This page lists the cookies and similar technologies used on this site, what they are for, and how long they last. It is generated from the services actually running here, so it stays accurate as those change.
Strictly necessary
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
__cf_bm | Cloudflare, Inc. | Bot Management / Bot Fight Mode — distinguishes humans from bots | 30 minutes from last activity |
_cfuvid | Cloudflare, Inc. | Rate Limiting Rules — distinguishes individual users sharing an IP address | session |
cf_clearance | Cloudflare, Inc. | Proof that a Managed Challenge / JS challenge was solved | configurable |
__cflb | Cloudflare, Inc. | Load Balancer session affinity | session to 24 hours |
__cfruid | Cloudflare, Inc. | Rate limiting | session |
__cfseq | Cloudflare, Inc. | Sequence rules — request order and timing | not stated |
__cfwaitingroom | Cloudflare, Inc. | Waiting Room queue position | not stated |
cf_ob_info | Cloudflare, Inc. | Always Online — HTTP status, Ray ID, data centre | 30 seconds |
cf_use_ob | Cloudflare, Inc. | Always Online — cache port | 30 seconds |
cf_chl_* | Cloudflare, Inc. | Challenge Platform internal issue identification | not stated |
_GRECAPTCHA | Google Ireland Limited | Risk analysis / bot detection | ~6 months |
NID | Google Ireland Limited | Set incidentally by the google.com origin | 6 months |
Some of these providers process data outside the European Economic Area, including in the United States.
Analytics
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
_ga | Google Ireland Limited | Distinguishes users | 2 years |
_ga_* | Google Ireland Limited | Persists session state | 2 years |
_gid | Google Ireland Limited | Distinguishes users (per data stream, not cross-domain) | 24 hours |
_gat* | Google Ireland Limited | Throttles request rate (Universal Analytics legacy) | 1 minute |
_gac_* | Google Ireland Limited | Google Ads campaign attribution — only present when GA4 is linked to Google Ads | 90 days |
Some of these providers process data outside the European Economic Area, including in the United States.
Advertising
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
visitor_id_id22 (browser storage) | Stay22 Technologies Inc. | Rewrites booking links so a reservation can be credited to this site. Identifies the device using browser fingerprinting and stores an identifier in your browser. | Until you clear your browser data |
cache_id22 (browser storage) | Stay22 Technologies Inc. | Rewrites booking links so a reservation can be credited to this site. Identifies the device using browser fingerprinting and stores an identifier in your browser. | Until you clear your browser data |
thumbmark_* (browser storage) | Stay22 Technologies Inc. | Rewrites booking links so a reservation can be credited to this site. Identifies the device using browser fingerprinting and stores an identifier in your browser. | Until you clear your browser data |
_tmjs_l (browser storage) | Stay22 Technologies Inc. | Rewrites booking links so a reservation can be credited to this site. Identifies the device using browser fingerprinting and stores an identifier in your browser. | Until you clear your browser data |
Some of these providers process data outside the European Economic Area, including in the United States.
What the four groups mean
The table above is generated from the services actually running here, so it cannot drift from reality, and it sorts them into the same four groups the cookie dialog uses. Necessary covers security, load balancing and remembering the choice you make — these cannot be switched off, because the site does not work without them. Functional makes embedded things like maps work. Analytics counts which guides get read. Advertising is where Stay22, the booking partner, sits.
When each group is allowed to run
That depends on where you are reading from, because the law does. Readers in the European Economic Area, the United Kingdom and Brazil, Chile, China, Israel, Nigeria, Saudi Arabia, South Korea, Thailand, Türkiye and Vietnam get a dialog on their first visit, and nothing outside Necessary runs until it is answered — Reject all included, on that first screen. Readers in Switzerland get the dialog too, but analytics starts on arrival there and they are asked about advertising. Readers in the United States get a bar: analytics starts on arrival, but Advertising waits for an answer. Readers in Canada, Australia, New Zealand, Japan, Singapore, Hong Kong, Taiwan, India, Malaysia, Indonesia, the Philippines, Mexico, Argentina, South Africa and the United Arab Emirates get a notice, and all of it starts on arrival. Everywhere else, and wherever we cannot tell, gets the dialog.
Your answer is stored in cookie_consent_26eca6, a first-party cookie set by Theme Parks Guide itself and readable by nobody else, and a companion cookie, cookie_consent_26eca6_loc, remembers for a day which country you are reading from. An answer lasts up to a year, and a refusal given in the dialog six months, before you are asked again. The Cookie settings link at the foot of every page reopens the choice (in the United States it reads Do not sell or share my personal information). If you withdraw, the scripts stop and what they stored on your device is cleared, including visitor_id_id22, cache_id22 and the thumbmark_* keys.
Things in here that are not cookies
Stay22, the partner that handles the accommodation and activity links on this site, is the clearest example. It rewrites those links as the page loads and recognises your device from the characteristics of your browser — its fonts, screen, language and similar details — rather than by setting a cookie, keeping an identifier in your browser’s local storage under the names visitor_id_id22 and cache_id22. Because that is not a cookie, blocking third-party cookies in your browser does not stop it and a cookie-name-based blocker never sees it — which is why it is gated at the script itself here, under Advertising, and does not load at all until that category is allowed.
Where a guide embeds something from another site — a map, a video, a post — that embed is held back behind a placeholder until the relevant category is allowed, so it cannot quietly set anything on your device before you have chosen. Clicking the placeholder loads that one item.