Five cookies possible, all disclosed, all revocable.
No advertising cookies, no retargeting pixels, no profile-building. One analytics tool (Google Analytics 4) that writes cookies under Consent Mode v2 — on by default, auto-revoked for Sec-GPC / DNT browsers and for anyone who clicks Decline. The other cookies are strictly-necessary or preference-only. Full list below — revoke any time.
Manage your consent
Analytics consent: loading…
Click to change. Takes effect immediately. GA4 cookies set after Accept: _ga, _ga_G-9XSQMGB7DV.
Complete cookie list
| Name | Purpose | Party | When set | Lifetime | SameSite |
|---|---|---|---|---|---|
_ga |
Google Analytics 4 client identifier (pseudonymous session grouping). | First-party (Google) | Only after you click Accept on the banner or above. | 2 years | Lax |
_ga_G-9XSQMGB7DV |
GA4 session state for this specific stream. | First-party (Google) | Only after you click Accept. | 2 years | Lax |
ssp_consent |
Records your consent choice so we don't re-ask every page. | First-party (SupplierSpy) | When you click Accept or Decline. | 1 year | Lax |
ssp_view |
Reading-mode preference (lite or pro). |
First-party (SupplierSpy) | Only after you click the Lite/Pro toggle. | 1 year | Lax |
__cf_bm |
Cloudflare bot-defence challenge state. | Third-party (Cloudflare) | Always — operational, not advertising. | 30 minutes | None |
Nothing else. No Meta Pixel, no TikTok Pixel, no LinkedIn Insight, no Hotjar, no Clarity, no Mixpanel, no Segment, no ad-network cookies of any kind.
How the consent banner works
On your first visit, a banner at the bottom of the page offers two equal-weight buttons: Accept and Decline. No pre-checked boxes, no "Accept All" vs buried "Reject" dark pattern. Your choice is remembered via the ssp_consent cookie (strictly necessary under ePrivacy Art. 5(3) — a record of refusal is itself refusal).
The Google tag loads on every page in Consent Mode v2 with analytics_storage granted by default and ad_* permanently denied. Analytics auto-revokes when the browser sends Sec-GPC: 1 or DNT: 1, and when you click Decline. Clicking Accept after a Decline flips the state back; cookies _ga and _ga_G-9XSQMGB7DV are only written while consent is granted.
If your browser sends Global Privacy Control (Sec-GPC: 1) or Do Not Track (DNT: 1), the banner doesn't show at all — the signal is honored automatically and analytics stays denied for the duration of your visit.
Legal basis & references
- ePrivacy Directive 2002/58/EC (as amended by 2009/136/EC), Art. 5(3): prior consent required for storing info on the user's device, except where strictly necessary.
ssp_consent+__cf_bmfall under the strictly-necessary carve-out;_ga,_ga_*,ssp_vieware set only after an explicit action. - GDPR Art. 6(1)(a): consent as the legal basis for analytics processing. Obtained via the banner or this page's controls.
- Italian Garante Privacy cookie guidelines (10 June 2021): banner with equal-weight Accept / Decline; no scroll-equals-consent; the "X" close-button does not equal consent.
- UK ICO cookie guidance: parallel framework; same banner satisfies both.