Cookie Policy: One Functional Cookie, Zero Tracking
Plain-English cookie policy for bestgirlfriend.ai. One functional cookie (NEXT_LOCALE), zero tracking, no banner. GDPR, ePrivacy, CCPA compliant.
Most adult sites in this space drop 80+ tracking cookies before you've even seen the homepage. Meta Pixel, Google Ads tag, TikTok Pixel, four heatmap SDKs, three retargeting platforms, the works. We set one functional cookie. Not as a marketing position. As the consequence of choosing privacy-first tooling on day one, when the trade-off was real and we made it anyway. This cookie policy explains what we set, what we explicitly do not set, and how the law applies.
bestgirlfriend.ai is an independent editorial comparator covering AI girlfriend apps, live cam sites, real-model creators, and adult games. We are ad-free and reader-supported through affiliate commissions disclosed separately. The honest minimalism here, one cookie, no banner, is what made the rest of the privacy story possible.
This cookie policy complies with the EU ePrivacy Directive 2002/58/EC (Article 5(3), as amended by 2009/136/EC), GDPR 2016/679, the UK Privacy and Electronic Communications Regulations 2003, CNIL Délibération 2020-091, the EDPB Guidelines 2/2023 on Article 5(3) ePrivacy, and the California Consumer Privacy Act as amended by the CPRA.
What is a cookie?
A cookie is a small text file a website stores on your device to remember information between page loads. The EU ePrivacy Directive defines cookies as "information stored in the terminal equipment of a user." Cookies can be functional, analytics, advertising, or social. Their purpose, not their existence, decides whether consent is required.
The legal regime treats every cookie identically until you ask what it does. A cookie remembering language preference is treated very differently from a cookie tracking your scroll depth across forty sites. The [Source: EDPB Guidelines 2/2023 on Technical Scope of Article 5(3) ePrivacy Directive · verified 2026-05-26] walks through the test in detail; the short version is the four-purpose taxonomy used by every European regulator: strictly necessary (functional), performance (analytics), targeting (advertising), and social. Only the first category is exempt from prior consent.
Last reviewed: 2026.Does bestgirlfriend.ai use tracking cookies?
No. The site sets a single strictly-necessary functional cookie called NEXT_LOCALE that remembers your selected language across 32 localized versions. It expires twelve months after your last visit. There are no analytics cookies, no advertising cookies, no social cookies, no fingerprinting alternatives. The cookie inventory is reproducible: open browser DevTools, Application tab, Cookies.
The full cookie inventory, in one row:
| Cookie name | Purpose | Duration | Type | Consent required |
|---|---|---|---|---|
NEXT_LOCALE | Remembers your selected language across 32 localized versions of the site | 12 months from last visit | Functional / strictly necessary | No (Article 5(3) exemption) |
That table is the entire cookie inventory. No second row, no hidden tab, no asterisk. The day we add a second cookie (if we ever do), the change appears on this page within 24 hours. The minimalism is an editorial choice: every additional cookie is a tax on reader trust we are not willing to pay.
I check it myself by opening Chrome DevTools on any page of the site, switching to the Application tab, expanding Cookies. One row. NEXT_LOCALE, value en. Anyone can verify the same in 30 seconds.
What is the one functional cookie?
NEXT_LOCALE is a 12-month first-party cookie that stores a two-letter language code (en, fr, de, ja, etc.). It is set by the Next.js middleware on first language selection. It is strictly necessary under ePrivacy Article 5(3) because language preference cannot persist between visits without it. No personal data, no identifier, no behavioural signal.
CNIL Délibération 2020-091 lists language-memory cookies as a textbook example of the strictly-necessary exemption. The cookie holds no identifier that could re-link two visits to the same reader; the value is whichever language you picked from the language switcher. If two readers in the same household pick the same language, their NEXT_LOCALE values are byte-identical and indistinguishable from each other.
Does bestgirlfriend.ai use Google Analytics?
No. We run two cookieless analytics tools in parallel: Plausible Analytics (privacy-first, self-hosted on our own server) and Cloudflare Web Analytics (free-tier RUM beacon, cookieless by Cloudflare's published privacy model). Both measure aggregate visits without persistent identifiers, never identify individual users, and store no cookie. Google Analytics, Adobe Analytics, Mixpanel, and Matomo with cookies are not on this site.
