The short version
XO uses cookies (and similar storage) for three things: keeping the site working, measuring traffic, and serving ads. We never run personalised advertising — ads on XO are targeted on geography only. When you first visit, our consent banner lets you accept all, reject all, or pick and choose. You can change your mind at any time via “Cookie settings” in the footer.
Categories of cookie
We group cookies into three buckets:
- Essential — remembers your cookie choice (
xo-consent-v1), your statistics opt-out if you set one (xo-stats-optout), and keeps the site functional. Always on; UK PECR doesn't require consent for these. - Analytics — Google Analytics. Off by default.
- Advertising — Google Ad Manager. Off by default. Even with this off, we may serve non-personalised, geo-targeted ads in “limited” mode (Google Consent Mode v2) without setting advertising cookies on your device.
Analytics
With your consent, Google Analytics counts page views, sessions and referrers, plus device and (coarse) location signals, so we know which stories land and where readers come from. Google's privacy policy is at policies.google.com/privacy.
XO also keeps its own visitor statistics, and uses
Cloudflare Web Analytics. Both are cookieless: they set no
cookies, store nothing on your device and build no individual profile, so
they run without consent and aren't part of the banner above. What our own
statistics record, and a switch to turn them off for your browser, are on
the privacy page. That switch
is the one exception to "nothing on your device": turning statistics off
saves a single setting, xo-stats-optout, in your browser's
local storage so we can honour it.
Advertising
XO's ad slots are served by Google Ad Manager. We do not use personalised advertising or remarketing; ads are targeted on geography only. With your consent, Ad Manager uses cookies for frequency capping (so you don't see the same ad ten times) and aggregate measurement. Without your consent, Ad Manager runs in “limited” mode — ads still serve, but no advertising cookies are stored on your device.
Embeds
Articles may include embedded video from YouTube (via the youtube-nocookie.com domain) or Vimeo, plus TikTok, Instagram, X and Spotify embeds. These platforms set their own cookies only when you interact with the embed (e.g. press play). To avoid this entirely, don't interact with the embed.
Manage your choice
Open the preferences panel from the Cookie settings link here or in the footer, or clear the cookies for this site in your browser settings to be re-prompted. You can also use your browser's built-in controls (Chrome, Safari, Firefox and Edge all let you block third-party cookies entirely).
Changes to this policy
If we materially change what we collect, we'll bump the consent banner version so you're re-prompted, and we'll update this page.