Cookie Policy
This page lists the cookies and similar technologies used on this site, what they are for, and how long they last. It is generated from the services actually running here, so it stays accurate as those change.
Strictly necessary
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
__cf_bm | Cloudflare, Inc. | Bot Management / Bot Fight Mode — distinguishes humans from bots | 30 minutes from last activity |
_cfuvid | Cloudflare, Inc. | Rate Limiting Rules — distinguishes individual users sharing an IP address | session |
cf_clearance | Cloudflare, Inc. | Proof that a Managed Challenge / JS challenge was solved | configurable |
__cflb | Cloudflare, Inc. | Load Balancer session affinity | session to 24 hours |
__cfruid | Cloudflare, Inc. | Rate limiting | session |
__cfseq | Cloudflare, Inc. | Sequence rules — request order and timing | not stated |
__cfwaitingroom | Cloudflare, Inc. | Waiting Room queue position | not stated |
cf_ob_info | Cloudflare, Inc. | Always Online — HTTP status, Ray ID, data centre | 30 seconds |
cf_use_ob | Cloudflare, Inc. | Always Online — cache port | 30 seconds |
cf_chl_* | Cloudflare, Inc. | Challenge Platform internal issue identification | not stated |
_GRECAPTCHA | Google Ireland Limited | Risk analysis / bot detection | ~6 months |
NID | Google Ireland Limited | Set incidentally by the google.com origin | 6 months |
Some of these providers process data outside the European Economic Area, including in the United States.
Functional
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| — | Google Ireland Limited | Typefaces are downloaded from Google's servers, which receives your IP address. | — |
Some of these providers process data outside the European Economic Area, including in the United States.
Analytics
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
_ga | Google Ireland Limited | Distinguishes users | 2 years |
_ga_* | Google Ireland Limited | Persists session state | 2 years |
_gid | Google Ireland Limited | Distinguishes users (per data stream, not cross-domain) | 24 hours |
_gat* | Google Ireland Limited | Throttles request rate (Universal Analytics legacy) | 1 minute |
_gac_* | Google Ireland Limited | Google Ads campaign attribution — only present when GA4 is linked to Google Ads | 90 days |
Some of these providers process data outside the European Economic Area, including in the United States.
Advertising
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| — | Travelpayouts Inc. | Credits a booking made after a visit here to this site. | — |
Some of these providers process data outside the European Economic Area, including in the United States.
What the four groups mean
The table above is generated from the services actually running here, so it cannot drift from reality, and it sorts them into the same four groups the cookie dialog uses. Necessary covers security, load balancing and remembering the choice you make — these cannot be switched off, because the site does not work without them. Functional makes embedded things like maps work. Analytics counts which guides get read. Advertising is where Travelpayouts and any ad partner sit.
When each group is allowed to run
That depends on where you are reading from, because the law does. Readers in the European Economic Area, the United Kingdom and Brazil, Chile, China, Israel, Nigeria, South Korea, Thailand, Türkiye and Vietnam get a dialog on their first visit, and nothing outside Necessary runs until it is answered — Reject all included, on that first screen. Readers in Switzerland get analytics on arrival and are asked about advertising. Readers in the United States get a bar: analytics starts on arrival, but Advertising waits for an answer. Readers in Canada, Australia, New Zealand, Japan, Singapore, Hong Kong, Taiwan, India, Malaysia, Indonesia, the Philippines, Mexico, Argentina, South Africa and the United Arab Emirates get a notice, and all of it starts on arrival. Everywhere else, and wherever we cannot tell, gets the dialog.
Your answer is stored in cookie_consent_3cab39, a first-party cookie set by Milan Tourism Guide itself and readable by nobody else. It lasts about a year, and the Cookie settings link at the foot of every page reopens the choice (in the United States it reads Do not sell or share my personal information). If you withdraw, the scripts stop running, and the analytics cookies this site can reach are cleared. Travelpayouts stores nothing here under a name this site can see, so anything it has already set on its own domains has to be cleared in your browser rather than from this page.
Things in here that are not cookies
Travelpayouts, the affiliate network behind the booking links on this site, is the clearest example. It loads a script that turns ordinary outbound links into commission-tracking ones as the page loads, so a link that looks plain in the page can still earn us a commission, and it recognises returning visitors in order to credit a booking made later. Because that is not a cookie, blocking third-party cookies in your browser does not stop it and a cookie-name-based blocker never sees it — which is why it is gated at the script itself here, under Advertising, and does not load at all until that category is allowed.
Where a guide embeds something from another site — a map, a video, a photograph credited to its source — that embed is held back behind a placeholder until the relevant category is allowed, so it cannot quietly set anything on your device before you have chosen. Clicking the placeholder loads that one item.