Cookie Policy
Effective 7 September 2026. Last updated 8 September 2026.
This page explains what cookies and similar browser-storage technologies Finnish IRL - operated by Data Sauna LLC, a Wyoming limited liability company - uses, the legal basis for each, and how you can control them. Read it together with the privacy policy. Short version: the Site runs on a few strictly-necessary first-party storage entries plus cookieless traffic counters. We also use optional analytics and advertising tools, most of which load only after you accept cookies. The one exception is Google AdSense, which serves the ads that pay for the Site: it runs for every visitor, but requests non-personalized ads unless you accept.
When you first visit, a prompt asks you to accept or reject non-essential cookies. Pressing Accept is what turns on Google Analytics' cookie-based mode, Microsoft Clarity and the Meta Pixel - none of those store anything on your device before that. Two things run either way: Google Analytics in its cookieless "consent denied" mode, and Google AdSense in non-personalized mode. If you press Reject, or ignore the prompt, that is all that runs, alongside the strictly-necessary storage and the cookieless counters.
Most readers of this site see Google's consent message, not ours. Finnish IRL is written for people in Finland, and in the EEA, the UK and Switzerland Google requires a certified consent management platform before any ad personalization. We use Google's own, so in those regions its message appears instead of our banner - one prompt, not two - and it is the record that governs everything described below, including our own analytics. Section 2 has the detail.
1. What cookies are
Cookies are small text files a website places on your device. Similar technologies include localStorage, sessionStorage, pixels and SDKs. Under the EU ePrivacy Directive - implemented in Finland by the Act on Electronic Communications Services - the UK Privacy and Electronic Communications Regulations, and comparable rules elsewhere, storing or reading information on your device generally needs either your prior consent or the "strictly necessary" exemption.
2. Cookie and storage categories on finnishirl.com
Strictly necessary - no consent required
| Name | What it does | How long |
|---|---|---|
| cookie-consent | Records whether you accepted or rejected non-essential cookies, so we can honour your choice and not ask again. Two boolean flags, no identifier. | Until you clear your browser data |
| fi_popup_shown_at | Timestamp of when we last showed you the newsletter signup popup, so it does not come back for 30 days. A number, no identifier. | 30 days, then eligible to be overwritten |
| fi_subscribed | Set after a successful signup from any form on the Site, so the popup stops showing. A boolean flag, no email and no identifier. | Until you clear your browser data |
These are first-party localStorage entries on finnishirl.com, not cookies. Legal basis: strictly necessary for the functioning of the Site as you requested it - the Art. 5(3) ePrivacy exemption, with effectively no personal-data aspect since none of them contains an identifier. The two fi_ entries exist purely to suppress repeat popups: without them we could not respect your "no thanks" the next time you visit.
Cookieless analytics - no consent prompt required
We use two cookieless tools that run for every visitor to measure aggregate traffic: Vercel Analytics and Cloudflare Web Analytics. Neither sets cookies, localStorage or sessionStorage, and neither uses a device identifier or fingerprint. They collect anonymised page-view metadata: page URL, referrer, country, device type, browser. Because nothing is stored on or read from your device, the Art. 5(3) ePrivacy consent requirement does not apply. Legal basis: legitimate interest under Art. 6(1)(f) GDPR.
Analytics
Google Analytics 4 runs for every visitor, but by default - before you accept - it operates in a cookieless "consent denied" mode under Google Consent Mode: it sets no cookies and uses no persistent identifier, sending only anonymised aggregated pings. It sets the cookies listed below and enables full measurement only after you accept. Microsoft Clarity (heatmaps and session replay) does not load at all unless you accept.
| Provider | Purpose | Typical storage |
|---|---|---|
| Google Analytics 4, Google Ireland Ltd. | Aggregate audience and traffic measurement: pages viewed, referrers, rough location, device. | First-party cookies, _ga and _ga_ plus the property id, up to about 2 years. |
| Microsoft Clarity, Microsoft Corp. | Aggregate heatmaps and session replay, to see how pages are actually used. Text you type is masked by default. | First-party and Microsoft cookies, _clck and _clsk, up to about 1 year. |
More on how each handles it: Google's privacy policy and Microsoft's privacy statement.
Advertising
Google AdSense serves the display ads that pay for the Site, so its script loads for every visitor, before and regardless of your cookie choice. Until you accept, we set Google's non-personalized-ads flag, and Consent Mode v2 signals for ad storage, ad user data and ad personalization are all denied. That means non-personalized ads: selected from general context - roughly the page you are on and your approximate location - rather than a profile of your browsing history. Non-personalized does not mean storage-free. Google can still set cookies and read device storage, including first-party cookies on finnishirl.com, for frequency capping, ad measurement and invalid-traffic detection. Accepting upgrades AdSense to personalized ads from your next page view onward.
The Meta (Facebook) Pixel is different: it loads only if you accept, and lets us measure whether our social posts and ads bring people to the Site, and reach similar audiences.
