Cookie policy
This page is the working end of the demo. Everything below is read live from the browser, so whatever the banner has actually done is what you see — not a description of what it ought to have done.
What this site sets
Three of its own, and then whatever the tag stack decides to store. The first-party ones first, because they are the ones this site is responsible for.
| Cookie | When | Why it is here |
|---|---|---|
| vc_visitor | On arrival, before any decision | Deliberately wrong. The scanner exists to find cookies set before consent, and it needs something to find. This is the only thing on the site done badly on purpose. |
| vc_analytics | Only after statistics is accepted | The correct pattern: nothing is written speculatively, and nothing is written back if consent is withdrawn. |
| yupkit_consent | When the banner is answered | The banner's own record of the decision, on this domain. First party, and the only thing the embed stores. |
The tag stack
Twelve tags, added one at a time over about four years, which is an ordinary number for an institution this size. Every account id in them is fictional — the requests are real, the reporting goes nowhere — so the site stays a working demo without live advertising accounts behind it. What each one is allowed to do is the interesting column.
| Tag | Category | How it is gated |
|---|---|---|
| Google Tag Manager googletagmanager.com |
Statistics |
Loaded on arrival, gated by Consent Mode v2.
Google's tags read the banner's all-denied default out of the
dataLayer before they do anything, so they start up
able to measure and unable to store. The cookies appear at the
consent update, which is the moment you answer — not
at page load.
|
| Google Analytics 4 google-analytics.com |
Statistics | |
| Google Ads googleadservices.com |
Marketing | |
| Meta Pixel connect.facebook.net |
Marketing | Not loaded at all until the category is granted. None of these honours Consent Mode, and a tag that cannot be told "no" has to be a tag that is never asked. Before consent no request leaves the page — which is stronger than loading it and hoping the vendor behaves. |
| LinkedIn Insight Tag snap.licdn.com |
Marketing | |
| TikTok Pixel analytics.tiktok.com |
Marketing | |
| YouTube youtube-nocookie.com |
Marketing | |
| Hotjar static.hotjar.com |
Statistics | |
| Microsoft Clarity clarity.ms |
Statistics | |
| HubSpot js.hs-scripts.com |
Statistics | |
| Intercom widget.intercom.io |
Preferences | |
| Typeform embed.typeform.com |
Preferences |
What they store, in practice. Because every account id
on this site is fictional, most of these vendors store nothing at all —
they will not open a session for an account that does not exist. The ones
that do, measured rather than assumed:
_ga, _ga_VC1963DEMO
and _gcl_au on this domain, from Google, and
only ever after a decision;
test_cookie on doubleclick.net;
bcookie, li_gc and
lidc on linkedin.com;
_ttp on tiktok.com. The rest
contact their vendor and store nothing — which is still a third party
this page talked to, and still worth disclosing.
Preferences is not a technicality. The chat widget and the enquiry form are functional, and putting them behind marketing consent — which is the easy mistake, because they are third parties and third parties feel like advertising — breaks the page for somebody who answered the banner honestly.
What the banner did
yupkit_consent
reading…
This site's own cookies
reading…
The tag stack, right now
reading…
What the tags have stored
reading…
Google Consent Mode v2 (dataLayer)
reading…
IAB TCF
reading…
Changing your mind. The control is in the footer of
every page here, and there is a button below. It is plain markup
— <a href="#yupkit-preferences"> — with no
JavaScript, which is what lets it work under the
Content-Security-Policy this site sends. Any element carrying
data-yupkit-preferences does the same, and
window.yupkit.showPreferences() is there for anyone who
would rather write a line of script.
Turning everything back off is recorded as a withdrawal rather than a refusal, and answering again after the policy changes is recorded as a renewal rather than an edit. Watch the inspector above while you do it.
Where the data goes
Nine companies, listed above, in the United States, Ireland, Singapore and — for TikTok — a set of jurisdictions its own documentation describes at length. Their cookies are set on this domain where they can be (Google's, Meta's, Hotjar's) and on their own where they cannot, and the difference is invisible to you and irrelevant to what they learn.
Which is the actual argument for the gating above. A list of vendors is a disclosure; not loading them is a decision. This site does the second one for everything except Google, where Consent Mode is a genuine alternative because Google's tags read the answer instead of being told after the fact.