Cookie Consent on School Websites: Keeping Pupil Data Out of Trackers

Published 2026-10-24

A school website looks harmless: term dates, a prospectus, a lunch menu, a contact form. Underneath, many school sites carry the same tracking stack as a retail store, inherited from templates, embedded media, and well meaning additions over the years, all running on pages read by pupils and parents.

Consent on a school site is not mainly a marketing question. It is a safeguarding and trust question. This guide walks through where trackers hide on school websites, what a proportionate setup looks like, and how to document decisions for governors and parents.

Where trackers hide on a typical school site

Start with embedded content. Video players, social feeds, and interactive maps commonly set third party cookies or load trackers the moment a page opens, before any visitor chooses anything. Next, check templates: site builders and themes often include analytics, fonts, and chat widgets by default, added by a developer years ago and never reviewed. Parent portals and payment pages for trips and meals deserve separate attention, because they involve accounts and transactions. Finally, look at the admissions and recruitment sections, where advertising pixels sometimes appear after a marketing campaign and stay long after it ends. A full crawl with a cookie scanner, page by page, produces the honest list. Memory and good intentions do not.

Consent from children and parents needs extra care

Rules on children's data set a higher bar: information must be plainer, purposes narrower, and optional tracking harder to justify. A banner copied from a commercial template, full of marketing language and a bright accept button, is the wrong instrument here. Where analytics are genuinely needed to run the site, prefer privacy respecting, first party measurement with short retention, configured to avoid advertising features entirely. For anything optional that remains, the choice must be genuinely free, which on a school site means a parent or pupil who declines loses nothing: no blocked videos that are required viewing, no degraded portal access. Two click placeholders for embedded videos, loading the player only after a deliberate tap, are a simple pattern that respects that line.

A proportionate setup a small school can maintain

Most schools do not need a large consent platform; they need a short, enforced list. One analytics setup, properly configured. One approach to embeds: click to load, everywhere. No advertising pixels at all. A banner only if something optional actually remains, written in language a tired parent understands at midnight. Assign an owner, usually the school's data protection lead working with whoever maintains the site, and review the tracker list once a term, because sites drift as staff add pages and tools. Each review is short when the list is short. The goal is a setup a governor can be walked through in five minutes, with every line answerable.

Documenting decisions for governors and parents

Write the outcome down in plain English: what the site collects, why, what was removed, and when it will be checked again. Governors do not need cookie names and lifetimes in the main summary; they need the reasoning and the assurance that children's data is not feeding advertising systems. Keep the technical table behind the summary for anyone who asks. If parents raise questions, the same document answers them without scrambling. Schools are trusted with far more sensitive information than website data, and handling the visible, public part carefully is one of the easiest ways to show that the less visible parts are taken seriously too.

Related reading

These earlier guides cover connected questions in more depth: White Label Cookie Consent: What It Is and How to Choose a Platform, Consent in Podcast Players and Embedded Audio: The Tracking Nobody Sees, and Consent and Push Notifications: The Browser Prompt Is Not the Whole Story.

Frequently asked questions