No cookie banner. Here is why.

1Why there is no banner

A cookie banner exists to ask permission for what a site puts on your device to follow you. This site does not do that. There is no advertising cookie on it and no profile is built from your visit. A banner would then be a question about something that does not happen here, and I would rather not put that in front of you.

Visit statistics are measured with Plausible. It works without cookies: nothing is placed on your device and nothing is read from it. No profile is built, you cannot be recognised on a later visit, and you cannot be followed from this site to another one. What does get counted is in the privacy policy.

That position holds exactly as long as Plausible is the only measurement that runs in your browser. The Google Ads connection is still being set up. Once it is active, my server will report enquiries that came in through a Google ad to Google Ads, as described below, and that report will go from my server to Google. In your browser, the click ID only sits in session storage until you close the tab. Where that entry stands under the rules is explained in the section on the rules. The moment a tag arrives that does put an identifier on your device, consent becomes mandatory and a banner appears. What else that would mean is further down this page.

2What does end up on your device

Three things, and none of them keeps track of you. The language cookie and the /studio login key are functional, so they are allowed without consent. For diginesso.first-touch I take the same view, and the section on the rules explains why that question is not settled. All three have to be named, so here they are, with their contents and how long they last.

Nothing else is stored. No cookie that records which pages you read, and no identifier that ties today’s visit to the one you make next week.

3The entry that remembers what brought you in

The one entry this site writes to your device is called diginesso.first-touch. It is written on the page your visit starts on, whichever page that is, and sits in your browser’s session storage. That is something other than a cookie: it never travels with a request to the server, and it disappears the moment you close the tab.

What is in it:

• the page your visit started on
• the site that sent you here, if that was a site other than this one
• the campaign labels from the link you arrived through: utm_source, utm_medium and utm_campaign
• the Google Ads click ID, gclid, if you came through an ad

There is no name in it, no email address and no IP address. The click ID is a code Google attaches to a click on an ad. It tells me nothing about who you are, but Google can connect it to the click it belongs to.

Why it is there: the visit statistics are cookieless and therefore anonymous, so they can never show where an enquiry came from. And someone who reads a few pages first may well fill in the form on a different one. Without this single entry, an enquiry like that no longer shows whether it came from an ad, from a search engine or from someone else’s recommendation.

Come back a week later and it starts over. Nothing is kept from your previous visit.

What happens to it: the entry itself stays in your browser. Its values are stored with your enquiry, in my database, only when you send a form yourself. Send nothing and nothing from it is stored, by me or by Google.

The link you arrive through goes the way of any web address. The page you land on, the campaign labels and a gclid are part of that link, so they reach the server with the first page load and end up in its log lines, which are kept for 30 days at most. Where the Plausible script runs, it sends the address as well, to count the visit.

Once the Google Ads connection is set up and active, one value will travel further. If you came through a Google ad and then send an enquiry, my server will later report it to Google Ads, sending the click ID from your first visit, which conversion the enquiry counts as, the time of that conversion, and a value if one has been set. Your name, email address and message will not go along. That will show me which ads bring in enquiries, with no Google tag in your browser. Until the connection is active, nothing from your enquiry goes to Google.

Doing it this way keeps this site free of an ad tag and of the banner such a tag would need: the report will go from my server to Google, and nothing in your browser talks to Google Ads. The legal basis, and how to object, are in the privacy policy.

Clearing it yourself: close the tab and it is gone. If you would rather not wait, clear the storage for this site in your browser. That sits under the site settings you reach through the icon at the left of the address bar. The site keeps working afterwards.

4What the rules say about this

There is a line here and I would rather be open about it. The European rule on this covers storing data on your device and reading data from it, so it covers more than cookies alone: session storage falls under it too. It is Article 5(3) of the ePrivacy Directive, written into national law in every member state. For Diginesso that is Article 122 of the Italian Codice Privacy.

Data that is strictly necessary to deliver what you asked for yourself needs no consent. I treat this entry as falling under that. It holds only what the link and your browser already told the server on arrival. It leaves your browser only inside a form you send yourself, and then it belongs to that enquiry. Knowing where an enquiry came from is the legitimate interest the privacy policy names for what is stored with it. That interest covers what I do with the data once you have sent it. Whether the entry may sit on your device without consent is a separate question, and it is the one this rule asks.

