Independent AI agent for EU Deforestation Regulation compliance, not affiliated with the EU. Scope & disclaimer →

Cookies on eudr.dev

Last reviewed 2026-05-17. Served live at /legal/cookies.

We use two classes of cookies:

Strictly-necessary cookies — required to deliver the service. These are set without consent under Art. 5(3) of the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC) read with EDPB Guidelines 2/2023 on the technical scope of Art. 5(3).
Analytics cookies — set only after the visitor clicks "Accept analytics" on the consent banner. Default is denied; no analytics cookies are written until consent is given.

You can withdraw consent at any time via the Manage cookies link in the footer.

Strictly-necessary cookies (no consent required)

Name	Purpose	Lifetime	Scope
`__Host-eudr_sid`	Session identity. `HttpOnly`, `Secure`, `SameSite=Lax`. Set on sign-in, deleted on sign-out or after 30 days of idle.	30 days idle / session	First-party, `eudr.dev`
`eudr_csrf`	CSRF token (double-submit pattern). Required to authorise state-changing requests against the session.	Same lifecycle as `__Host-eudr_sid`	First-party, `eudr.dev`
`eudr_locale`	UI language preference. Read on every page load to render the dashboard in the user's chosen locale.	1 year	First-party, `eudr.dev`
`eudr_consent`	Records the visitor's consent choice for analytics (`granted` or `denied`). Necessary to remember the choice and to keep the banner from re-appearing on every visit.	1 year	First-party, `eudr.dev`

All four are first-party and set by the engine itself.

Analytics cookies (consent required; default denied)

These cookies are loaded only after the visitor clicks "Accept analytics" on the consent banner. They are not written on the first visit, on the rejection path, or after consent is withdrawn.

Name	Purpose	Lifetime	Provider
`_ga`	Google Analytics 4 — distinguishes unique visitors for aggregate dashboard usage statistics.	2 years	Google Ireland Limited
`_ga_C654QTBTFX`	Google Analytics 4 — session state for the measurement id `G-C654QTBTFX`.	2 years	Google Ireland Limited

Google Analytics is configured with IP anonymisation enabled and Consent Mode v2 signals (analytics_storage is granted only after the explicit Accept click; ad_storage, ad_user_data and ad_personalization stay denied). The measurement endpoint (googletagmanager.com, google-analytics.com) is loaded from the visitor's browser only when consent is granted; if consent is rejected, no requests to Google fire from this site.

Google is disclosed as a sub-processor in the Sub-processors list. The legal basis for this processing is Art. 6(1)(a) GDPR (consent) read with Art. 5(3) ePrivacy Directive (storage requiring consent).

Withdrawing consent

Three equivalent paths:

Click Manage cookies in the page footer to re-open the banner, then click Reject analytics. The eudr_consent cookie flips to denied. Existing analytics cookies expire on their own schedule; you can clear them yourself in browser settings if you want them gone immediately.
Set your browser's privacy controls (Firefox Strict, Brave, Safari Intelligent Tracking Prevention) — these block third-party analytics scripts regardless of the banner state.
Email avijeet@vortx.ai with a request to suppress your IP or account from analytics; we will configure exclusion on the measurement-property side.

Why we ask at all

Strictly-necessary cookies are exempt from consent (Art. 5(3) ePrivacy). Analytics cookies are not exempt because they process personal data (the _ga identifier is a pseudonymous identifier under GDPR) for a purpose — measuring service usage — that is not strictly necessary to deliver the service the visitor asked for. The banner exists to obtain Art. 7 GDPR-compliant consent for that class only.

Transparency obligations

Even where consent is not required (strictly-necessary class), the transparency obligation under Art. 13 GDPR is owed and is satisfied by this page and by the privacy notice at /privacy.

If this changes

If we ever extend processing beyond the cookies listed above — for example to add A/B testing, advertising, or any additional third-party cookie — this page will be updated, the privacy notice will be amended, the Sub-processors list will be expanded, and the consent banner will be re-asked.