Plausible's data model is published openly: a salted SHA-256 hash of IP address concatenated with User-Agent, rotated daily, used solely to estimate "unique visitors per day" and discarded within 24 hours. No cookie, no localStorage value, no fingerprint persisted across sessions. Because we self-host the open-source edition on our own infrastructure, even the aggregate counts never leave our control.
Cloudflare Web Analytics is the secondary signal. The RUM beacon (https://static.cloudflareinsights.com/beacon.min.js) loads after page hydration and reports anonymous performance and visit counts to our Cloudflare account dashboard. Cloudflare's public privacy commitment states the product "does not use any client-side state (like cookies or localStorage) to attribute visits to the same visitor." Verified at our edge: the beacon endpoint sets no cookies in the response header. Cross-validation between Plausible and Cloudflare protects against single-vendor measurement drift; ad-blockers that suppress one tool do not always suppress the other.
Are there advertising cookies on this site?
No. There is no Meta Pixel, no Google Ads tag, no TikTok Pixel, no LinkedIn Insight Tag, no X conversion pixel, no Pinterest tag, no Reddit Pixel, and no programmatic ad SDK. We do not retarget visitors, build audiences, or share behavioural data with ad platforms. The business model is reader-supported affiliate revenue, disclosed at /affiliate-disclosure.
The ad-tech ecosystem is the reason most sites need cookie banners. Every pixel is a third-party data flow that requires explicit consent under GDPR Article 7 and the ePrivacy Directive. We chose at launch to exclude that entire layer. The trade-off is real (no retargeting campaigns, no lookalike audiences, no Pixel-based conversion attribution) but it makes the privacy story honest end to end. Our affiliate disclosure explains how revenue actually works without those pixels.
What we use vs what we don't
| Category | Tool | Status on bestgirlfriend.ai |
|---|---|---|
| Functional cookie | NEXT_LOCALE language memory | In use, 12-month, strictly necessary |
| Privacy-first analytics | Plausible Analytics, self-hosted, cookieless | In use, no cookie |
| Performance / RUM analytics | Cloudflare Web Analytics, cookieless beacon | In use, no cookie |
| Email marketing | Listmonk, self-hosted | Sets no cookie on this domain |
| Advertising / retargeting | Meta Pixel, Google Ads, TikTok Pixel, LinkedIn Insight, X, Pinterest, Reddit | Not used |
| Generic analytics with cookies | Google Analytics 4, Adobe Analytics, Matomo (cookie mode) | Not used |
| Heatmaps and session replay | Hotjar, Microsoft Clarity, FullStory, LogRocket | Not used |
| A/B testing platforms | Optimizely, VWO, Google Optimize successors | Not used |
| Tag manager | Google Tag Manager, Tealium, Segment | Not used |
| Fingerprinting fallbacks | FingerprintJS, ThreatMetrix, canvas / WebGL fingerprinting | Not used |
| Embedded video | youtube-nocookie.com privacy-enhanced domain | Used; no cookie until you press play |
The table is auditable from the browser DevTools "Network" and "Application" panels on any page of the site. If you find a tag, pixel, or cookie not listed above, write to [email protected] and we will publish a correction on this page the same week.
Are there third-party cookies?
Almost none. The only third-party cookies you may see come from optional embeds you click to expand, such as a YouTube video. Until you press play, no third-party cookie is set. We use the youtube-nocookie.com privacy-enhanced domain whenever a video must be embedded. Affiliate clicks set cookies on the destination platform, not here.
This deserves precision. A "third-party cookie" is a cookie set by a domain other than the one in your address bar. Our base configuration sets none. The two narrow exceptions are user-initiated: pressing play on a video embed (handled via youtube-nocookie.com to delay cookie setting) and clicking an affiliate link (which sets a CrakRevenue tracker on its own domain, governed by its own privacy notice, not ours).
Do affiliate redirects set cookies?
No cookie is set on the bestgirlfriend.ai domain. Our outbound redirect route logs a hashed event (page slug, CTA placement, locale, country derived from the request) and issues a 302 redirect to the partner tracking URL. The CrakRevenue tracking cookie is set by the destination platform on its own domain, under its own privacy notice, after the redirect resolves.
