The short version
- Until you choose, and if you decline, no analytics cookies are set and Google Analytics is never even downloaded.
- Microsoft Clarity is the exception — it runs either way, but without consent it stores nothing on your device and can't link your page views together. There's a full section on this below.
- reCAPTCHA on the contact form is treated as strictly necessary, so it isn't behind the toggle.
- You can change your mind whenever you want — “Cookie settings” is in the footer of every page, and there's a button at the bottom of this one.
Strictly necessary
These make the site work or protect it from abuse. They can't be switched off, and under the ePrivacy rules they don't require consent.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
sebilations:cookie-consent | This site | Remembers what you chose here. Technically browser local storage rather than a cookie, so it's never sent to any server — it stays in your browser. | 180 days |
_GRECAPTCHA | Google reCAPTCHA | Bot detection on the contact form. Set when the contact section scrolls into view. | ~6 months |
On the consent record: keeping it is what stops the banner reappearing on every page. It holds your choice, when you made it, and which button you pressed — nothing that identifies you. After 180 days it expires and you'll be asked again.
Analytics — only with your consent
None of these exist on your device unless you've turned the Analytics toggle on.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes one visitor from another | 2 years |
_ga_<id> | Google Analytics 4 | Keeps track of session state | 2 years |
_clck | Microsoft Clarity | Links your visits to one Clarity ID, so returning visits are recognised | 1 year |
_clsk | Microsoft Clarity | Joins the page views within a single visit into one replayable session | 1 day |
Google Analytics is wired up with Google Consent Mode v2. Before you answer, every consent signal is set to denied and the Analytics library is never requested — so Google receives nothing at all, not even an anonymous ping. Advertising signals stay denied permanently, because this site runs no ads and never will.
Turn Analytics back off later and the four cookies above are actively deleted, not just left to expire.
Microsoft Clarity without consent
This is the one place where something still runs after you decline, so it gets a straight explanation rather than a table row.
Clarity loads on every page view. What changes is how much it's allowed to do:
| Analytics off (restricted) | Analytics on (full) | |
|---|---|---|
| Cookies on your device | None | _clck, _clsk |
| How you're identified | A new random ID for each page view | A stable ID across pages and visits |
| Can page 2 be linked to page 1? | No | Yes |
| Can today be linked to next week? | No | Yes |
| Still sent to Microsoft | Page address, IP, browser and device, what you did on that one page | All of that, plus a full session replay |
So in restricted mode I can see that a visitor scrolled two-thirds of the way down a blog post and left — useful for fixing the post — but there's no thread connecting that to anything else you did. Nothing accumulates into a profile.
Because this doesn't rely on your consent, it relies on legitimate interest instead, and that comes with an absolute right to object. Two ways to exercise it:
- Microsoft's global opt-out: clarity.microsoft.com/optout — it covers every site that uses Clarity, not just this one.
- Email sebigabip@gmail.com and I'll deal with it.
Browser tracking protection and content blockers also stop Clarity, and nothing on this site breaks if they do.
Third parties that don't set cookies
These don't store anything on your device, but they do receive your IP address as part of serving a request, which is worth knowing about:
- Google Fonts — the Inter typeface is fetched from
fonts.googleapis.comandfonts.gstatic.comon every page load, so Google's servers see your IP. I'd like to self-host it. - StaticForms — receives your name, email and message when you submit the contact form, and only then.
- Vercel — hosts the site, so it handles the request that delivers each page to you.
Changing your mind, and doing it yourself
The easiest route is the button below, or “Cookie settings” in the footer of any page. You can also clear cookies and site data directly in your browser — Chrome, Firefox, Safari and Edge all keep this under privacy settings. Doing that also wipes the record of your choice, so the banner will come back.
Blocking everything won't break the site. The only casualty is the contact form, which needs reCAPTCHA to work — if it's blocked, email me instead.
Full context on who processes what, and your rights over it, is in the privacy policy.