Cookie Policy and Consent

Some cookies are set by us, from this domain. Those are first party cookies. Others may be set by a service we use, from that service’s own domain, and those are third party cookies. The sections below describe the cookie types used and how each type works.

A cookie is a small text file that a website asks your browser to store, and that your browser sends back on later requests. It is how a site recognises that two page loads came from the same browser, which is otherwise invisible to it.

That mechanism is useful and neutral in itself. Remembering that you dismissed a notice, or that you prefer a particular language, requires it. Building a profile of your browsing across many sites also requires it. The technology is the same; the purpose is what differs, which is why the law treats the categories differently rather than banning cookies.

The other technologies this policy covers

“Cookies” is shorthand. Several other mechanisms do similar work and the law treats them the same way, so this policy covers all of them.

Local storage and session storage hold data in your browser the way a cookie does, but are not sent automatically with every request. Local storage persists until it is cleared; session storage disappears when you close the tab. A consent preference is often held in local storage rather than a cookie.

Pixel tags, also called web beacons or tracking pixels, are tiny images or scripts embedded in a page or an email. Loading one tells the server that the page or the email was opened, and can set or read a cookie at the same time.

Device and browser fingerprinting infers an identifier from the combination of your screen size, fonts, time zone, browser version and other characteristics, without storing anything on your device. It needs consent on the same basis as a cookie, and we do not use it.

Software development kits and tag managers load other scripts on a page. A tag manager that fires an analytics or advertising script is subject to consent for whatever it fires.

Where this policy says “cookies” it means all of these unless it says otherwise.

First party and third party

A first party cookie is set by the domain you are visiting, which here is this site. A third party cookie is set by another domain whose content or script is loaded into the page, such as an analytics provider, an advertising network or an embedded video player.

Third party cookies are the ones that can follow you between unrelated websites, which is why most browsers now block them by default and why regulators scrutinise them most closely. Where we use any, the table names the vendor and the domain.

Every cookie on this site falls into one of four categories. The first is set automatically; the other three wait for consent.

Nothing on this site is gated behind consent. Every article, every table and every policy page is fully readable with all three optional categories declined. Declining is a real option and not a degraded experience.

These are set because the site cannot do what you asked without them. Under UK and EU cookie rules this category is exempt from the consent requirement, but the exemption is narrow: it covers what is strictly necessary to provide the service you requested, and it does not stretch to analytics, however much we might want the data.

What legitimately belongs here on a site like this one: a session cookie that allows the web server or caching layer to serve the right version of a page; a security or firewall cookie that distinguishes a reader from an automated attack; a cross-site request forgery token on the contact form, which exists to stop a third party site submitting the form on your behalf; and the cookie or storage key that records your cookie consent choice, which is necessary precisely so that we do not have to ask you again on every page.

That last one is worth noting: the consent record itself is a strictly necessary cookie. A site that honours your refusal has to remember it somewhere.

These remember a choice you made so the site behaves the way you left it. They are a convenience, not a necessity, so they need consent.

On this site the realistic uses are narrow: remembering whether you were reading the English or the Arabic version, remembering that you closed a notice so it does not reappear on every page, and remembering a display preference such as text size if one is offered.

Analytics tell us which pages are read, how readers arrive, roughly which country they are in, and whether a page is slow or broken on mobile. That information is what keeps a price guide from going stale and decides which city buying guide gets written next.

We configure analytics to be as unintrusive as the tool permits: measurement at page and country level rather than individual level, IP truncation or anonymisation where the provider supports it, the shortest useful data retention setting, and no sharing with the provider for its own advertising purposes where that can be switched off.

None of that makes analytics exempt. Analytics cookies are non-essential under UK and EU rules, they require consent, and on this site they do not load until consent is given. If you decline, the analytics script does not run and no analytics cookie is set.

Advertising cookies select which advertisements you see, cap how often you see the same one, and measure whether an advertisement led to anything. If advertising runs through Google AdSense, Google and its partners may use cookies to serve ads based on your prior visits, and you can opt out of personalised advertising through Google Ads Settings and at aboutads.info. The ones that matter most to privacy are the ones that build an interest profile across unrelated websites.

