Three at the outside, and two of them Google's

The useful part of a page like this is an inventory, so the inventory comes first and the explanations follow it. Across the whole of this site three cookies can be written: one that records what a reader answered, and two that belong to Google and arrive only behind a yes.

Until the question has been answered, the browser receives nothing whatever. The banner goes up before any measurement is fetched, and the file that would bring the measuring with it stays unrequested while the answer is outstanding, so closing the tab without choosing leaves no cookie behind and no record anywhere except one line in a server log.

A second reason nothing arrives today is worth setting out plainly. The identifier the measuring would report into has not been filled in yet, so even a reader who accepts loads nothing at all and the two Google entries below are at present theoretical. They describe what happens once a real identifier exists, and the date above this text changes on the day one does.

The inventory

Each entry names the cookie, the party writing it, the work it does, how long it survives and which of four classes it belongs to. The classes are the "strictly necessary" (without which a site cannot do what a reader asked of it), the measuring (what was read, and in what order), the preference-keeping (a choice remembered for next time) and the advertising (which this site will never have); two of the four are used here, the third has nothing to keep, and the fourth will never appear.

First, "ac_consent", written by this site, holding what a reader answered so that nobody has to meet the same question on every page. Its life is 182 days, it is sent across the whole of the site's path, it travels with "SameSite=Lax" (a restriction keeping it off requests that other sites start) and, over a secure connection, with "Secure" as well, and its value is one word and no more, either "granted" or "denied".

Second, "_ga", written by Google, which tells one browser apart from another in the statistics (a random identifier, with no name attached to it) and lasts two years. Third, "_ga_" with the identifier of a "stream" (the channel an Analytics account collects one site's traffic on) appended to it, also written by Google, holding the state of a "session" (one visit, as an Analytics account counts one) on that channel, and also lasting two years.

Both of those durations are Google's own, taken from its documentation for an Analytics 4 account and read on 20 October 2026. We have guessed nothing here, and we have taken no duration out of another site's policy, which is the origin of most of the wrong ones in circulation!

Of the three, ours is the single entry a reader cannot usefully refuse, because a refusal has to be written down somewhere in order to be remembered at all. It contains no identifier, it is not joined to anything else, and it would be useless for recognising anybody.

The guard on the identifier, and the silence it buys

While the container identifier still holds its row of capital Xs (the unfilled form the script is published with), the loading routine checks it and gives up, which is a guard rather than an oversight: a distracted publication cannot send a single visit to an account that does not exist.

That guard has a cost, and admitting it is more useful than praising it. An identifier typed in wrongly produces no error, no warning in the browser console and no entry in the statistics: it produces silence, and silence looks exactly like a quiet fortnight, so whoever installs the real one should watch a "test visit" arrive rather than wait for a complaint.

Pressing Reject, instruction by instruction

Walking the sequence end to end in a browser is the one honest route to knowing what a banner does, and this one runs in a fixed order. The refusal first writes the word "denied" into our own cookie and takes the banner off the screen (removing the element, rather than hiding it); then, in the case where an earlier acceptance had already brought the container down, it raises Google's own "disabling flag" (a switch the measuring library reads before it sends anything) for the "property" (the account the measuring reports into) and issues a "consent update" (a message revoking the measuring category) behind it.

Only then does the clearing run, and it is more thorough than most. It reads the cookies of the page, picks out every name equal to "_ga" or beginning "_ga_", and expires each one three times over (three spellings of the same cookie, because a browser treats them as three): once with no domain named, once against the host with any leading "www" stripped away, and once against that same host with a dot in front of it.

That third form is the one most installations leave out, and leaving it out is why a refusal on other sites so often leaves the old entries exactly where they were. You can check ours in a minute, which is a better guarantee than this paragraph!

An "event" (a named message any script on the page may listen for) is then announced inside the page, so that anything which has to wait for the decision, such as a market warning that must not cover the banner, learns that a decision was taken. Last of all, and only where a container had genuinely been loaded, the page reloads itself.

Why a reload is part of it

A container that is already running in memory is not stopped by the loss of a cookie. It would go on recording the scrolling and the leaving of whatever page is still on the screen, and in the normal course it would write its cookies back a few seconds after the clearing removed them.

Reloading throws the container out of memory along with the page that held it, and only that lets a refusal take effect in the minute it was given rather than on the next visit, at a cost to you of one "refresh" (a single reload, and nothing else), which seems to us much the cheaper of the two prices on offer.

Changing your mind, now or in six months

The control sits at the bottom of every page, next to the links to this page and to the privacy notice, labelled "Cookie settings". Using it expires our cookie on the spot and brings the question back, and you may reverse the decision as many times as you wish, in either direction.

The control is a plain link marked with an attribute that the consent script listens for (one meaning nothing to a browser and everything to the script), rather than code written inside the page, and the script comes from this domain like every other file a page here loads. A browser's own settings are the second route, and they have the advantage of not depending on anybody's good faith: every current browser will list what an address has stored and delete it singly or in a block, and clearing ours simply brings the question back on a later visit.

The banner speaks whatever language the page does

The lines on the banner are written out by hand in English, French and Spanish, and the script chooses between them by reading the "lang" attribute of the page it finds itself in (the one a browser and a screen reader both consult), falling back to English wherever it meets something else.

That looks like fussiness and is not, because a page built for a protected market in one language, carrying a banner in another, has been translated halfway, and the half left behind is the half that asks permission.

Two tests that are mistaken for cookies

The country test belongs to the hosting (a rule in the service, not a script in the page) and runs before a page is assembled, on every address here. For the markets whose rules bar an operator licensed somewhere else, the hosting takes a country from the network address and answers with the page meant for that country; it stores nothing, it sets nothing in the browser, and no outside party sees any part of it.

The regional test is meant to run inside the browser, since a province is invisible to a hosting rule, and it would ask an outside service to tell one province from another. We have installed it on no page at the date above, so nothing on this site currently reaches past this domain at all: the typefaces, the two stylesheets, the images and the three small scripts are served from the same address as the page itself.

Neither test profiles anybody. Both exist in order to withhold a page from a market whose law forbids it, and neither of them waits on the banner. Our privacy notice carries the legal ground for that, and the address to object at.

What a refusal does not cost

The Tag Manager fragment written for browsers with scripting switched off, the one tucked inside a "noscript" element (what a browser falls back on with scripting turned off), appears nowhere on this site. It deserves its own sentence, because it is the commonest single route by which a container loads despite a refusal, and it survives on so many sites only because an installation guide told somebody to paste it in.

No part of this site is locked behind an acceptance. A reader who refuses everything gets the same lists, the same ledgers and the same figures (each with the day it was read beside it) as a reader who accepts; what changes is only that the visit teaches us nothing, and that is a bargain we are happy with. This page is the inventory, and the privacy notice is where the bases, the recipients, the retention periods and your rights are set out.