Cookie policy

What we store on your device

The list is short, and it is complete:

• NEXT_LOCALE, a cookie set by the site’s routing layer: it remembers the language you are reading in, so that a later visit does not start again in the wrong one;
• cv-reading-theme, saved in your browser’s local storage: it holds the reading mode you chose yourself, dark or paper. It is not an identifier, it says nothing about you, it is never transmitted to us or to anyone else, and it stays on your device until you delete it;
• cv-consenso, also in local storage: it holds the choice you made about the measurement tools, the moment you made it, and the version of this policy that was in force at the time. It exists so that the same question is not put to you on every page, and so that it can be put to you again when something changes that makes it a different question;
• nothing else, until you consent. Before you choose, no third-party cookie is written, no measurement tool is loaded, and no request leaves this page for an outside provider.

Two of the three entries are not cookies, and we name them anyway, on purpose. Article 122 of the Italian data protection code is not about cookies but about storing information on the device of the person browsing, and the Garante’s guidelines confirm this by covering any tracking tool, active or passive. Staying silent about what we save because technically it is not called a cookie would be the one avoidable mistake in this document.

How the choice works

Before you choose, no third-party tool runs at all: the only things on your device are the three technical entries listed above. It is a property you can check for yourself, by opening your browser’s network panel before touching any button, which is why we write it as a fact rather than as a promise.

There are three categories to choose from:

• technical, always on: the language, the reading mode and the choice itself. There is nothing to decide, because the site does not work without them, and the box is shown locked rather than presented as a choice it is not;
• statistics: Google Tag Manager and Google Analytics 4, to count visits and pages read in aggregate form;
• session recording: Microsoft Clarity, which replays the visit by recording pointer movements, clicks and scrolling. It is a category of its own and not a variant of statistics, because it is a different kind of processing: folding it into traffic counts would have you accept the recording while you thought you were giving only the numbers.

The choice is given, refused and changed from the “Cookie preferences” control at the foot of every page of this site, in the legal notices column. Refusing costs one click, exactly as accepting does, and refusing closes off nothing: the content of this site, the labs included, can be read in full without consenting to anything.

Your choice is recorded in your browser together with the date and the version of this policy. You are not asked again on every visit: you are asked again if six months go by, or if the substance changes — the providers, the purposes or the categories. Those are the cases in which the Garante’s guidelines of 10 June 2021 say consent must be sought afresh, and they are also the only cases in which a choice already made would stop describing what it was made about.

Measurement tools

These tools exist and stay switched off until you switch them on. We list them by name, with the cookies they actually write, because a generic phrase such as “analytics cookies” lets nobody check anything.

Statistics — the provider is Google Ireland Ltd., with Google LLC for processing in the United States:

• _ga, first-party cookie: a pseudonymous identifier for the browser;
• _ga_<ID>, first-party cookie: it holds the state of the measurement session. The end of the name is the identifier of the property, so the name you see in the browser ends with that code.

Google Analytics 4 is not loaded on its own: it runs inside Google Tag Manager, the single container through which this site’s tools pass. The container itself writes no cookies — the tags it hosts do — and your choice is passed to it through Consent Mode version 2.

The three advertising fields of that mechanism — ad_storage, ad_user_data, ad_personalization — stay denied at all times, even when you accept statistics, because this site carries no advertising and does not use readers’ data for remarketing. It is not a setting we could change quietly: changing it would mean rewriting this page and asking for your consent again.

Session recording — the provider is Microsoft Corporation:

• _clck, first-party cookie: the Clarity identifier for the browser, and preferences;
• _clsk, first-party cookie: it joins several page views into a single recording;
• CLID, third-party cookie: it records the first time Clarity sees this browser, on any site at all;
• ANONCHK, third-party cookie: it indicates whether MUID is passed to ANID, which Clarity does not do;
• MR, third-party cookie: it indicates whether MUID should be refreshed;
• MUID, third-party cookie: it identifies the browser across Microsoft sites. Microsoft describes it as a cookie “used for advertising, site analytics, and other operational purposes” — that is, used for advertising purposes too. We report it in the provider’s own words, without softening them: it is their fact, and staying silent about it would be the one dishonest option here. This site carries no advertising and does not process readers’ data for remarketing;
• SM, third-party cookie: it synchronises MUID across Microsoft domains.

