Cookie policy
One cookie of our own, holding a yes or a no for 182 days, and three of Google's that are never written until the banner has been answered with an acceptance.
Four cookies at the most, and three of them wait for an answer
A cookie policy is usually the longest page on a site and the least informative, so we start this one with the whole of the answer. This site can write four cookies: one records the answer you give to the banner, and the other three belong to Google and appear only if that answer was "yes".
Nothing of ours is written before you answer. The banner is the first thing the page does, and the "container" (the Google Tag Manager file that would bring the measurement with it) is not requested until "Accept" has been pressed. There is no hidden frame on these pages, no "tracking pixel", and no advertising network of any sort.
At the date of this page the measurement container carries no identifier of its own, so in practice nothing is loaded even after an acceptance and the Google cookies below do not yet appear. The description is of what happens once the identifier exists, and the date at the head of the page moves when it does.
What the site writes, and for how long
Each entry gives the name, who sets it, what it is for, how long it lasts and which kind it belongs to, the four kinds being necessary, measurement, preference and advertising (of which this site uses the first two and will never use the last). The names and lives of the Google cookies are the ones Google documents for a property of this type (we have not invented a duration anywhere on this page), and where a name ends in a variable part, that part is the identifier of the measurement "stream".
- bjc_consent · this site · records the answer given to the banner, so that the question is not put again on every page · 182 days · strictly necessary
- _ga · Google · distinguishes one browser from another for the statistics · 2 years · measurement, written only after an acceptance
- _ga_ followed by the identifier of the stream · Google · holds the state of the session for that measurement stream · 2 years · measurement, written only after an acceptance
- _gid · Google · distinguishes one browser from another for a day, where the property still uses it · 24 hours · measurement, written only after an acceptance
The first of those four is the only one the site itself sets, and it is also the only one that cannot sensibly be refused. It exists so that a refusal can be remembered at all, which is a use the Regulation itself treats as "strictly necessary" (recital 32, and the guidance that followed it). It holds one word (either "granted" or "denied") and no identifier of any kind. We could not recognise you by it if we wanted to!
What happens when the answer is no
A reader who presses "Reject" is not measured, and the refusal is not a formality: we have followed the whole sequence in a browser, which is the only way anybody can know what a banner really does, and the order of what happens next is worth setting out. Google Tag Manager is never requested, so nothing of Google's is downloaded, nothing is executed and no measurement identifier is created. Any "_ga" cookie left behind by an earlier acceptance is deleted on the spot, across the domain and across the subdomain (the part most implementations forget, and the reason a refusal often leaves the old cookies sitting there).
A reader who accepted and then changes their mind gets the same result immediately, and gets it in a fixed order. The revocation disables the property, declares consent denied, deletes the cookies and reloads the page without the container; a container already sitting in memory will otherwise go on measuring the scroll and the exit of that same page, and will quietly rewrite the cookies that were removed a moment earlier. We learned that on another site in the group, at the cost of a day of its statistics, and the fix is in the script this site loads.
There is also no "noscript" fragment of Google Tag Manager anywhere on this site, which is worth a sentence of its own, because that fragment (the instruction a browser follows when scripting is switched off) is the commonest single way a container ends up loading in spite of a refusal, and it is usually left in place by somebody following an installation guide.
How to change the answer, now or later
The control is at the foot of every page on this site, next to the links to the privacy notice and to this one, and it is labelled "Cookie settings". Pressing it clears the recorded answer and brings the banner back, so a "yes" can become a "no" and a "no" can become a "yes" as often as you like.
That control is a plain link carrying an attribute the consent script listens for (the attribute is named in the script, and the script is served from this domain), rather than a piece of code written inside the page. The reason is technical and worth stating in full: the "Content-Security-Policy" this site sends with every page allows scripts only from the site itself, so a handler written into an attribute of the page ("onclick", in the old style) would never run, and the control would be a button that does nothing whatever.
The browser is the other route, and it is the one that works whatever a site may claim about itself! Every current browser lists the cookies of a site and deletes them one by one or together (the setting usually sits under privacy). A reader who clears ours is simply asked again on the next visit.
The things that look like cookies and are not
Two mechanisms on this site handle data without writing anything to the browser, and both belong on a page about cookies precisely because they are so often confused with them.
The first of them, the country check, happens on the server (in the hosting rules, before a page is even built) and applies to every page of this site. For the markets whose rules do not permit the promotion of operators licensed elsewhere, the hosting reads the country from the address of the request and serves the page written for that country. Nothing is stored, nothing is set, and no third party is involved at any point.
The second (the regional check) happens in the browser, because a province or a state is invisible to the hosting; it queries an outside service that derives a location from the address of the request (a derivation accurate to the country far more often than to the province), and it runs only on the pages that need it. With the settings this site uses, that service writes no cookie at all, which is why no "gt" entry appears in the list above. If the setting ever changes, the entry gets added with its name and its life read in a browser after a test redirect, rather than copied out of a manual and hoped for.
Neither check profiles anybody and neither one waits for the banner, because both exist to keep a page away from a reader who should not be shown it. That is a legitimate interest under Article 6(1)(f), and the privacy notice says so plainly and gives the address for an objection (which anybody is entitled to make, and which we answer).
Where the rest of it is written down
Privacy carries the whole of the Article 13 information: who the controller is (named in full at the top of it), what each legal basis is, who the recipients are, where the data goes when it leaves the European Economic Area, how long each thing is kept, the rights that go with all of it, and the supervisory authority a complaint can be made to without asking us first. This page is the inventory; that one is the notice.
Nothing on this site sits behind a wall that a refusal closes. A reader who rejects everything reads exactly the same pages, with the same ten tables and the same figures in them, as a reader who accepts; the only difference is that we learn nothing at all about the visit, which is a price we are content to pay and which, in any case, was never ours to refuse in the first place.
Questions
Which cookies does this site set by itself?
One, called bjc_consent. It records the answer given to the banner so that the question is not asked again on every page, it lasts 182 days, it holds a single word and no identifier of any kind. It is strictly necessary in the sense the Regulation gives the term, because without it a refusal could not be remembered.
How do I change my cookie choice?
Use the Cookie settings control at the foot of every page, including this one. It clears the recorded answer and brings the banner back, so a yes can become a no and a no can become a yes as often as you like. Clearing the site's cookies in the browser has the same effect.
What exactly happens if I press Reject?
Google Tag Manager is never requested, so nothing of Google's is downloaded or executed and no measurement identifier is created. Any _ga cookie left from an earlier acceptance is deleted at once, on the domain and on the subdomain. The pages themselves are unchanged: a refusal closes nothing.
Does the site call anything before I answer the banner?
The country check in the hosting, which happens on the server and stores nothing, and on the pages that need it a regional check that runs in the browser. Neither profiles anybody; both exist so that a page is not shown to a reader whose market does not permit it.