Cookie and local-storage policy

Security, authentication, language, session, form-draft, basket and consent-preference storage may be necessary to deliver a requested service. The live cookie inventory must identify each key, provider, purpose and duration.

Analytics, advertising or third-party media storage is disabled until the required consent is obtained. Refusal must be as easy as acceptance, optional choices must not be preselected and withdrawal must be available through the privacy controls.

This policy must be updated from the deployed consent manager and browser scan before production. A generic category statement does not replace the current inventory.