01
Strictly necessary
The `bii_session` cookie supports CSRF protection, magic-link login, and account security. It is Secure on HTTPS, HttpOnly, and SameSite=Lax. Refusing it would make authenticated features unavailable, but public pages remain readable.
02
Optional analytics
Matomo may measure page use only after an affirmative choice. Analytics is configured without analytics cookies and must not receive emails, contact details, private Irish-connection evidence, or raw IP histories. GA4 is not used by the new application.