tooling: new recruitment vendor, same consent categorization form. Extend the banner and consent state into the careers template and, where the ATS allows it, into the embedded flow; where it does not, record that limitation and compensate by minimizing what the embed loads pre consent. Add careers pages to the consent crawl, including the application path with a test candidate. Finally, align retention: candidate marketing pools and ATS records should have deletion schedules that someone owns. The careers page will keep changing as hiring priorities shift; the goal is a review habit that changes with it, not a one time cleanup.
Related reading
These earlier guides cover connected questions in more depth: Cookie Consent for Nonprofits: Donation Pages, Donor Data, and Lean Budgets, Cookie Consent for Webinars and Virtual Events, and Cookie Consent Handoff: The Checklist Agencies Should Leave Behind.
Frequently asked questions
Do job applicants have the same consent rights as customers?
Yes. Privacy law does not carve out candidates; they are individuals whose data is processed, and tracking technologies on careers pages follow the same consent rules as elsewhere on the site. Some jurisdictions add specific protections around employment context, which raises rather than lowers the bar.
Our ATS is a separate platform. Is its tracking our problem?
If it is embedded in your site or reached through your careers pages, candidates experience it as you, and regulators will generally treat the choice of vendor and configuration as your responsibility. Contracts should cover consent behavior, sub-processors, and retention, and the configuration should be tested, not assumed.
Can we retarget people who viewed our job pages?
Only under the same conditions as any advertising tracking: a valid consent where required, honest categorization, and a privacy notice that mentions recruitment marketing. Consider the sensitivity before doing it at all; the signal that someone is job hunting is exactly the kind they may not want auctioned.
What is the quickest audit for a careers section?
Browse it in a clean profile with network recording on, decline everything the banner offers, then click through job listings into the application as far as you can without submitting. List every third party request. Anything advertising or analytics related that fired after a refusal is your first fix, and the list itself is usually a surprise to both teams.