Skip to main content
Mayor of London logo London Assembly logo
Home

Protecting your information

We aim to have a secure and reliable website and use appropriate security technology to protect any personal data we process about you. But your use of the internet, and this website, is entirely at your own risk. We have no responsibility or liability for the security of personal information transmitted over the internet.

Sharing your information

We will not:

  • sell or rent your data to third parties
  • share your data with third parties for marketing purposes without express permission

The GLA may be required to share your personal information with the police and other law enforcement agencies for the purposes of crime prevention or detection. If we are asked to disclose your information, we ask the requesting organisation to demonstrate that the data will assist in the prevention or detection of crime, or that the GLA is legally obliged to disclose it.

Cookies

Cookies are small pieces of data that are downloaded to your computer or mobile device when you visit a website or application.

Cookies are generally used to monitor how a website is used and improve your online experience. They do not give us access to the rest of your computer and are not used to identify you personally.

Read more about how we use cookies.

These cookies are essential for the website to work properly — for example, keeping you signed in, remembering your cookie preferences, and protecting the site against fraud and abuse. They cannot be switched off.

Cookie name Purpose Retention period Provider
.AspNetCore.Antiforgery.* Protects the webcasts service from cross-site request forgery attacks. Session ASP.NET Core / Microsoft
AGS_ROLES Supports interactive map functionality and access to our ArcGIS map services. 59 seconds Esri ArcGIS
ARRAffinity Keeps requests for an embedded Power BI report routed to the same server during your session. Session Microsoft Power BI
ASP.NET_SessionId Maintains your session on the website so the service can recognise requests from the same visit. Session ASP.NET / Microsoft
CookieControl Stores your cookie consent preferences. 3 months Civic Cookie Control
Drupal.visitor.autologout_login Automatically signs out inactive logged-in users. 1 year Drupal
SSESS* Authenticates logged-in users and maintains their session. Session Drupal
WFESessionId Maintains a session so an embedded Power BI report or dashboard functions correctly. Session Microsoft Power BI
XSRF-TOKEN Protects the site and users against cross-site request forgery attacks. 60 minutes Homes for Londoners
_GRECAPTCHA / rc::a / rc::c Google reCAPTCHA — distinguishes humans from bots to protect forms from spam and abuse. Session to 6 months Google reCAPTCHA
__Secure-BUCKET Set by Google with a security ("Secure") attribute so it's only sent over HTTPS connections. 6 months Google
__Secure-ENID Remembers your settings and preferences for Google services used on our site (e.g. Google Translate). 13 months Google
__cf_bm Cloudflare bot management — identifies and manages incoming traffic that matches bot-like behaviour. 30 minutes Cloudflare
_cfuvid Helps Cloudflare apply security controls and rate-limiting rules for your session. Session Cloudflare
_ehq_session_id Assigns a session ID for activity during your visit to the consultation platform. 30 minutes EngagementHQ
_ehq_uid Stores an encrypted, anonymous ID so the consultation platform can recognise activity during a visit. 1 year EngagementHQ
_engagementhq_v3 Stores an encrypted token used to verify secure access to the consultation platform. 2 days EngagementHQ
_tl_tracked Records campaign parameters when a new Talk London account is created. 24 hours Talk London
_user_action_fragment / _user_action_redirect Used by Talk London to redirect you correctly after an action. Session Talk London
cf_chl_rc_ni Helps Cloudflare manage and verify completion of a security challenge. 60 minutes Cloudflare
cf_clearance Records that a CAPTCHA or JavaScript security challenge has been solved. 1 year Cloudflare
ckan Maintains your session on the Data for London (CKAN) platform. Session Data for London / CKAN
crisis_communication_modal Controls display of GLA crisis prompt banners. [TO CONFIRM] Drupal
current_language / next-i18next Remembers your selected language so consultation pages display correctly translated. Session to 2 days EngagementHQ
googtrans Remembers your selected language for Google Translate on the site. Session Google Translate
h4lwebsearch Stores a temporary login token so the site recognises a returning signed-in user. 6 months Homes for Londoners
has_js Indicates whether JavaScript is enabled in your browser. Session Drupal
hubspotutk Identifies your visit to support form submissions on Homes for Londoners. 6 months HubSpot
infoShown Remembers whether an information message has already been shown to you. Session london.gov.uk
new_content_menu_links_viewed Used by Talk London to notify you of new content. Session Talk London
participant_fe / pfe_ideas Supports login, registration and the ideas tool on consultation pages. Session EngagementHQ
sessionToken Records visits and logins to the Healthy Early Years London and Healthy Schools London sites. Session Drupal
sharetobuy_web_search_session Keeps your session active so the site can function correctly. 60 minutes Share to Buy
test_cookie Checks whether your browser supports cookies. 15 minutes Google / DoubleClick

These cookies help us understand how visitors use london.gov.uk — which pages are popular, how people move through the site, and where things could work better. We only set these if you consent. All data is used in aggregate to improve our services.

