Cookie policy

Last updated: 11 August 2026.

CASRAI.org uses a small number of cookies — most are strictly necessary for the site to function, and one set is used for analytics (Google Analytics 4). We do not use cookies for advertising, cross-site tracking, or behavioural profiling. The site does carry sponsored content promoting lac.us (a medical/research-supply distributor), but those placements are plain links and images — they do not set any cookie of their own.

Cookies we set

Cookie	Set by	Purpose	Lifespan	Category
_ga	GA4 (Google Analytics)	Distinguishes unique visitors	13 months	Analytics
_ga_J5HT9GKYTN	GA4 (Google Analytics)	Persists per-property session state	13 months	Analytics
wordpress_logged_in_*	WordPress (contributors only)	Authentication session	2 weeks (or session)	Strictly necessary
wp-settings-*	WordPress (contributors only)	Persists admin-UI preferences	1 year	Strictly necessary
casrai_ask_sid	CASRAI (first-party)	Holds an Ask CASRAI conversation together across follow-up questions, and is the identifier the daily question allowance is counted against. Random, unguessable, and not linked to your identity unless you are signed in	30 days	Strictly necessary
__cf_bm, cf_clearance	Cloudflare (incl. Turnstile)	Bot management + DDoS protection. `__cf_bm` is also set by the Cloudflare Turnstile challenge on the Ask CASRAI input, which checks that a request came from a person rather than a script. Turnstile does not profile you and does not track you across sites	30 min / 30 days	Strictly necessary

Analytics cookie purpose

The _ga and _ga_J5HT9GKYTN cookies are set by Google Analytics 4. They let us count unique visitors and understand which pages of the CASRAI Dictionary, CRediT documentation, and editorial are actually used by the research-administration community. We use this to prioritise content updates and identify orphan pages. No personally identifiable information is sent to GA4. IP addresses are anonymised by Google before storage; we never see them.

The Ask CASRAI session cookie

casrai_ask_sid is set the first time you ask the assistant a question. It does two jobs, both of which the feature cannot work without: it lets a follow-up question (“and for the ERC?”) be understood in the context of the previous one, and it is what the daily free-question allowance is counted against. Counting the allowance per session rather than per IP address is deliberate — many of our readers sit behind a single institutional gateway, and counting per IP would give an entire university one person’s quota.

It contains a random identifier and nothing else: no name, no email, no IP address, and no cross-site value. It is first-party, is never shared with an advertising network, and expires after 30 days. Because it exists solely to deliver a service you have asked for, it is strictly necessary under PECR regulation 6(4) and does not require consent. Clearing it simply starts a new conversation and a new allowance window. You can delete the questions recorded against it at any time — see /legal/privacy.

How to opt out

You can stop the analytics cookies from being set in any of the following ways:

Browser opt-out add-on — install the Google Analytics Opt-out Browser Add-on (works in Chrome, Firefox, Safari, Edge).
Browser settings — block third-party cookies and trackers in your browser's privacy settings.
Content blockers — uBlock Origin, Brave Shields, Privacy Badger, AdGuard, NextDNS, or Pi-hole all block googletagmanager.com by default.
Do Not Track / GPC — our site honours the browser Do Not Track header and Global Privacy Control signals; if either is set, GA4 will not load.

Strictly-necessary cookies (WordPress session, Cloudflare bot management, and the Ask CASRAI session cookie) cannot be opted out of without breaking core site features. Blocking casrai_ask_sid specifically will make every question look like a first question and apply the stricter anonymous allowance; the rest of the site is unaffected.

Third-party data sharing

Google LLC processes GA4 cookie data under the EU-US Data Privacy Framework. See Google's privacy policy.
Cloudflare, Inc. processes infrastructure cookies under its own privacy policy.

No data is shared with advertising networks. No data is sold or exchanged with data brokers.

Why we don't show a cookie banner

Under UK GDPR Article 6(1)(f), aggregated, anonymised analytics on first-party cookies — where the user has a clear opt-out path — relies on legitimate interests as the lawful basis and does not require prior consent. We've documented this on our privacy page. If you would prefer a consent-first banner, opt out via any of the methods above and your preference will persist via your browser settings.