Cookie Policy

Last updated: 4 November 2026

Necessary storage

The site may use csrftoken for form protection and, where set, sessionid for the website session. These are separate from optional measurement cookies.

Your analytics and advertising choice is stored as eos_whisper_consent in this browser’s localStorage for this website. It remains until changed or until the browser removes the site’s local data. It is not a shared-domain consent cookie.

Before consent

Before a choice, ad_storage, ad_user_data, ad_personalization and analytics_storage default to denied. Google tag libraries may load and send consent-state and measurement pings without analytics cookies through data.eoswhisper.com. Optional Google Maps, YouTube and external font services do not load at this stage.

After Accept

GA4 uses _ga and _ga_H73HQM0THF to distinguish browsers and sessions, while _gcl_* cookies may be set only after Accept. The first-party measurement service sets the server-set FPID (HttpOnly) and FPLC cookies.

Maps, video and external services

Google Maps loads only after Accept and when requested or in view. A plain “Open in Google Maps” link remains available and navigates to Google under its own terms.

YouTube does not load before consent. Where a video is embedded, a poster is shown first and loading occurs only after Accept and the relevant interaction.

After Accept, the Adobe Fonts stylesheet can load for the site’s typography. Before consent the existing self-hosted Lato and Bodoni Moda fonts are used; fonts injected by Maps are loaded only with Maps.

reCAPTCHA Enterprise checkbox starts only on interaction with a form, even if you declined analytics. It is used for form security, with Google’s Privacy Policy and Terms.

Change or withdraw consent

Use “Cookie settings” in the footer or below to reopen the choice. Moving from Accept to Decline clears JavaScript-accessible _ga*, _gid, _gat*, _gcl_*, _gac_*, FPLC, FPAU, FPGCL*, FPGSID, _dc_gtm_*, _gaexp*, _fbp, _fbc, __utm* and _uet* cookies and the _gcl_ls key. A POST to /en/consent/withdraw/ or /el/consent/withdraw/ then expires FPID, FPLC and submitted _ga*/_gcl_* cookies with Max-Age=0 before the reload.

FPID is HttpOnly and cannot be deleted by page JavaScript. Withdrawal therefore uses the CSRF-protected endpoint above, which also expires FPLC and returns an empty 200 response.

Cookie settings