From 2 August 2026, AI systems used to screen, rank, or target candidates are classified as high-risk under the EU AI Act, with obligations backed by fines up to 15 million euros or 3% of global turnover. In the UK, the ICO spent 2024 and 2025 intervening in AI recruitment tools and published a March 2026 report on automated decision-making in hiring after auditing more than 30 employers, finding most weren't applying the safeguards the law requires. Candidate data has become a regulated, watched category.

Job boards, career sites, and recruitment agencies run heavy tracking on top of that data: programmatic job ads, retargeting of applicants, analytics on which listings convert, and applicant-tracking integrations. This guide covers how to handle cookie consent when the people you're tracking are job seekers and the data is under a spotlight.

Candidate data is personal data with sharp edges

Everything a candidate gives you (name, contact details, CV, work history, salary expectations) is personal data under GDPR and needs a lawful basis. Recruitment usually rests on a mix of consent, contract, and legitimate interests depending on the step, but the tracking layer is where consent specifically bites. Marketing and analytics cookies that profile a job seeker across sessions, feed retargeting, or attribute an application to an ad campaign need consent in the EU and UK, and an opt-out path in US states.

CVs also carry a hidden risk: they can reveal special-category data (health, ethnicity, religion, union membership, or characteristics inferable from a name or photo). The ICO's audits found recruitment AI inferring gender and ethnicity from candidates' names. Any tracking or profiling that touches those inferences raises the bar sharply. Keep behavioral tracking away from the application itself, and don't let advertising pixels ingest form fields on an apply page. Our GDPR cookie compliance checklist covers the baseline classification.

The AI Act changes the calculus for career sites

Under Annex III of the EU AI Act, AI used for recruitment or selection (including placing targeted job advertisements, filtering applications, and evaluating candidates) is high-risk. The high-risk obligations (risk management, data governance, transparency, human oversight, logging) become enforceable from 2 August 2026. The text of Annex III names targeted job advertising explicitly, which is the part that intersects with your cookie stack.

Here's the connection. If you target job ads using audiences built from tracking data, and an AI system decides who sees which ad, that ad-targeting system can fall within the high-risk category. Consent for the underlying tracking is the entry point to the whole data flow. Getting consent right (clear, granular, revocable, logged) is the foundation the AI Act's transparency and governance obligations sit on. Weak consent doesn't just risk an ePrivacy problem; it undermines the lawful basis the rest of the recruitment AI stack depends on.

What the ICO is actually enforcing

The ICO's 2024 intervention into AI recruitment tools and its follow-up guidance push a few themes that map onto consent and tracking:

Transparency to candidates. Job seekers should understand what data you collect and how it's used, including tracking. A vague banner buried on a listings page doesn't meet that bar.
Fairness. Don't process candidate data in ways that filter people out on protected characteristics, and don't infer those characteristics without a basis.
Data minimization. Collect and track only what the hiring purpose needs. A career site that fires a dozen advertising pixels on an application form is over-collecting.

The consent layer is where transparency and minimization become concrete. If a candidate can see, choose, and revoke the tracking, and if necessary tracking is genuinely limited to what the application needs, you're aligned with the direction the ICO is enforcing.

Job boards: programmatic ads and the tracking tax

Job boards live on programmatic job advertising and pay-per-click or pay-per-apply models, which means dense conversion tracking: which source drove a click, which drove an application, which drove a hire. When a candidate declines marketing cookies, that attribution chain breaks, and for a job board that's revenue reporting, not a nice-to-have.

The recovery path is the same as any conversion-driven site. Send application and apply-click events server-to-server, keyed off a consented first-party signal rather than a browser pixel, so a decline degrades measurement instead of erasing it. Our server-side conversion gating guide covers doing this so you only forward events you have consent to forward. And because job seekers are exactly the audience you don't want to alienate with a manipulative banner, our consent-rate optimization without dark patterns guide is worth a read: candidates who feel tricked don't finish applications.

How CookieBeam handles recruitment sites

CookieBeam manages the consent and tracking layer. It doesn't audit your hiring AI for bias or build your AI Act conformity documentation, but it delivers the consent foundation those obligations require.

Script blocking that protects applications. Advertising, analytics, and session-recording scripts stay blocked until consent, so pixels can't ingest CV and form data on apply pages. Session and application-state cookies run regardless, so candidates can always finish applying.
Granular, revocable consent. Candidates can accept or reject categories and change their mind later, with the record kept, which is the transparency and control the ICO expects.
Scanning the application funnel. The scanner crawls apply pages and listing pages where ATS, programmatic-ad, and analytics tags accumulate, and flags new cookies and connections when an integration changes.
Geo-targeted rules. EU/UK opt-in and US opt-out from one configuration, so a global job board serves each candidate the right model. See our regional consent guide.
Durable consent records. Timestamped logs that support both a data-protection inquiry and the logging discipline the AI Act pushes. Our visitor de-anonymization guide covers a related risk on the employer side.

Checklist for job boards and recruitment sites

Give candidate data a clear lawful basis. Tracking and profiling need consent (EU/UK) or an opt-out path (US states).
Keep marketing tags off apply pages. CVs can reveal special-category data; don't let pixels ingest form fields.
Treat targeted job advertising as high-risk under the AI Act. Consent is the foundation that stack sits on, effective from 2 August 2026.
Be transparent and minimize. Show candidates the tracking, let them choose and revoke, and collect only what hiring needs.
Recover attribution server-side. Send apply events server-to-server so declines don't erase your reporting.
Don't use dark patterns on job seekers. A tricked candidate abandons the application.
Log consent and scan the funnel continuously. Keep records for inquiries and catch ATS and ad-tag drift early.