Privacy and cookies notice
Cookies
We want our internet-based services to be easy, useful and reliable. This sometimes involves placing small amounts of information on your device, for example your computer or your mobile phone. These include small text files known as cookies. This helps us:
- make our website secure.
- carry out our statutory functions efficiently.
- make sure our website works well for you and make improvements.
- remember your preferences where necessary.
- gather anonymised information about the functioning of our website and campaigns. You can find out more about our use of analytics below.
- personalise the website to display relevant content to you.
- improve the guidance and materials available to you.
We are subject to the EC Privacy and Electronic Communications directive and UK GDPR which says we need to provide you with information on the cookies used on our website. Find out more about how cookies work.
We’ve explained the cookies used by the GMC below.
Cookie types and duration
Cookies set when visiting our website
Strictly necessary
| Cookie name | Retention | Set by | Purpose |
|---|---|---|---|
| ASP.NET_SessionId | End of session | First party | Anonymous unique session identifier created to collect details of setting or information entered on website. Essential for website functionality as this cookie allows information to be passed between our web pages. |
| __cfduid | Session | First party | Collects and anonymises end users IP addresses. Helps Cloudflare to detect malicious visitors to our website and minimises blocking legitimate users. |
| _cf_bm | 1 day | First party | Security-this cookie helps intercept cookies which could be used in a cyber-attack for example a denial-of-service attack. |
| _cfruid | Session | First party | This cookie is part of the services provided by Cloudfare - Including load-balancing, deliverance of website content and serving DNS connection for website operators. |
| __RequestVerificationToken | End of session | First party | An anti-forgery cookie to confirm a request has come from the user’s device and they aren’t being impersonated. |
| GRECAPTCHA | 180 days | First party | This cookie is used to distinguish between humans and bots. This is beneficial for the website to make valid reports on the use of the website. |
| BIGipServer# | Session | First party | Make sure incoming network traffics or requests are efficiently distributed across our servers. |
| Cf_chl_1 | 1 day | First party | This cookie is a part of the services provided by Cloudflare - Including load-balancing, deliverance of website content and serving DNS connection for website operators. |
| Cf_chl_rc_i | 1 day | First party | This cookie is a part of the services provided by Cloudflare. Includes load-balancing, deliverance of website content and serving DNS connection for website operators. |
| CsrfToken | Session | First party | Helps prevent Cross-Site Request Forgery (CSRF) attacks. |
| Ts | Session | First party | Used for the website security. |
| CookieConsent | 12 months | First party | Used to record if a user has accepted the use of cookies on the GMC website. |
| Shell#lang | Session | First party | Stores the context language of the current site. Used by Sitecore. |
| Cookies_policy | 12 months | First party | We use this to record your preferences as to whether you want to accept cookies in our Performance or Marketing categories. After a year we will ask you if you are happy to continue with your preferences or change them. You are also able to change your settings at any time in cookies preferences. |
| Gmcwebsite#lang | Sessions | First party | Used to support Welsh language on our site. |
| Rc::a | Persistent | First party | Google uses this cookie to distinguish between humans and bots. This is beneficial for the website to make valid reports on the use of our website. |
| Rc::b | Session | First party | Google uses this cookie to distinguish between humans and bots. |
| Rc::c | Session | First party | Google uses this cookie to distinguish between humans and bots. |
| Rc::f | Persistent | First party | Google uses this cookie to distinguish between humans and bots. |
| Sc_anonymous_id | 10 years | First party | This cookie is set by Soundcloud to enable Soundcloud player. |
| CONSENT | 15 months | Third party | Youtube cookie in YouTube videos. |
| 1.gif | Session | Third party | Used to count the number of sessions to the website, necessary for optimizing CMP product delivery. |
Performance
| Cookie name | Retention | Set by | Purpose |
|---|---|---|---|
| #-# | Session | Third party | Used to track user's interaction with embedded content |
| _Secure-ROLLOUT_TOKEN | 180 days | Third party | Unclassified |
| _ga | 2 years | First party | Used by Google Analytics. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _ga_# | 2 years | First party | Used by Google Analytics to collect data on the number of times a user has visited the website as well as dates for the first and most recent visit. |
| _gid | 1 day | First party | Google Analytics registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _gat | 1 day | First party | Used by Google Analytics to throttle request rate to manage server requests. |
| cf.turnstile.u | Persistent | First party | Unclassified. |
| collect | Session | First party | Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels. |