What stays recorded, even with masking on. Clarity replays the visit: it is a session recording tool, not a counter. The masking we use is Strict mode, which hides text, form fields and images; what stays recorded is the geometry of the page, pointer movements, clicks, scrolling, the sequence of pages seen, the screen resolution, the browser as declared, and the address of the pages visited.

We write it that way, and not as “anonymous statistics”, because a recording remains a recording. That is why this is a separate category: you can refuse it while keeping statistics on, and the refusal takes effect immediately.

Third-party technical tools

Not every third party on this site measures something. Two of them exist to make two things work that you ask for yourself — sending a form and booking a call — and for that reason you are not offered a choice: there is no alternative we could put in their place, and without them the thing that would not work would be that service, not the reading. We list them all the same, with the same precision as the others, because they remain outside providers that receive data.

Cloudflare Turnstile — the provider is Cloudflare, Inc. It protects the public forms on this site from automated submissions. It writes no cookie and reads none of the existing ones; it does receive your IP address, the browser you declare and some technical characteristics of the connection, which it uses to tell a person from a program. The check is not loaded when the page opens: it appears once you start filling the form in, so if you type nothing, no request goes to Cloudflare.

Cal.com — the provider is Cal.com, Inc. It shows the calendar used to book a call. The calendar is not loaded with the page: it appears only after you ask to book. From that moment Cal.com sets __cf_bm, a third-party cookie with a technical purpose — it tells human requests from automated ones — and a short lifetime. Until you ask to book, nothing from Cal.com appears on your device.

Why we name them if they ask you for nothing. Because informing you and asking for your consent are two different duties: the second is not owed for what is needed to provide a service you asked for, the first always is. A third party left unnamed because it is “technical” would still be a third party you met without knowing.

If the tools were to change

The tools listed above are today’s tools. A change of providers, of purposes or of categories is a substantive change: in that case this page is updated before the new tool is switched on, and you are asked to choose again rather than having a consent given for something else carried over.

Two of the three services this page announced have arrived, and they are listed above: the protection of forms against automated abuse, and call booking. What remains announced is the members’ area of the analysis platform, which will be listed in the same way — with its purpose and its lifetime — before it goes live rather than afterwards.

The rule that no refusal closes off the content still stands: if one day a service could not work without consent, the thing that would not work would be that service, not the reading.

How to delete what has been saved

The simplest way is to withdraw. The “Cookie preferences” control at the foot of every page reopens the same choice as the first time: “Reject all” is a single click, and from that moment the tools are no longer loaded. Withdrawing stops the loading; cookies already written are cleared from the browser, as described below.

The reading preference and the record of your choice are removed from your browser settings, in the section dealing with site data: the two entries are called cv-reading-theme and cv-consenso. Delete the second one and, on your next visit, you will be asked to choose again as if it were the first time.

The language cookie is removed from the same screen, along with the site’s other cookies. After that the language goes back to the one your browser says it prefers, and it can always be changed with the switcher at the top of every page. The same screen also clears the cookies written by Google and by Microsoft, which you can find by the names listed above.

We write the names out in full because they are public names: a document that says “clear your preferences” without saying which ones is asking you to take its word for it, which is the opposite of what this site exists for.

Updates to this page

This page changes when what the site stores on the reader’s device changes, and the revision date at the top is the date of the last substantive change. Where the change concerns the providers, the purposes or the categories, a new version of the policy comes with that date, and you are asked to choose again.

The rest of the processing of personal data — controller, purposes, processors, transfers, rights and complaints to the supervisory authority — is described in the privacy policy, reachable from the foot of every page.

The Italian and English versions say the same thing. Should a discrepancy ever emerge, the Italian version prevails.