Cookie policy

Last updated: 30 September 2026 (the LinkedIn Insight Tag, Mautic, and the sign-in cookie).

CASRAI.org uses a small number of cookies. Some are strictly necessary for the site to work (sign-in, Ask CASRAI, Cloudflare’s protection). The rest are for measurement: Google Analytics 4 for site analytics, the LinkedIn Insight Tag for advertising measurement (which of our LinkedIn campaigns bring visitors), and our own Mautic instance for marketing analytics. The site also carries promotional placements for lac.us / LAC Health (a medical and laboratory supply distributor, and a commercial partner of CASRAI — see our disclosure page). Those placements are plain links and images and set no cookie of their own; following one passes your Mautic device identifier to lac.us, as described below.

Cookies we set

Cookie	Set by	Purpose	Lifespan	Category
_ga	GA4 (Google Analytics)	Distinguishes unique visitors	13 months	Analytics
_ga_J5HT9GKYTN	GA4 (Google Analytics)	Persists per-property session state	13 months	Analytics
LinkedIn Insight Tag cookies	LinkedIn (`snap.licdn.com`, `px.ads.linkedin.com`)	Loaded on every page. LinkedIn sets its own cookies to report which of our LinkedIn campaigns brought visitors and to measure conversions. Their names and lifespans are set by LinkedIn and can change; see LinkedIn’s cookie policy	Set by LinkedIn	Advertising measurement
mautic_device_id	Mautic, our own marketing-analytics server (`marketing.hospital.org.uk`)	A random device identifier that lets Mautic record which pages a browser visits. It is set on the Mautic server’s own domain, so to casrai.org it is a third-party cookie, and some browsers (Safari, Firefox) block it. See “Mautic” below for the browser-storage copy	Set by Mautic	Marketing analytics
casrai_session	CASRAI (first-party)	Keeps you signed in to your CASRAI account (account pages, Ask CASRAI and Regulatory Radar). Set only when you sign in; cleared when you sign out. Not readable by page scripts	7 days	Strictly necessary
wordpress_logged_in_*	WordPress (contributors only)	Authentication session	2 weeks (or session)	Strictly necessary
wp-settings-*	WordPress (contributors only)	Persists admin-UI preferences	1 year	Strictly necessary
casrai_ask_sid	CASRAI (first-party)	Holds an Ask CASRAI conversation together across follow-up questions, and is the identifier the daily question allowance is counted against. Random, unguessable, and not linked to your identity unless you are signed in	30 days	Strictly necessary
__cf_bm, cf_clearance	Cloudflare (incl. Turnstile)	Bot management + DDoS protection. `__cf_bm` is also set by the Cloudflare Turnstile challenge on the Ask CASRAI input, which checks that a request came from a person rather than a script. Turnstile does not profile you and does not track you across sites	30 min / 30 days	Strictly necessary

Analytics cookie purpose

The _ga and _ga_J5HT9GKYTN cookies are set by Google Analytics 4. They let us count unique visitors and understand which pages of the CASRAI Dictionary, CRediT documentation, and editorial are actually used by the research-administration community. We use this to prioritise content updates and identify orphan pages. No personally identifiable information is sent to GA4. IP addresses are anonymised by Google before storage; we never see them.

The LinkedIn Insight Tag

The LinkedIn Insight Tag is an advertising-measurement script from LinkedIn that loads on every page of this site. It lets LinkedIn tell us which of our LinkedIn campaigns brought visitors here and what they went on to do, and LinkedIn may use what it collects under its own terms. LinkedIn chooses the cookies it sets, so we describe the tag rather than list cookie names we cannot guarantee; LinkedIn describes its cookies in its cookie policy, and processes the data under its privacy policy.

Mautic

Mautic is a marketing-analytics server that we run ourselves; it is not a third-party service. It records which pages a browser visits, keyed to a random device identifier, so we can see which pages and campaigns bring visitors. The identifier is kept in two places: the mautic_device_id cookie on the Mautic server’s domain (listed above), and a copy in this site’s own browser storage (localStorage keys mautic_device_id and mtc_id), which is not a cookie but does the same job when the cookie is blocked.

When you follow a link from casrai.org to lac.us, that device identifier is added to the link so the two visits can be counted together. If you fill in a form on this site, such as the Regulatory Radar checkout or an enquiry form, the address you gave may be recorded against the identifier. See /legal/privacy for what is kept and why.

The Ask CASRAI session cookie

casrai_ask_sid is set the first time you ask the assistant a question. It does two jobs, both of which the feature cannot work without: it lets a follow-up question (“and for the ERC?”) be understood in the context of the previous one, and it is what the daily free-question allowance is counted against. Counting the allowance per session rather than per IP address is deliberate — many of our readers sit behind a single institutional gateway, and counting per IP would give an entire university one person’s quota.

It contains a random identifier and nothing else: no name, no email, no IP address, and no cross-site value. It is first-party, is never shared with an advertising network, and expires after 30 days. Because it exists solely to deliver a service you have asked for, it is strictly necessary under PECR regulation 6(4) and does not require consent. Clearing it simply starts a new conversation and a new allowance window. You can delete the questions recorded against it at any time — see /legal/privacy.

How to opt out

You can stop the analytics and measurement cookies (Google Analytics, LinkedIn and Mautic) in any of the following ways:

Browser opt-out add-on — for Google Analytics, install the Google Analytics Opt-out Browser Add-on (works in Chrome, Firefox, Safari, Edge).
Browser settings — block third-party cookies and trackers in your browser's privacy settings. This blocks the Mautic cookie and LinkedIn’s third-party cookies; clearing this site’s data also removes the Mautic browser-storage copy.
Content blockers — uBlock Origin, Brave Shields, Privacy Badger, AdGuard, NextDNS, or Pi-hole block googletagmanager.com and LinkedIn’s snap.licdn.com with their default lists.
LinkedIn settings — if you have a LinkedIn account, its advertising settings let you limit how LinkedIn uses what the tag collects.

The site does not currently read the browser’s Do Not Track or Global Privacy Control signals, so those settings alone do not stop these tags; use one of the methods above.

Strictly-necessary cookies (the CASRAI sign-in session, WordPress session, Cloudflare bot management, and the Ask CASRAI session cookie) cannot be opted out of without breaking core site features. Blocking casrai_ask_sid specifically will make every question look like a first question and apply the stricter anonymous allowance; blocking casrai_session means you cannot stay signed in. The rest of the site is unaffected.

Third-party data sharing

Google LLC processes GA4 cookie data under the EU-US Data Privacy Framework. See Google's privacy policy.
LinkedIn receives data from the Insight Tag and processes it under its own privacy policy. LinkedIn is an advertising platform.
Cloudflare, Inc. processes infrastructure cookies under its own privacy policy.

Mautic data stays on our own server. No data is sold or exchanged with data brokers.

Why we don't show a cookie banner

For Google Analytics, under UK GDPR Article 6(1)(f), aggregated, anonymised analytics on first-party cookies — where the user has a clear opt-out path — relies on legitimate interests as the lawful basis and does not require prior consent. We've documented this on our privacy page.

The LinkedIn Insight Tag and Mautic also load today without a consent prompt. If you would rather they did not run, use any of the opt-out methods above; a browser or content-blocker setting persists across visits.