Google's consent message. Google requires publishers to use a certified consent management platform before serving personalized ads to visitors in the EEA, the UK and Switzerland, so we use Google's own. If you are in one of those regions - which, for a site written for people in Finland, is most of you - Google shows its own message, with Consent, Do not consent and Manage options, and our banner stays hidden so you get one prompt rather than two. Google's message records your choice under the IAB Transparency and Consent Framework (TCF v2.2), and we read that same signal to decide whether to run our own tools: Google Analytics' cookie-based mode and Microsoft Clarity follow your consent for storing information on your device and measuring content performance, and the Meta Pixel follows your consent for advertising. In those regions Google's message governs everything on this page, not just ads. Visitors elsewhere in the world do not see it and use our banner instead.
| Provider | Purpose | Typical storage |
|---|---|---|
| Google AdSense, Google Ireland Ltd. | Serving the display ads that fund the Site, plus frequency capping, ad measurement and invalid-traffic detection. Personalized only after you accept; non-personalized otherwise. | First-party cookies set on finnishirl.com by the AdSense script, __gads and __gpi, typically up to about 13 months, plus Google cookies on google.com and doubleclick.net such as IDE and test_cookie, and storage on Google's own domains. Some of these are set before you make a choice, including in non-personalized mode. |
| Meta Pixel, Meta Platforms Ireland Ltd. | Conversion measurement and audience building for Facebook and Instagram campaigns. Loads only after you accept. | Cross-site cookies, _fbp, up to about 3 months. |
More: how Google uses cookies in advertising and Meta's privacy policy.
Legal basis: for anything that stores cookies or data on your device - Google Analytics after you accept, Microsoft Clarity, the Meta Pixel, and personalized ads through Google AdSense - your consent, under Art. 6(1)(a) GDPR and the Art. 5(3) ePrivacy consent rule. Google Analytics' cookieless denied-mode pings rely on our legitimate interest under Art. 6(1)(f). Consent is optional and you can withdraw it at any time - see section 5. You can also manage Google's ad settings directly at My Ad Center, and opt out of many third-party vendors' use of cookies for personalized advertising at youronlinechoices.eu or aboutads.info/choices.
Where this setup is limited. Ad serving reads and writes information on your device even in non-personalized mode, and the AdSense script runs before you make a choice. In the EEA and the UK a strict reading of the ePrivacy consent rule would require consent for that too, not only for personalization. We would rather say that plainly than imply a stricter gate than the one that exists. If you do not want any ad-related storage, block third-party cookies and scripts for this site in your browser, or use an ad blocker - nothing on the Site is gated behind seeing an ad.
Embedded content
There is none. No embedded video, no social embeds, no comment widget, no map. Fonts (Cabin Sketch and Mulish), illustrations and photographs are all served from this domain, so no request goes to Google Fonts or any other CDN.
3. Third-party cookies on this domain
Apart from Google AdSense - described in section 2, which can set its own first-party cookies on finnishirl.com as soon as an ad loads, including before you make a choice - no third-party tool sets cookies on this domain unless you accept non-essential cookies. If you accept, the analytics and advertising tools above (Google, Microsoft, Meta) may set their own.
Our hosting provider (Vercel), our email provider (Resend) and Google may set cookies on their own domains in connection with their services, but those are not set on, nor accessible from, finnishirl.com:
4. About the cookie banner
The banner is a genuine consent gate for Google Analytics' cookie-based mode, Microsoft Clarity and the Meta Pixel: press Accept and we record your choice and load them; press Reject, or ignore it, and they never load. It is not a gate for Google AdSense. The AdSense script loads for every visitor either way, because it serves the ads that pay for the Site - what the banner controls is whether those ads are personalized. Rejecting keeps them non-personalized; it does not remove them, and it does not stop Google setting ad-serving cookies for frequency capping, measurement and invalid-traffic detection.
In the EEA, the UK and Switzerland this banner does not appear at all - Google's certified consent message takes its place, and your answer there drives the same tools. The "Cookie settings" link in the footer reopens whichever prompt applies to you.
If your browser sends Global Privacy Control, you see neither. GPC is a standing opt-out that overrides a stored acceptance, so a prompt would be offering you an Accept that cannot grant anything. Rather than show a control that does nothing, we hide the banner and remove the footer link that reopens it. The choice has already been made, in your browser, and we honour it on every page load.
Your answer does not govern the newsletter signup popup, and does not need to: it is our own interface, it sets no cookie and it loads nothing from a third party. The two fi_ entries in section 2 are written either way, because they are what caps the popup at once per 30 days and retires it once you have signed up - they have to keep working for someone who declined. The popup never opens on top of a consent prompt; it waits until the prompt is answered or gone.
5. How to control or remove cookies and storage
You can clear cookies and localStorage at any time through your browser settings. Most browsers also let you block first-party or third-party cookies entirely, which may affect how other sites work.
To withdraw consent for the analytics and advertising tools, use the "Cookie settings" link in the footer. It reopens whichever prompt applies to you: Google's consent message in the EEA, the UK and Switzerland, ours elsewhere. You can also clear this site's storage in your browser, which removes the cookie-consent entry and brings the prompt back. Withdrawing downgrades Google Analytics to its cookieless mode, stops Microsoft Clarity and the Meta Pixel loading on future visits, and returns AdSense to non-personalized ads.
We honour the Global Privacy Control signal. If your browser or an extension sends it, we treat it as a standing opt-out: analytics cookies, Microsoft Clarity and the Meta Pixel stay off, ads stay non-personalized, and Consent Mode stays denied - even if an Accept is already stored from an earlier visit. To opt out of the cookieless counters as well, use a content blocker, or email us and we will handle it manually.
6. Changes
We will update this page if our use of cookies or similar technologies changes. The "effective" and "last updated" dates at the top show when it last did.
7. Contact
Questions about cookies, tracking or privacy: moi@finnishirl.com, reply to any newsletter email, or use the contact page.