| td | Session | First party | Google tag manager. Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator. |
| _hjSession_# | 1 day | First party | Hotjar collects statistics on the visitor's visits to the website, such as the number of visits, average time spent on the website and what pages have been read. |
| _hjSessionUser_# | 1 year | First party | Hotjar collects statistics on the visitor's visits to the website, such as the number of visits, average time spent on the website and what pages have been read. |
| _hjTLDTest | Session | First party | Hotjar registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator. |
| hjActiveViewportIds | Persistent | First party | Hotjar cookie that contains an ID string on the current session. This contains non-personal information on what subpages the visitor enters – this information is used to optimise the visitor's experience. |
| hjViewportId | Session | First party | Hotjar saves the user's screen size to adjust the size of images on the website. |
| iU5q-!O9@$ | Session | Third party | Registers a unique ID to keep statistics of what videos from YouTube the user has seen. |
|
LAST_RESULT_ENTRY_KEY, nextId, requests |
Session | Third party | Used to track user’s interaction with embedded content. |
| LogsDatabaseV2:V#||LogsRequestsStore |
Persistent | Third party | Used to track user's interaction with embedded content. |
| NID | 6 months | Third party | Unclassified |
| remote_sid | Session | Third party | Necessary for the implementation and functionality of YouTube video-content on the website. |
| ServiceWorkerLogs Database#SWHealthLog |
Persistent | Third party | Necessary for the implementation and functionality of YouTube video-content on the website. |
| TESTCOOKIESENABLED | 1 day | Third party | Used to track user’s interaction with embedded content. |
| VISITOR_INFO1_LIVE | 180 days | Third party | Tries to estimate the users' bandwidth on pages with integrated YouTube videos. |
| YSC | Session | Third party | Registers a unique ID to keep statistics of what videos from YouTube the user has seen. |
| WIDGET::local::assignments | Persistent | Third party | Used by audio-platform SoundCloud to implement, measure and improve their embedded content/service on the website. The collection of data also includes visitors’ interaction with embedded content/service. This can be used for statistics or marketing purposes. |
| ytidb::LAST_RESULT_ENTRY_KEY YtIdbMeta#databases |
Persistent | Third party | Used by YouTube to track user’s interaction with embedded content. |
| yt-remote-connected-devices yt-remote-device-id |
Persistent | Third party | Stores the user's video player preferences using embedded YouTube video. |
| yt-remote-cast-available yt-remote-cast-installed yt-remote-fast-check-period yt-remote-session-app yt-remote-session-name |
Session | Third party | Stores the user's video player preferences using embedded YouTube video. |
Marketing
| Cookie name | Retention | Set by | Purpose |
|---|---|---|---|
| _gcl_au | 3 months | Third party | Used by Google AdSense for experimenting with advertisement efficiency across websites using their services. |
Cookies set when visiting GMC Connect and GMC Online
Strictly Necessary
| Cookie Name | Retention | Set by | Purpose |
|---|---|---|---|
| ..AspNetCore.Cookies | Session | First party | Used to identify and maintain the B2C session. |
| ef270529b84d369ff5b39af64d5d1df8 | 15 minutes | First party | Keeps track of when the session is due to end to issue a redirect on mobile device if user comes back in after cookie expiry. |
| GMCSignInUrlRedirect ResolveGMCSignInUrlRedirect |
2 hours | First party | Stores URL to redirect to after B2C sign in. Used to identify if we need to redirect the user after they’ve signed in, for example following a password reset. |
| JSESSIONID | Session | First party | Used for session management. |
| OpenIdConnect.nonce. | 15 minutes | First party | Used to verify the B2C session and protect against replay attacks. |
| _sn_ecustomer_enu | Session | First party | Used to identify and maintain the users Siebel GMC Online session. |
| _sn_gmcconnect_enu | Session | First party | Used to identify and maintain the users Siebel GMC Connect session. |
| x-ms-cpim-admin x-ms-cpim-cache:{id}_n x-ms-cpim-csrf x-ms-cpim-ctx x-ms-cpim-dc x-ms-cpim-rc x-ms-cpim-rp x-ms-cpim-slice x-ms-cpim-sso:{Id} x-ms-cpim-trans |
Session | First party | These cookies are set by Azure Active Directory B2C (Azure AD B2C). Azure AD B2C is an identity management service that enables our user sign up, sign in and profile management. We use this platform for our GMC Online and GMC Connect applications. More information about these Cookies can be found at Cookie definitions - Azure AD B2C. |
| _sn_gmcconnect_enu | Session | First party | Used to identify and maintain the users Siebel GMC Connect session. |
| ai_user | 1 year | First party | Used by Microsoft PowerBI to collect statistical usage and telemetry information. The cookie stores a unique identifier to recognise users on returning visits over time. |
| ai_session | 1 day | First party | Preserves user states across page requests. |
Performance
| Cookie Name | Retention | Set by | Purpose |
|---|---|---|---|
| _gid | 1 day | First party | Google Analytics registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _gat | 1 day | First party | Used by Google Analytics to throttle request rate to manage server requests. |