Advertising cookies are only set where advertising is live and consent has been given.

Where advertising is introduced, four commitments apply:

1. No advertising technology will load before consent.

   Not the network’s script, not a tag manager that fires it, not a pixel.

2. The vendor will be named here and in the privacy policy before it goes live.

   A new advertising vendor appearing on the site without appearing in this policy first would be a failure of the process, not an oversight.

3. The consent banner will be re-prompted.

   When advertising is added, consent is collected for the new purpose rather than inferred from a choice made before it existed.

4. The US state law section of the privacy policy will be revised at the same time.

   Personalised advertising may constitute “sharing” for cross-context behavioural advertising under California law even with no money changing hands, which triggers an opt-out link in the footer.

Affiliate links work differently from the categories above and are easy to misunderstand, so they get their own section.

When you click an affiliate link, you are sent to the merchant’s site, usually through a redirect at the affiliate network. The network and the merchant then set cookies on their own domains, recording that the visit came from here so a commission can be attributed. Those cookies are not set by us, we cannot read them, and we cannot delete them for you. They typically expire after a window set by the merchant, commonly between a day and a month.

What we receive back is a report of counts: clicks from a page, conversions, commission earned. It does not identify you to us.

Because the cookie is set on the destination domain after you click, it is governed by the merchant’s and the network’s own cookie policies, which is a reason to read the policy of a site you are about to buy from. Where a redirect on this domain is involved, any cookie it sets is listed in the tables above.

The commercial side of affiliate links, which programmes we are in and how products are selected, is on the affiliate and advertising disclosure page. The editorial independence commitment is in the disclaimer.

Articles sometimes embed content hosted elsewhere, such as a video player, a map, a web font or a social media post. An embed is a request to that third party’s server, and the third party can set cookies and see your IP address when the embed loads.

An embed therefore needs consent in the same way an analytics script does. Where embedded content is used on this site it is configured to load only after consent, using a click-to-load placeholder where the service supports one, so that nothing reaches the third party until you ask for it.

Web fonts are the one most often forgotten: a font loaded from a third party CDN sends your IP address to that CDN on every page view, and the cleanest answer is to self-host fonts, which removes the issue entirely.

Once the consent tool is live on the site, a consent banner will appear on your first visit. It is designed to meet the standard the law actually sets, which is a specific and often ignored list.

1. Non-essential cookies do not fire before you choose.

   This is the requirement that most sites fail. The analytics and advertising scripts are blocked until consent is recorded, rather than loading immediately with a notice displayed over the top. A banner that says “we use cookies” while the cookies are already set is not consent; it is notification after the fact.

2. Accepting and rejecting are equally easy.

   There is a reject button on the first layer of the banner, with the same visual weight as the accept button. Not a link. Not buried behind “manage preferences”. Not a grey outline next to a coloured accept button.

3. Nothing is pre-ticked.

   Every optional category starts off. Consent has to be an active choice, and a pre-selected checkbox is not one.

4. Granular choice is available.

   You can accept analytics and refuse advertising, or any other combination. All-or-nothing is not valid consent where the purposes are separable.

5. Closing the banner is not consent.

   Dismissing it, scrolling past it, or continuing to read does not count as agreement. Implied consent through continued browsing was permitted under earlier guidance and is not any more.

6. We tell you who, before you choose.

   The banner names the categories and links to this page, where the categories are described, so that consent is informed rather than blind.

7. No cookie walls.

   Access to the site is never conditioned on accepting non-essential cookies. There is nothing to unlock.

8. The choice is recorded.

   We store what you chose and when, because under UK and EU rules we have to be able to demonstrate that valid consent was obtained.

Withdrawal is as easy as consent, which is a legal requirement and not a courtesy.

Use the cookie settings control. A persistent link or button will be available on every page, in the footer and from this page, which reopens the consent panel. Change any category and save. The change takes effect immediately.