The redirect chain is short. Click an outbound button. Our Cloudflare Worker writes one ephemeral event to our analytics store (no IP retained, no reader identifier created), then returns HTTP 302 with the destination URL. Your browser follows the redirect. From that point you are on the partner platform under its policy, not ours. The SubID semantics (which page, which CTA, which placement) are published at /affiliate-disclosure so the trail is reproducible.
How do YouTube embeds handle cookies?
We use the youtube-nocookie.com privacy-enhanced domain for any YouTube embed, which delays cookie setting until you press play. Until then, no YouTube cookie is set. Once you click play, YouTube sets cookies under Google's privacy policy. We label every video with a "starts YouTube cookies on play" note above the player so the choice is informed.
Privacy-enhanced mode is YouTube's own feature, designed exactly for sites with strict cookie policies. The trade-off: even in privacy-enhanced mode, the moment you actually watch a video, YouTube and Google receive standard playback telemetry under their own privacy policy. We disclose this above the embed rather than in the footer because CNIL considers proximity essential to informed choice.
How do I clear or block cookies?
All major browsers let you block or delete cookies in their settings. Chrome: Settings, Privacy and security, Cookies. Firefox: Settings, Privacy and Security, Cookies and Site Data. Safari: Preferences, Privacy. Edge: Settings, Cookies and site permissions. You can also use private or incognito mode, which discards cookies when the window closes.
The browser is the right place to manage cookies because it is universal: a single setting governs every site you visit. Site-by-site cookie banners create the illusion of control but actually fragment the surface where you exercise it. If you block the NEXT_LOCALE cookie specifically, the site degrades gracefully: your language reverts to your browser's Accept-Language header on each visit. No content is hidden, no feature is paywalled, no nag screen appears.
What is the difference between functional and tracking cookies?
Functional cookies make a feature work, such as remembering your language. They are exempt from prior consent under the ePrivacy Directive's strictly-necessary carve-out. Tracking cookies measure behaviour or build profiles for analytics or advertising. Tracking cookies require informed, freely given, specific, and unambiguous consent before they are set, per EDPB guidelines.
The European regulators' four-purpose taxonomy is the clearest mental model. Functional and strictly-necessary cookies (remembering language, keeping a shopping cart, holding a session token) need no consent. Performance cookies (analytics that count visits) need consent unless they are aggregated, anonymous, and first-party; Plausible-style measurement does not. Targeting cookies (ad retargeting) always need consent. Social cookies (Facebook Like buttons, embedded tweets) need consent and were the basis of the Schrems II saga. We have only the first category, which is why no banner is shown.
Why don't you show a cookie banner?
Cookie banners are required only when a site sets cookies that need consent. The ePrivacy Directive and EDPB cookie guidelines require consent for tracking, not for strictly-necessary functional cookies. Because we set only one strictly-necessary cookie, no consent is legally required. CNIL and ICO guidance both confirm this; a banner would mislead readers into thinking we track them.
The ePrivacy Directive's Article 5(3) exempts cookies "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." CNIL Délibération 2020-091 lists language-memory cookies as a textbook example of the exemption. The ICO's PECR guidance on cookies reaches the same conclusion. The EDPB Guidelines 2/2023 on the technical scope of Article 5(3) reconfirm the carve-out. Adding a banner where none is required would, paradoxically, weaken trust by suggesting tracking we do not perform.
Do I need to consent to anything?
No. The single NEXT_LOCALE cookie is strictly necessary to deliver the language you chose, which is the legal basis for the consent exemption under Article 5(3) of the ePrivacy Directive. We process no personal data via cookies, so GDPR consent obligations do not attach. CCPA opt-out rights do not apply because we sell or share no personal information.
If you want to opt out further than we already have, the practical levers are these: block third-party cookies in your browser (already does almost nothing on this site, but everywhere it matters), turn on Do Not Track or Global Privacy Control (we honour both even though Plausible already ignores you), or use a content blocker like uBlock Origin. None of these affect the content you can read.
Does Plausible use cookies?
No. Plausible Analytics is cookieless by design. It computes a daily-rotating, salted hash of IP plus User-Agent to estimate unique visitors, then discards the hash within 24 hours. No cookie, no localStorage, no fingerprint persisted across days. Plausible publishes its data model openly; we self-host the open-source edition on our own VPS infrastructure.
