Cookies
We set five cookies. Every one of them is needed for the site to work, and none of them is used for advertising or measurement.
What a cookie is here
A cookie is a short piece of text your browser stores for us and sends back on your next request. We use them to keep you signed in, to hold your basket together, to stop other sites submitting forms in your name, and to remember that you have told us your age. That is the whole list, and it is set out below.
We run no analytics and no advertising at all. There is no Google Analytics, no tag manager and no advertising pixel on this site, so there is no optional cookie to agree to and no consent banner to click past. If that ever changes, we will ask first — before the script is added, not after — and a refusal will be one click, in the same place and the same size as agreeing.
Why the age cookie does not ask your permission
We sell alcohol, so we are required to take steps to keep it away from people under 18. When you confirm your age we store that answer in a cookie called dv_age_ok. The alternative is not “no cookie” — it is asking you the same question on every page you open, which is not a working site.
That is why it sits under strictly necessary and why there is no toggle for it. Refusing it would mean refusing the site. What it holds is worth being precise about: the value is the single character 1. It is not a name, an age, a date of birth or an identifier; it cannot be used to recognise you on another site; it is never shared; and it plays no part in measurement or advertising. Your browser will not hand it to page scripts, and it is not sent when another site links to us.
It is worth being equally plain about what it is not: a check anyone passes by clicking. It records a declaration, and it is a retail convention rather than identity verification.
Every cookie we set
This list was compiled by opening the site in a browser with no cookies at all and recording what appeared, rather than from memory. Not every cookie is set on every visit — three of them appear only once you add a bottle, sign in or start to check out.
dv_age_ok
Records that you have confirmed you are 18 or over, so we ask once rather than on every page.
- Lasts
- One year
- Set by
- Us
- Category
- Strictly necessary
Marked so that page scripts cannot read it.
csrftoken
Protects every form and every basket change from being submitted by another site on your behalf. Without it, adding to your basket and signing in cannot work safely.
- Lasts
- One year
- Set by
- Us
- Category
- Strictly necessary
sessionid
Keeps you signed in and holds the step you have reached in checkout. Set once there is something to remember — signing in, or starting to check out.
- Lasts
- Twelve hours after you stop using the site
- Set by
- Us
- Category
- Strictly necessary
Marked so that page scripts cannot read it.
oscar_open_basket
Links you to your basket before you have signed in, so the bottles you added are still there when you come back.
- Lasts
- Seven days
- Set by
- Us
- Category
- Strictly necessary
Marked so that page scripts cannot read it.
messages
Carries a one-off notice — "your basket is empty", "your details were saved" — across the page change that follows an action. It is deleted as soon as the notice is shown.
- Lasts
- Until the notice is shown, and in any case until you close the browser
- Set by
- Us
- Category
- Strictly necessary
Marked so that page scripts cannot read it.
Other servers your browser contacts
Nobody else stores anything on your device through this site. There is one other server your browser talks to, it was checked, and it sets no cookie. It is listed anyway, because loading something from another company’s server tells that company your IP address whether or not anything is stored.
Esri — The map on “Wine by place”
The satellite imagery is loaded from Esri as you pan and zoom, so Esri can see your IP address and which tiles you asked for. They are not told which page you were on: this site sends no referrer to another domain.
Sets no cookies.
Removing them yourself
Every browser lets you see and delete the cookies a site has set, and block them in future, from its settings. Deleting ours is safe: you will be asked your age again, you will be signed out, and a basket you had not signed in to will be forgotten.
For what we do with personal information more broadly — orders, delivery, bidding and your rights over it — see the privacy policy. Our terms cover buying and bidding, and the atlas is the one page that loads a map from elsewhere.