| _ga | 2 years | First party | Used by Google Analytics. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _hjSession_# | 1 day | First party | Hotjar collects statistics on the visitor's visits to the website, such as the number of visits, average time spent on the website and what pages have been read. |
| _hjSessionUser_# | 1 year | First party | Hotjar collects statistics on the visitor's visits to the website, such as the number of visits, average time spent on the website and what pages have been read. |
| _hjTLDTest | Session | First party | Hotjar registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator. |
| hjActiveViewportIds | Persistent | First party | Hotjar cookie that contains an ID string on the current session. This contains non-personal information on what subpages the visitor enters – this information is used to optimise the visitor's experience. |
| hjViewportId | Session | First party | Hotjar saves the user's screen size to adjust the size of images on the website. |
Cookies set when visiting our recruitment website
Strictly Necessary
| Cookie Name | Retention | Set by | Purpose |
|---|---|---|---|
| sessionid2965 | Session | First party | Allows user to select job alerts by email. |
| lastaccesstime2965 | Session | First party | Captures date and time of visit. |
| Ccp_user2965 | Session | First party | Captures candidate userid - only set if user registers to use the site and allows user to apply for jobs. |
| Ccp_name2965 | Session | First party | Captures candidate name - only set if user registers to use the site and allows user to apply for jobs. |
| Wedeputy_reg_email_3552 | Session | First party | Captures candidate email address - only set if user registers to use the site and allows user to apply for jobs. |
Performance
| Cookie Name | Retention | Set by | Purpose |
|---|---|---|---|
| _ga | 2 years | First party | Used by Google Analytics. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _ga_# | 2 years | First party | Used by Google Analytics to collect data on the number of times a user has visited the website as well as dates for the first and most recent visit. |
| _gid | 1 day | First party | Google Analytics registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _gat | 1 day | First party | Used by Google Analytics to throttle request rate to manage server requests. |
Cookies set when visiting GMC Data Explorer and Education Data Tool
Strictly necessary
| Cookie Name | Retention | Set by | Purpose |
|---|---|---|---|
| __cfduid | Session | First party | Collects and anonymises end users IP addresses. Helps Cloudflare to detect malicious visitors to our website and minimises blocking legitimate users. |
| _cfruid | Session | First party | This cookie is a part of the services provided by Cloudflare - Including load-balancing, deliverance of website content and serving DNS connection for website operators. |
| __RequestVerificationToken | End of session | First party | An anti-forgery cookie to confirm a request has come from the user’s device and they aren’t being impersonated. |
| AI_buffer AI_sentBuffer |
Session | First party | Used to limit the number of data-server-updates (Azure). This synergy also allows the website to detect any duplicate data-server-updates. |
| ai_session | 1 day | First party | Preserves users states across page requests. |
| ai_user | 1 year | First party | Used by Microsoft PowerBI to collect statistical usage and telemetry information. The cookie stores a unique identifier to recognise users on returning visits over time. |
| ARRAffinitySameSite | Session | First party | Microsoft PowerBI Insights assigns you a unique ID to collect statistical usage and telemetry information to help us improve performance and usability. |
| ASP.NET_SessionId | End of session | First party | Anonymous unique session identifier created to collect details of setting or information entered on website. Essential for website functionality as this cookie allows information to be passed between our web pages. |
| BIGipServer# | Session | First party | Make sure incoming network traffics or requests are efficiently distributed across our servers. |
| B2CSignOut | Session | First person | Unclassified. |
| CookieConsent | 12 months | First party | Used to record if a user has accepted the use of cookies on the GMC website. |
| Cookies_policy | 12 months | First party | We use this to record your preferences as to whether you want to accept cookies in our Performance or Marketing categories. After a year we will ask you if you are happy to continue with your preferences or change them. You are also able to change your settings at any time in cookies preferences. |
| cookies_preference_set (gde.gmc-uk.org only) |
1 year | First party | It records the user's cookie consent preferences. It stores information about the categories of cookies the site uses and whether visitors have given or withdrawn consent for each category. |
| cookietest | Session | First party | This cookie is used to determine if the visitor has accepted the cookie consent box. |
| deviceinfo1 | Persistent | Third party | Determines the device used to access the website. This allows the website to be formatted accordingly. |
| GeocoderCache#objects | Persistent | First party | Unclassified. |
| manifests.artifacts manifests.products manifests.tabs |
Persistent | First party | Used by Microsoft Power BI platform to display graphics on the website. |