Plausible's data policy is short, public, and audited by external researchers. The hash function is deterministic within a 24-hour window and irreversible across days, which is why CNIL has explicitly approved Plausible as a measurement tool that does not require consent in France. Self-hosting adds the second guarantee: data flows from your browser to our server, full stop, with no Plausible-Inc. transit hop in between.
What happens if I block your one functional cookie?
The site still works. Without NEXT_LOCALE, every page reload resets your language preference to whatever your browser sends in its Accept-Language header. Pages, links, citations, methodology, FAQs, and affiliate disclosures all render normally. The only consequence is that switching languages becomes a per-visit action instead of a sticky choice.
This is the architectural test of "strictly necessary": a strictly-necessary cookie is one whose absence degrades the requested service in a way the user would notice and care about. Language stickiness across visits passes that test for a multilingual site. None of the editorial content, none of the comparison tables, none of the affiliate links depend on the cookie's presence.
Where can I file a complaint about cookies?
Contact [email protected] first; we read every message and correct errors on the record. If unsatisfied, you can file with your national data-protection authority. EU: your country's regulator listed at the European Data Protection Board. UK: Information Commissioner's Office. France: CNIL. United States: state attorneys general or the FTC.
Most cookie complaints we have seen in the industry trace back to two failure modes: a banner that records "consent" before the user actually clicks (dark pattern, illegal under EDPB guidelines) or a vendor list that drifts from the actual cookies set. Neither failure mode applies here because we have neither a banner nor a vendor list. If you spot a divergence, the correction will appear on this page within 7 business days.
How do GDPR and ePrivacy interact with this policy?
The ePrivacy Directive 2002/58/EC governs cookie placement; GDPR 2016/679 governs personal data processing. Cookies that process personal data trigger both regimes. Our single functional cookie processes no personal data and is strictly necessary, so neither regime imposes consent or transparency duties beyond this cookie policy. The CCPA, LGPD, and PIPEDA reach the same outcome.
The two regimes are sometimes treated as one ("the GDPR cookie law"), but they are distinct. Article 5(3) of ePrivacy is the cookie-specific consent rule and is older; the GDPR is the broader data-protection regulation. The [Source: CJEU Planet49 GmbH v Bundesverband der Verbraucherzentralen, Case C-673/17 (1 October 2019) · verified 2026-05-26] is the leading authority on how the two combine. The relevance for us: even if we did process personal data through cookies, ePrivacy would govern the placement, GDPR would govern the processing, and our exemption under Article 5(3) would still apply because the cookie remains strictly necessary. Outside the EU, California's CCPA (as amended by the CPRA), Brazil's LGPD, Canada's PIPEDA, and the UK's PECR all converge on the same answer for a single, first-party, strictly-necessary functional cookie that processes no identifying data.
How this connects to our other policies
This cookie policy is one piece of a four-document trust stack:
- The privacy policy describes what data we collect, store, and share, including the affiliate click-through to CrakRevenue (which sets cookies on its own domain under its own notice).
- The affiliate disclosure explains how reader-supported revenue works without ad pixels.
- The terms of service cover eligibility and contractual obligations.
- This page covers placement and reading of information on your device.
Read together, the trust stack is what allows us to honestly say "no banner, no tracking" without the catch any reader is right to expect.
Last reviewed: 2026.Sources
The statutes, decisions, and guidelines cited on this page are listed below in the order they appear, with stable URLs. Re-verified 2026.
- [Source: ePrivacy Directive 2002/58/EC (Article 5(3) cookie rule, as amended by 2009/136/EC) · verified 2026-05-26], primary cookie consent baseline.
- [Source: General Data Protection Regulation (Regulation EU 2016/679) · verified 2026-05-26], Articles 6, 7 (consent + lawful basis interplay).
- [Source: European Data Protection Board, Guidelines 2/2023 on Technical Scope of Article 5(3) ePrivacy Directive · verified 2026-05-26], current authoritative interpretation.
- [Source: CNIL Délibération n° 2020-091, Lignes directrices cookies et autres traceurs · verified 2026-05-26], French regulator on cookieless analytics + functional-cookie exemption.
