Your privacy choices.

Analytics and advertising

Here is exactly what is set today. Advertising holds four things, and three of them are ad tags in the plain sense of the word. The Meta Pixel reports the pages you view here to Meta and adds your browser to advertising audiences we can then target on Facebook and Instagram. That is what it is for. It is how someone who read this page and did not sign up sees a CNL ad later, and how we tell whether an ad we paid for led to a signup. The Google Ads tag does the same two jobs on Google's side: it measures whether an ad led to a signup, and it adds your browser to remarketing lists we can target across Google's network. The OpenAI advertising pixel measures whether an ad on OpenAI's surfaces led to a signup. All three build or use audiences out of visitors to this site for advertising purposes. We are not going to describe that as anything softer. Microsoft Clarity is the fourth, and it is here for a narrower reason. It records anonymized page interactions so we can see where this site confuses people and fix it. Clarity is sold as an analytics and session-replay tool, and seeing how this site is used is the only thing we use it for, but loading it places MUID on c.bing.com, an identifier Microsoft itself uses for advertising on its own services. We would rather label it by what it does than by what it is sold as, so it sits in Advertising too. One switch turns off all four.

Analytics holds one thing: Google Analytics, which reports which pages are viewed and how people move through the site, in aggregate, so we can see what works. It sets first-party cookies on our own domain, and it does not set an advertising identifier, which is why it sits here rather than under Advertising. Google's advertising features are switched off for that property and the property is not linked to a Google Ads account, so the analytics data does not become ad data by a side door.

Google offers to fold the Google Ads tag into the Google Analytics one, as a single combined snippet. We said no, and the reason is the switch above. A combined tag would report to the advertising destination whenever the analytics category was on, so a visitor who allowed analytics and refused advertising would be fed into our ad targeting anyway, having explicitly declined exactly that. Two separate tags in two separate categories is what makes the Advertising switch mean what it says.

What we still do not do: we do not buy audiences, profiles, or lists from anyone, we do not sell or hand over your information for another company's own marketing, and none of this runs on an Operator's booking site. If you switch Advertising off, none of it is placed in the page at all.

What you allow on this browser

Analytics: Google Analytics. Switching this off stops the record of which pages you viewed reaching Google, and stops the first-party _ga cookies being set. Advertising: the Meta Pixel, the Google Ads tag, the OpenAI advertising pixel, and Microsoft Clarity. Switching this off stops your visit being reported to Meta, Google Ads, or OpenAI, stops your browser being added to any of their advertising audiences, stops the session recording of how pages are used, and stops Microsoft's MUID advertising identifier being set. Saved in a first-party cookie on this browser. Clearing your cookies clears the choice, and other browsers and devices keep their own.

Save choices →

What is actually stored

The complete list, everything, not a summary. Nothing on it is bought from or shared with a data broker. Everything Meta, Google Ads and Microsoft set appears only while the advertising switch above is on. Two of those three are ad tags outright, and their cookies are what make the audiences described further up: the Meta and Google Ads entries below are the identifier your browser is known by inside an ad platform. The Microsoft entries are there for the narrower reason given above, that installing a session-replay tool also places an identifier Microsoft uses for advertising on its own services. Outside the advertising switch are the two strictly necessary entries, and the Google Analytics cookies, which sit behind the analytics switch instead.

One entry below, the one headed fr / IDE / NID and similar, is the one we have least control over, and we would rather say so than leave it out. When the Meta and Google Ads tags contact those companies, they can set cookies on their own domains, not ours. We do not set them, cannot read them, and cannot list every one by name, because that is Meta's and Google's decision and it changes. Safari and Firefox block third-party cookies by default, so for a large share of visitors none of them are set at all. Switching Advertising off stops the request that would set them, which is the part we do control.

cnl_privacy

Strictly necessary, first-party, set by CNL. Remembers the choice you make above. Expires after 1 year.

session

Strictly necessary. The Flask session cookie: carries the token that protects most of our forms, and keeps the signup flow's state. The tracking controls above are protected by an origin check instead, and set no cookie. Not optional, and it carries no tracking.

_ga / _ga_<container-id>

Google Analytics, website analytics, in the analytics category. First-party, set by Google Analytics on cnlsystems.com. _ga recognizes a returning browser (2 years), and _ga_<container-id> holds the session state for the current visit (2 years). Set only while the analytics switch above is on.

_fbp / _fbc

Meta Pixel, advertising audiences and ad measurement, in the advertising category. First-party, set by the Meta Pixel on cnlsystems.com. _fbp is a random identifier for this browser, and it is what lets Meta join the pages you view here to a Meta profile and put you in an audience we can advertise to (90 days). _fbc is set only if you arrived from a Meta ad, because the link then carries a click identifier, and it stores that identifier so Meta can credit a signup to the ad you clicked (90 days). Set only while the advertising switch above is on.

_gcl_au / _gcl_aw and other _gcl_ cookies

Google Ads, conversion measurement and remarketing, in the advertising category. First-party, set by the Google Ads tag on cnlsystems.com. _gcl_au ties a signup back to an ad click so Google can report the conversion (90 days). _gcl_aw is set only if you arrived from a Google ad, because the link then carries a click identifier (90 days). Google names this family with a _gcl_ prefix and adds to it over time, which is why it is listed as a family rather than a fixed pair. Set only while the advertising switch above is on.

fr / IDE / NID and similar

Meta's and Google's own advertising cookies, set by them on their domains rather than by us on ours, when the two tags above contact them. fr is Meta's, on facebook.com, and lasts about 90 days. IDE is Google's, on doubleclick.net, and lasts 13 months in the UK, the EEA and Switzerland and 24 months elsewhere. NID is Google's, on google.com. We do not set these, cannot read them, and cannot promise the exact list, because it is Meta's and Google's to change. Safari and Firefox block third-party cookies by default, in which case none of them are set. Switching the advertising switch off stops the request that would set them.

_clck / _clsk

Microsoft Clarity, session replay — in the advertising category. Recognizes a returning browser on this site (1 year) and joins the pages of one visit into a single session recording (1 day). Set only while the advertising switch above is on.

CLID

Microsoft Clarity, session replay — in the advertising category. Records the first time Clarity saw this browser on any site that uses Clarity, not just ours. Expires after 1 year. Set only while the advertising switch above is on.

ANONCHK / MR / SM / MUID

Microsoft, set on c.bing.com when Clarity loads: Microsoft's own browser identifier and the machinery that keeps it in sync. Microsoft states that MUID is used for advertising as well as site analytics and other operational purposes. MUID and ANONCHK last up to 1 year, MR 7 days, and SM until you close the browser. Set only while the advertising switch above is on.