What happens when you withdraw. The script for that category stops running from that point. Cookies already set in the withdrawn category are deleted where the consent platform can delete them, and where it cannot, the section below explains how to clear them yourself. Withdrawal does not undo measurement that already happened; it stops any further measurement.

Clearing cookies in your browser also works, and resets the banner so you will be asked again on your next visit.

You do not need to email us to withdraw consent and you do not need to give a reason.

A consent choice is not permanent. We re-ask in four situations:

• When the stored consent record reaches the end of its configured lifetime, which is set to a period measured in months rather than years so that a choice made long ago is not relied on indefinitely
• When we add a new purpose or a new vendor, because a choice made before something existed cannot cover it
• When you clear your browser cookies, which removes the record of your choice along with everything else
• When the consent platform’s configuration changes materially

The consent record lasts for a period measured in months rather than years, as described in the consent section above.

Your browser gives you controls that work across every site, and they override anything a site’s own banner does. These are worth knowing about even on a site that respects your choice, because most sites do not.

Block third party cookies. Now the default in several browsers. It stops the cross-site tracking category almost entirely, with little effect on ordinary site function.

Block all cookies. Effective and blunt. Many sites break, because logins and shopping baskets need cookies. This site remains fully readable, although it will ask about cookies on every visit because it cannot remember that you said no.

Clear cookies on exit. A good middle setting. Each visit starts clean.

Private or incognito browsing. Cookies set during the session are discarded when you close the window. Note that this hides nothing from your network or employer; it only clears local storage.

Do Not Track. Largely ignored by the industry and effectively obsolete. It does not reliably stop anything.

Global Privacy Control. A newer signal, sent by some browsers and privacy extensions, that is legally recognised as a valid opt-out in California and some other US states.

Tracker-blocking extensions go further than browser settings and block requests to known tracking domains before they load.

Where to find the settings: Chrome under Settings then Privacy and security; Safari under Settings then Privacy; Firefox under Settings then Privacy and Security; Edge under Settings then Cookies and site permissions. Mobile browsers have the same controls in their own settings apps. If a setting has moved, the browser vendor’s own help pages are the reliable source rather than a third party guide.

The two documents answer different questions and are written to be read together.

This page answers: what is stored on your device, by whom, for how long, and how do you control it. The mechanism.

The privacy policy answers: what personal data do we hold, why, on what lawful basis, who else sees it, how long do we keep it, and what rights do you have over it. The substance.

Cookie consent and the GDPR lawful basis are related but not identical. Consent under the UK and EU cookie rules is what makes it lawful to place a non-essential cookie on your device at all. If that cookie then results in personal data being processed, the processing also needs a lawful basis under GDPR, which for analytics and advertising on this site is the same consent. Withdrawing consent therefore does two things at once: it stops the storage and it removes the basis for the processing.

Your rights over data already collected, including access, correction and erasure, come from the privacy policy, not from this page. The procedure for making a request is set out there.

Email [email protected] for questions about cookies.

If you want to know what a specific cookie on this site does, name it and we will tell you. If you believe a cookie is being set before consent, that is worth reporting and we will check it, because a consent banner that is misconfigured is a problem we would rather hear about from a reader than from a regulator.

This page changes whenever the cookies do, which in practice means whenever a vendor, a tag or a plugin is added, removed or updated.

How changes are communicated:

• The Last updated date at the top changes on every substantive edit, and the page’s dateModified changes with it.
• A short summary of what changed sits beneath the Last updated line for at least 30 days, naming any cookie or vendor added or removed.
• A new purpose or a new vendor triggers a re-prompt of the consent banner. This is the important one. We do not treat an existing consent as covering a purpose that did not exist when it was given, so adding advertising, a new analytics tool or a new embed means asking again rather than assuming.
• Removing a cookie needs no re-prompt, but the table is updated so that the page continues to match reality.
• Typographical corrections are made without notice.

Earlier versions are retained so that we can say what cookies the site used on a given date.