On a strict reading, remembering how a visit began is not strictly necessary for what you asked for, and consent would be required. I am not going to pretend the question is settled. Once the Google Ads connection is active, the click ID in the entry will also go on to Google Ads, and that gives the strict reading more weight.

What I have done is keep it as small as it can be. One entry, no cookie, no ID of its own that could recognise you on a later visit, nothing that follows you across sites, and gone the moment you close the tab. If a supervisory authority or a lawyer holds that it has to be done differently, the entry goes and this page changes first.

5The language cookie

This site exists in four languages and each language has its own address. Pick a different language in the menu and the site sets a cookie named NEXT_LOCALE. It holds a language code and nothing else: nl, en, de or it.

It is also set when the language you are shown is not the language your browser asks for. The site then knows on the next page that you picked something else yourself.

No expiry date is set on it, so it is a session cookie: it disappears when you close your browser. If your browser restores everything after a restart, it can survive that restart. There is no number in it that points to you and it goes to nobody other than this site.

6Signing in to the content system

At /studio sits the place where the text and images of the site are managed. I am the only one who can sign in there. Signing in makes Sanity, the system behind it, put a login key in the browser that signed in.

For a visitor nothing happens there. Without signing in no login key lands in your browser, and I am the only one who can sign in.

7What is not on this site

This is the list I would want to see myself on a site that makes this promise.

• no advertising cookie and no advertising pixel
• no Meta pixel and no LinkedIn tag
• no Google Ads tag. Once the Google Ads connection is active, enquiries that came in through a Google ad will be reported by my server, as described below.
• no session recording and no heatmap, so nobody is watching your mouse
• no A/B tool that puts you in a group and stores that on your device
• no bot check from Google on the form. It has one invisible field that only bots fill in, and that is enough.
• no fonts from another domain. They ship with the site, so your browser makes no request to Google Fonts.
• no embedded video and no embedded map from another site, because those place something on your device themselves.
• no consent platform. Nothing on this site tracks you, and where diginesso.first-touch stands under the rules is explained above, in the section on the rules.

8Clearing or blocking it yourself

Everything above can be removed by you. Every browser has a button under the site settings, reached through the icon at the left of the address bar, that clears the cookies and storage for this site. The privacy and data settings do the same thing.

Block storage for this site altogether and the site keeps working. You then pick the language again on every visit, and with an enquiry I no longer see what brought you in. Beyond that you would notice nothing.

If an extension stops the Plausible script, I lose one tick in a counter and you lose nothing.

9Google Ads without a tag in your browser

Most sites that advertise on Google measure which ads bring in enquiries with a Google Ads conversion tag in your browser. This site does not. The route chosen for it runs through my server, and that connection is still being set up.

A tag like that does put an identifier on your device and it is there to follow you. Consent would then be mandatory, and it would mean:

• a banner, with a real choice and a refusal as easy as a yes
• measurement that has to obey that choice, through the consent signalling Google requires for it
• for European visitors a certified consent platform, which Google requires, so another party would join that sees something of you
• the promise on the rest of the site, that nothing is placed on your device to follow you, would stop being true and would have to come off everywhere

So conversions will go the other way. An enquiry sits in my database anyway, with the click ID from diginesso.first-touch if you came through a Google ad. Once the connection is active, my server will report it from there to Diginesso’s own Google Ads account, with no tag in your browser and no cookie. That is why this page can stay as it reads now: no ad tag and no consent banner.

What will go to Google, on which legal basis and how to object is in the privacy policy, under the contact form.

A Meta pixel or any other tag would still bring everything in the list above. And what will not happen under any circumstances: switching something on and updating this page afterwards. If something is added, it appears here before it goes live. That is the same promise as in the privacy policy and on the Secure and European page.

10A question about this

Write to info@diginesso.com. It reaches me, Wesley Beerendonk, and I answer it myself. You hear back within five working days.

If you want to see which data is kept about you and for how long, that is in the privacy policy. If you want to know how the technology underneath is arranged, that is on the Secure and European page.

Diginesso di Beerendonk Wesley Johannes Wijnand, Piazza Guglielmo Marconi 6, 56046 Riparbella (PI), Italia.

11Changes and versions

If what ends up on your device changes, this page changes before that change goes in.