Cookies

What this site sets before you choose

Nothing. No analytics cookies, no advertising cookies, no fingerprinting, and no request to any third-party domain. Fonts are served from our own origin rather than a font CDN. Open your browser’s developer tools and check. We would rather you did.

That is not a courtesy, it is the order the law puts things in. Under the ePrivacy Directive and its national implementations, consent has to come before anything is stored on or read from your device, not after. So the tag manager described below is not loaded and suppressed, and it is not loaded with its signals turned down. It is not loaded.

Your choice

This is the same control as the banner, and it works in both directions.

Checking your current choice…

We record your answer in your browser’s local storage, underverhelm.consent, so we do not ask again on your next visit. That one entry is the only thing this site stores on your device without asking, and storing your refusal is the only way to honour it. Clearing your browser storage clears it, and the question comes back.

If you accept: Google Tag Manager

Saying yes loads Google Tag Manager, container GTM-5LD94DHG, from googletagmanager.com. It is a container for measurement tags rather than a measurement tool itself, and three consequences follow from accepting it:

• Your browser requests a script from Google, which means Google receives your IP address and user-agent string along with the page you were on.
• The tags inside the container set cookies on this domain — typically _ga and _ga_…, which hold a randomly generated identifier for around two years and let Google distinguish one browser from another across visits.
• That data goes to Google, in the United States and elsewhere, under Google’s terms rather than ours. It is named as a recipient in our privacy notice, along with the transfer safeguards we rely on.

We use it to answer questions of the form “did anyone read the thing we spent a week writing”. We do not use it for advertising, we run no remarketing or audience tags in the container, and we do not sell or share what it collects.

Changing your mind

Use the control above. Withdrawing is one button in the same place as the one that turned it on, because Article 7(3) of the GDPR requires withdrawal to be as easy as consent, and section 6(6) of the DPDP Act says the same. Withdrawing clears the cookies Google set on this domain and reloads the page without the container. It does not undo what was collected while you were consenting, which we cannot honestly claim to be able to reverse.

What this page used to say

Until August 2026 this page said there was nothing to consent to, because there was nothing to consent to: the site carried no third-party tracking at all, and the absence of a banner was the argument. We have since decided we want to know which of these pages get read, and that is a real trade against the position we held. We would rather write that down than quietly reword the page and hope nobody had read the old one.

The version we chose is the strict one — nothing loads before you answer, no is a button and not a maze, and there is no pre-ticked box anywhere on this site. If the measurement turns out not to be worth the trade, we will take it out and say so here.

Other third-party requests

There are none. No embedded video, no social widget, no chat bubble, no font CDN, no advertising pixel. Google Tag Manager, after you accept it, is the only third-party request this site makes.

If you follow an outbound link, to AIAuditSense, to EUR-Lex or to a scheduling tool, you are then on someone else’s site under their policies, not ours.

Two exceptions, for us

The content management system at /studio sets a session cookie so the directors can log in and edit articles. The enquiries page at /admin sets one for the same reason, so a director who has entered the password stays signed in for twelve hours while reading messages sent through the contact form.

Both are strictly necessary for a function only an authenticated director can reach, both are set only after a successful sign-in, and neither is ever set on a visitor’s device. Neither requires consent, and neither is used for measurement. Neither /studio nor /adminloads the tag manager under any circumstances — those pages list other people’s enquiries, and their addresses are not Google’s business.