EnergyScope

Cookies and preferences

See the cookies and similar technologies the current implementation actually uses, what remains off, and how to manage this device's preference.

Current implementation status

Google Analytics loads only after an explicit choice

When production has a valid GA4 Measurement ID, public pages can load Google Analytics 4 after you accept. No analytics request is sent to Google before a choice or after rejection. Advertising, cross-site profiling, tracking pixels and third-party social embeds are not enabled.

Analytics on public pages: Off by default; loaded after consent
Cookie-preference record: First-party, necessary, 180 days
Advertising and cross-site tracking: Not enabled
Code and guidance last checked: 4 October 2026

Cookies and similar technologies

Necessary functionality is kept separate from non-essential tracking

A cookie is a small item a website asks a browser to store. PECR also covers local storage, pixels, fingerprinting, scripts, SDKs and other ways of storing or accessing information on a device, so this review is not limited to files named cookies.

Nothing loads before consent

The Google tag is not downloaded or run until analytics is explicitly accepted.

Rejecting is as easy as accepting

The notice offers both choices. Continued browsing, silence or scrolling is not consent.

The purpose stays limited

Analytics measures public-page use only. Tool inputs, quotes, complaint answers and form contents are not sent.

Consent can be withdrawn

You can turn analytics off here. The code disables the tag and attempts to remove this site's GA cookies.

Current inventory

Cookies the current implementation may use

Names can vary because of HTTPS security prefixes and Auth.js chunking. This lists each cookie family, its trigger, sole purpose and longest expected duration.

Cookie or technology	When it appears	Sole purpose	Duration and control
es_cookie_preferences	After you save a choice in the notice or on this page	Records only that this notice version is necessary-only, avoiding a repeat on every page.	180 days; first-party, SameSite=Lax; Secure on HTTPS; removable below.
authjs.session-token (may use __Secure- and .0/.1 chunks on HTTPS)	After an allowlisted administrator completes Google sign-in	Maintains an administrator session that remains subject to server-side RBAC checks.	Up to 8 hours; HttpOnly, SameSite=Lax and Secure on production HTTPS; removed on sign-out or expiry.
authjs.csrf-token, authjs.callback-url and authjs.nonce	When an administrator starts sign-in, sign-out or a callback flow	Protects cross-site requests and returns an OAuth response to the correct location.	For the flow or session as required; HttpOnly, SameSite=Lax and secure-prefixed on production HTTPS.
authjs.pkce.code_verifier and authjs.state	When an administrator starts Google OAuth	Validates the OAuth/PKCE flow and reduces callback substitution or replay risk.	15 minutes; HttpOnly, SameSite=Lax and Secure on production HTTPS.
_ga／_ga_<measurement-id>	Only when production has GA4 configured and you accept analytics	Measures public-page views and navigation performance to improve site content; advertising personalisation is disabled.	Google defaults to up to 2 years. On withdrawal, the code disables the tag and attempts to remove this site's _ga cookies.

Public users do not sign in and do not receive an administrator session merely by reading, using a tool, downloading, subscribing or making a business enquiry. Choosing Google sign-in also takes the browser to Google; Google controls cookies on its own domains and this notice does not treat them as covered by blank EnergyScope consent.

Not currently deployed

The following remain off and are not loaded when you accept analytics:

Advertising, retargeting, affiliate or cross-site profiling.
Social pixels, like buttons or automatically loaded embeds; sharing controls open an external link only after the user acts.
Sending tool inputs, quote values, complaint answers or form contents to analytics or storing them in localStorage for tracking.
Email tracking pixels, including on token-action pages.

UK rules

PECR Regulation 6 and the UK GDPR consent standard

Current ICO guidance says that, unless a purpose-specific exception applies, an online service must provide clear and comprehensive information and obtain UK GDPR-standard consent before storing or accessing device information. The information should cover the technology, purpose, third parties and duration.

Necessary or properly exempt purposes

Authenticating a user, protecting sign-in security and solely remembering a cookie choice may qualify for the strictly necessary exception where its conditions are met. An exception is not a general pass: the technology must remain limited to that necessary purpose and still be explained transparently.

Purposes requiring consent

EnergyScope does not rely on the statistical-purpose exception to load Google Analytics 4. It obtains a freely given, specific, informed and affirmative choice first; rejection is as easy as acceptance, the default is off and consent can be withdrawn.

A changed purpose, provider, event or duration requires an updated inventory, a new preference version and a fresh applicable choice. Existing consent does not automatically extend to advertising or another tool.

Your choice

Manage this device's preference

Necessary cookies and Google Analytics 4 can be chosen separately. Analytics is off by default. If this environment has no Measurement ID, the option remains unavailable. Clearing the choice makes the notice return.

No current-version choice saved

Necessary cookies

Used to remember this preference and, when an administrator chooses to sign in, to provide OAuth security and a session. These cannot be disabled here.

Always on

Google Analytics 4

Measures use of public pages only. Tool inputs, quotes, complaint answers and form contents are not sent. The Google tag loads only after an explicit acceptance.

Off

Browser controls

You can also inspect or remove cookies in your browser

Most browsers let you inspect, block or delete cookies by site and limit cross-site tracking. Names and steps vary by browser and device.

Deleting es_cookie_preferences makes this notice return.
Deleting _ga and _ga_<measurement-id> removes this site's GA identifier cookies; you can first turn analytics off above.
Deleting Auth.js cookies ends or disrupts an administrator sign-in flow; public visitors are unaffected.
Hosting request logs, form database records and email records are not browser cookies; see the privacy notice for those processes.

On a shared device, an administrator should sign out after use. Closing a tab does not necessarily end a session that is still valid.

Read the privacy notice

Official legislation and guidance

UK legislation · PECR 2003 (as amended)ICO · Storage and access technologies guidance ICO · PECR rules and consent ICO · Exceptions Google · How Google uses cookies Google Analytics · Cookie usage Google · Basic consent mode

Code, Google Analytics cookie and Consent Mode documentation, and ICO guidance last checked: 4 October 2026. This is not a legal certification; scan and review again after the production domain, provider settings or law changes.