Cookies, and what is kept on your device
Last updated: 14 September 2026. This page describes what the site's own code does, step by step, rather than what a policy of this kind usually says.
This site sets no cookie of its own, at all. It keeps two small values in your browser's local storage, and one of them is your answer about measurement. Keeping that answer out of a cookie is deliberate: remembering that somebody said no must not itself require the thing they said no to.
Cookies, and the things that behave like them
A cookie is a small piece of text a site asks your browser to hold on to and send back later. Local storage does a related job by a different route: the browser keeps the value, but it is never attached to requests and never travels anywhere unless a script on that same site reads it and sends it somewhere. Both are covered here, because the rules care about what is stored on your device rather than about which technique stored it.
What is on your device because of this site
| Name | Kind | What it is for | How long | Set by |
|---|---|---|---|---|
wtdim.saved |
Local storage | Whatever you have tapped the heart on, so the list survives closing the tab. | Until you clear your browsing data | This site |
wtdim.consent |
Local storage | The single word granted or denied, so the banner asks you
once rather than on every page. |
Until you clear your browsing data | This site |
That is the complete list. Both are what the rules call strictly necessary: they exist only to do something you asked for, nothing reads them but the pages of this site running in your own browser, and no copy of either reaches us. The odd looking prefix on the names is a leftover from the sister site this site's code grew out of, and it is cosmetic. Browser storage is walled off per web address, so a value stored here is a separate thing from a value of the same name stored by any other site.
The banner, in the order it really happens
- The page arrives with no measurement code in it. There is no Google tag in the document and no request has gone anywhere near Google.
- With no answer stored, the box appears. Decline and Accept carry the same weight and the same size, neither is preselected, and there is no way to click past it into a yes.
- Decline, and the word
deniedis written to your device, the box closes, and nothing else happens on this visit or any later one. - Ignore it entirely, and the outcome is the same, except that nothing is remembered and you will be asked again next time.
- Accept, and this happens in this order: consent mode is first told to deny advertising storage, advertising user data, advertising personalisation and analytics storage; analytics storage alone is then switched to granted; only after that is Google's tag requested and added to the page, configured to shorten your IP address. The advertising permissions are never granted, on any path through this code.
The order in point five is the whole substance of the thing. A great many sites load the tag with the page and then ask it to behave, which means the request to Google has already happened before you were asked anything. Here the tag is not loaded quietly and told to wait. It is not loaded.
What measurement would set, once you accept it
Google Analytics, and nothing besides. If it runs, these are its cookies, set by Google on this domain:
| Name | Kind | What it is for | How long | Set by |
|---|---|---|---|---|
_ga |
Cookie | Distinguishes one browser from another, so a second visit is not counted as a first. | 2 years | Google Analytics |
_ga_<property> |
Cookie | Holds the state of the visit in progress. | 2 years | Google Analytics |
One condition sits underneath all of that. Measurement only runs when a measurement account has been configured for the site, and where none is configured the loader has nothing to load, so an acceptance is recorded and no cookie is set and no request leaves your browser. Your answer is what governs it either way: a refusal keeps the tag out whether or not an account exists, and an acceptance given now would take effect on the next page you load after an account is put in place. You can change the answer whenever you like, and the section below is how.
Partner photographs, which load before you click anything
This has a heading of its own rather than a line buried further down, because out of
everything here it is the only thing that reaches a company other than our host before you have
asked for anything. Every option inside a booking panel carries that partner's own photograph of
what is being sold, and those photographs are served from the partners' own image hosts rather than copied onto ours,
which today means aws-tiqets-cdn.imgix.net for Tiqets, image.kkday.com
for KKday and wegotrip.com for WeGoTrip.
The request is made when the panel comes into view, so while you are reading rather than when you click, and it happens whichever way you answered the banner. Asking a server for an image is an ordinary web request, which means that server is told your IP address, the string your browser sends identifying itself, and the address of the page you are reading. It can also return a cookie of its own in that reply, set on its own domain. None of that is anything we ask it for, none of it reaches us, and we cannot see it, but we are not going to describe a site that does this as a site that does not.
Why it is done that way rather than by keeping copies here: these are the partners' photographs of the partners' products, shown as part of the card that links to that exact listing, which is what an affiliate image is for, and this site holds no licence to host them. Taking copies to tidy up a sentence in this policy would trade an honest paragraph for a licensing problem. If you would rather those requests were not made, a content blocker or an images-off setting stops them and every booking link still works.
Booking partners, once you leave
Links that can earn this site money are marked as such. Following one hands you to Travelpayouts, who record the click and pass you straight on to the partner, which will be Tiqets, Klook, KKday or WeGoTrip. Whatever is placed on your device to credit a later booking is placed there by them, on their address, after you have arrived, and their policy governs it. Nothing is written to your device by this site before the click or during it, and no information about you travels back here afterwards. What does reach a partner ahead of any click is the product photograph described just above. The arrangement is explained on the affiliate disclosure.
Changing your mind, and what that can and cannot reach
- Cookie settings, in the footer of any page here, reopens the same box whichever way you answered it before. Switching to decline is recorded at once and, if a tag is running at the time, the refusal is handed straight to it so that collection stops there and then rather than at your next page. Nothing is loaded again afterwards.
- What that click cannot do is reach back into a cookie Google already placed during the visit where you had accepted. That one sits on your device under their name, and your browser's own settings are what remove it. We would rather say so than imply a reach we do not have.
- Clearing your browsing data wipes both stored values, so the question returns and the saved places are gone with it.
- If your browser refuses local storage altogether, which private windows and hardened settings often do, then nothing can be remembered, the box simply comes back, and measurement stays unloaded. The failure runs in your favour.
- Declining costs you nothing. Every word of every page is there either way, and you will not be asked twice in a row or nagged about it.
What is not here at all
Typefaces are served from this site's own address rather than pulled from a font service, so reading the words on a page reveals you to our host and to nobody else. There is no advertising network, no embedded video, no social button, no comment system, no chat widget and no heat mapping tool anywhere on the site. The partner product photographs described above are the only thing any page loads from a server we do not control, and they are pictures of things you can buy rather than anything built to measure you.
Questions
Send them to admin@whattodoinmalta.com. The broader picture is in the privacy policy.