Of the 65 federal Web sites reviewed, 57 did not use persistent cookies. However, of the eight Web sites using persistent cookies, four did so without disclosing this in their privacy policies, as required by OMB. The four remaining sites using persistent cookies disclosed this use but did not meet OMB’s other conditions. In addition, four sites that did not use persistent cookies did not post privacy policies on their home pages. OMB’s Cookie Guidance Helpful but Fragmented and Unclear

Although OMB’s guidance has proved useful in ensuring that federal Web sites address privacy issues, the guidance is fragmented, with multiple documents addressing various aspects of Web site privacy and cookie issues. Conclusions

Most federal Web sites we reviewed were following OMB’s guidance on the use of cookies. The sites that were not following the guidance either have taken or plan to take corrective action. Recommendations for Executive Action

To clarify agency requirements on the use of automatic collections of information, including the use of cookies on their Web sites, we recommend that the Director, OMB, in consultation with other parties, such as agency officials and the CIO Council,   unify OMB’s guidance on Web site privacy policies and the use of cookies,   clarify the resulting guidance to provide comprehensive direction on the use of cookies by federal agencies on their Web sites, and   consider directing federal agencies to disclose the use of session cookies in their Web site privacy notices. OMB did not provide comments. These Web sites consisted of (1) the sites operated by the 33 high- impact agencies, which handle the majority of the government’s contact with the public, and (2) 32 sites randomly selected from the General Services Administration’s government domain registry database. We reviewed each Web site between November and December, 2000, to determine which were using cookies and the type of cookies given.
Why GAO Did This Study

Federal agencies are using Internet "cookies" to enable electronic transactions and track visitors on their websites. Cookies are text files that have unique identifiers and are used to store and retrieve information that allow websites to recognize returning users, track on-line purchases, or maintain and serve customized web pages. This report discusses whether (1) federal websites complied with the Office of Management and Budget's (OMB) guidance on the use of cookies and (2) the guidance provided federal agencies with clear instructions on the use of cookies. GAO reviewed 65 websites randomly selected from the General Services Administration's government domain registry database between November 2000 and January 2001 to determine whether they used persistent cookies and whether such use was disclosed in the website's privacy policy. As of January 2001, most of the websites reviewed were following OMB's guidance on the use of cookies. Of the 65 sites GAO reviewed, 57 did not use persistent cookies on their websites, eight used persistent cookies, four did not disclose such use in their privacy policy, and the remaining four sites using persistent cookies did provide disclosure but did not meet OMB's other conditions for using cookies. In addition, four other sites that did not use cookies did not post privacy policies on their home pages. Those sites were taking, or planning to take, corrective action to address their noncompliance with OMB guidance.

What GAO Found

GAO found that although OMB's guidance proved useful in ensuring that federal websites address privacy issues, the guidance remained fragmented, with multiple documents addressing various aspects of Web site privacy and cookie issues. In addition, the guidance did not provide clear direction on the disclosure of session cookies.