Cookie name Purpose Retention period Provider
_ga, _ga_*, _gid, _gat_* Google Analytics — distinguishes users and sessions to generate statistics on how the site is used. 56 seconds to 1 year Google Analytics
_hj* (19 cookies, e.g. _hjid, _hjSession_*) Hotjar — session recording, heatmaps and on-site surveys/polls used to understand and improve the user experience. Under 100ms to 1 year Hotjar
_vwo*, _vis_opt*, vis_opt_exp* (18 cookies) VWO (Visual Website Optimizer) — runs and measures A/B tests on page content to improve the site. Session to 10 years VWO
__hssc, __hssrc, __hstc HubSpot — tracks sessions and visitor identity for analytics and form-submission reporting. Session to 6 months HubSpot
_clck, _clsk Microsoft Clarity — records how visitors use the site to help build an anonymised analytics report. 24 hours to 1 year Microsoft Clarity
ANONCHK Helps verify requests and maintain service integrity to support analytics functionality. 10 minutes Microsoft Clarity
CLID Used by Microsoft Clarity to support analytics functionality. 1 year Microsoft Clarity
MR Used by Microsoft to collect information for analytics and service improvement. 7 days Microsoft Clarity
MUID Unique browser identifier used by Microsoft to recognise users across Microsoft services for analytics and service improvement. 1 year Microsoft Clarity
SM Used by Microsoft to measure use of the website for internal analytics. Session Microsoft Clarity
_ehq_last_visit Records the time of your last visit to the consultation platform. 1 year EngagementHQ
vuid Vimeo — generates analytics information for the video owner. 1 year Vimeo

These cookies are set by third-party platforms embedded in our pages (such as YouTube, LinkedIn and Twitter/X content) and may be used to measure engagement, personalise content, or support advertising. We only set these if you consent.

Cookie name Purpose Retention period Provider
VISITOR_INFO1_LIVE YouTube — estimates your bandwidth on pages with embedded YouTube videos. 6 months YouTube
YSC YouTube — registers a unique ID to keep statistics on which videos you've watched. Session YouTube
__Secure-ROLLOUT_TOKEN YouTube — supports player feature rollouts and experiments. 6 months YouTube
__Secure-YEC YouTube — anti-abuse and diagnostics to protect the video service. Session YouTube
__Secure-YNID YouTube — identifies your browser or device for statistical purposes. 6 months YouTube
bcookie Browser identifier used by LinkedIn to identify browsers and devices, supporting platform functionality, analytics, advertising measurement and personalisation. 1 year LinkedIn
guest_id Assigns an identifier to visitors not logged into Twitter/X so embedded Twitter/X content functions correctly. 1 year Twitter/X
guest_id_ads Supports advertising services and measures advertising effectiveness for users not logged into Twitter/X. 1 year Twitter/X
guest_id_marketing Used by Twitter/X for marketing and promotional purposes, including ad delivery and campaign measurement. 1 year Twitter/X
li_gc Stores your consent to LinkedIn's use of non-essential cookies for embedded LinkedIn content. 6 months LinkedIn
lidc Used by LinkedIn to route requests to the correct servers for embedded LinkedIn content. 24 hours LinkedIn
personalization_id Used by Twitter/X to personalise content and adverts, and to recognise users across sites with embedded Twitter/X content. 1 year Twitter/X
sp_landing / sp_t Required for the functionality of an embedded Spotify plugin. 24 hours to 1 year Spotify
SRM_B Collects user data adapted to the individual or device, which may be used to track behaviour outside the site. 1 year Microsoft Clarity
VISITOR_PRIVACY_METADATA Stores privacy/consent state for embedded YouTube videos. 180 days YouTube

Need a document on this page in an accessible format?

If you use assistive technology (such as a screen reader) and need a version of a PDF or other document on this page in a more accessible format, please get in touch via our online form and tell us which format you need.

It will also help us if you tell us which assistive technology you use. We’ll consider your request and get back to you in 5 working days.