| Shell#lang | Session | First party | Stores the context language of the current site. Used by Sitecore. |
| SsoSignOut | Session | First party | Unclassified. |
| WFESessionId | Session | First party | A PowerBI cookie that is required for the reports to function. |
| _$Maps_centreLatitude_expiration _$Maps_centerLongitude_expiration _$Maps_deviceInfo1_expiration _$Maps_zoom_expiration |
Persistent | Third party | Used in context with the website's map integration. The cookie stores user interaction with the map in order to optimise its functionality. |
| _EDGE_V | 1 year | Third party | This cookie is used in context with the Bing-Map integration on the website. This cookie is necessary for some map-features. |
| zoom | Persistent | Third party | Used in context with the website's map integration. The cookie stores user interaction with the map in order to optimise its functionality. |
Performance
| Cookie name | Retention | Set by | Purpose |
|---|---|---|---|
| _ga_# | 1 year | First party | Used by Google Analytics to distinguish users by assigning a randomly generated number as a client identifier. It's included in each page request on a site and used to calculate visitor, session and campaign data for the site's analytics reports. |
| _ga_KGWWQL4MM1 | 1 year | First party | A variation of the _ga cookie set by Google Analytics and Google Tag Manager to enable website owners to track visitor behaviour and measure site performance. The pattern element in the name contains the unique identity number of the account or website it relates to. |
| _hjSessionUser_3680533 | 1 year | First party | Used by Hotjar to identify a new user’s first session. It stores a true/false value, indicating whether this was the first time Hotjar saw this user. It’s used by Recording filters to identify new user sessions. |
| _hjSession_3680533 | 1 year | First party | This Hotjar cookie maintains the session state across page requests. It ensures that the same user ID is attributed to behaviour on subsequent visits to the same site. |
Marketing
| Cookie name | Retention | Set by | Purpose |
|---|---|---|---|
| _EDGE_S | Session | Third party | Collects information on user behaviour on multiple websites. This information is used in order to optimise the relevance of advertisement on the website. |
| _SS | Session | Third party | Collects information on visitor behaviour on multiple websites - This information is used on the website in order to optimise the relevance of advisement. The cookie also allows the website to determine how the visitor accessed the website. |
| MUID | 1 year | Third party | Unclassified. |
| MUID8 | 1 year | Third party | Registers data on visitors from multiple visits and on multiple websites. This information is used to measure the efficiency of advertisement on websites. |
| SRCHD SRCHHPGUSR SRCHUID SRCHUSR |
1 year | Third party | Collects data on user behaviour and interaction in order to optimise the website and make advertisement on the website more relevant. |
Our website analytics and data
Google Analytics
Google Analytics cookies are classified as performance cookies. They are not strictly necessary for the functioning of the GMC’s website. If you consent to Google Analytics cookies via our cookie banner, we'll use Google Analytics to monitor site usage.
As part of Google Analytics, we have enabled Google Advertising Features. These features allow us to view general aggregated demographic information about our users, such as age group, gender, interest categories, etc.
We also use cookies for remarketing, which means we may display content about our regulatory functions that we think might be of interest to you when you visit other websites. Third party vendors, including Google, may use cookies to serve advertisements based on your prior visits to our websites.
Hotjar
Hotjar cookies are classified as performance cookies, so we need your consent via the Cookie banner to be able to use these on your device when visiting our website. We use Hotjar to better understand our users’ needs and to optimise their service and experience. Hotjar is a technology service that helps us better understand our users experience (e.g., how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc). This helps us build and maintain our service with user feedback.
Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices, in particular, a device's IP address (captured and stored only in anonymised form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and preferred language used to display our website. Hotjar stores this information in a pseudonymised user profile. Neither Hotjar nor the GMC will ever use this information to identify individual users or to match it with further data on an individual user. For further details, see Hotjar’s privacy policy.
Session variables
Some of our microsites use session variables to record your responses. Session variables are different to cookies because they are stored on the server relative to the session, rather than your device. Session variables are semi-permanent data files that exist only while your session with an application is active. Session variables are specific to each visitor and are deleted when you close the browser.
We monitor the introduction of new cookies on our websites and update privacy cookie information where appropriate.
Social media cookies