- [Source: UK Information Commissioner's Office, Guide to PECR, Cookies and similar technologies · verified 2026-05-26], UK statutory equivalent.
- [Source: UK PECR, Privacy and Electronic Communications (EC Directive) Regulations 2003 · verified 2026-05-26], UK cookie placement regime.
- [Source: CJEU Planet49 GmbH v Bundesverband der Verbraucherzentralen, Case C-673/17 (2019) · verified 2026-05-26], leading authority on cookie consent.
- [Source: California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act · verified 2026-05-26], US opt-out framework.
- [Source: Plausible Analytics, Data Policy · verified 2026-05-26], cookieless analytics primary source.
- [Source: Cloudflare Web Analytics, public privacy commitment · verified 2026-05-26], RUM beacon cookieless attestation.
- [Source: YouTube Help, Turn on privacy-enhanced mode for YouTube embeds (youtube-nocookie.com) · verified 2026-05-26], embed-specific cookie behaviour.
- [Source: Lei Geral de Proteção de Dados Pessoais (LGPD), Lei 13.709/2018 · verified 2026-05-26], Brazilian convergent framework.
How to cite this page
If you reference this cookie policy in academic, regulatory, or journalistic work, please cite as:
Joly, A. (2026). Cookie Policy: One Functional Cookie, Zero Tracking. bestgirlfriend.ai. https://bestgirlfriend.ai/cookies
A machine-readable summary is published at /llms.txt for AI search crawler ingestion.
Frequently asked questions
What is a cookie?
A cookie is a small text file a website stores on your device to remember information between page loads. The EU ePrivacy Directive defines cookies as "information stored in the terminal equipment of a user." Cookies can be functional, analytics, advertising, or social. Their purpose, not their existence, decides whether consent is required.
What cookies does bestgirlfriend.ai use?
One. The site sets a single functional cookie called NEXT_LOCALE that remembers which of the 32 language versions you selected. It expires twelve months after your last visit. There are no analytics cookies, no advertising cookies, no social cookies, and no fingerprinting alternatives. The cookie inventory is reproducible: open your browser DevTools, Application tab, Cookies.
Does bestgirlfriend.ai use Google Analytics?
No. We run two cookieless analytics tools in parallel: Plausible Analytics (privacy-first, self-hosted on our own server, salted-hash daily-rotating fingerprint) and Cloudflare Web Analytics (free-tier RUM beacon, cookieless by Cloudflare's published privacy model). Both stop short of any persistent identifier. Google Analytics, Adobe Analytics, Mixpanel, and Matomo with cookies are not on this site.
Are there advertising cookies on this site?
No. There is no Meta Pixel, no Google Ads tag, no TikTok Pixel, no LinkedIn Insight Tag, no X conversion pixel, no Pinterest tag, no Reddit Pixel, and no programmatic ad SDK. We do not retarget visitors, build audiences, or share behavioural data with ad platforms. The business model is reader-supported affiliate revenue, disclosed at /affiliate-disclosure.
Are there third-party cookies?
Almost none. The only third-party cookies you may see come from optional embeds you click to expand, such as a YouTube video. Until you press play, no third-party cookie is set. We use the youtube-nocookie.com privacy-enhanced domain whenever a video must be embedded. Affiliate clicks set cookies on the destination platform, not here.
Do affiliate redirects set cookies on bestgirlfriend.ai?
No. Our outbound redirect route logs a hashed event (page, CTA placement, locale, country) and issues a 302 to the partner tracking URL. No cookie is set on the bestgirlfriend.ai domain at any point in the chain. The CrakRevenue tracking cookie is set by the destination platform on its own domain, under its own privacy notice, after the redirect resolves.
How do I block or delete cookies?
All major browsers let you block or delete cookies in their settings. Chrome: Settings, Privacy and security, Cookies. Firefox: Settings, Privacy and Security, Cookies and Site Data. Safari: Preferences, Privacy. Edge: Settings, Cookies and site permissions. You can also use private or incognito mode, which discards cookies when the window closes.
What is the difference between functional and tracking cookies?
Functional cookies make a feature work, such as remembering your language. They are exempt from prior consent under the ePrivacy Directive's strictly-necessary carve-out. Tracking cookies measure behaviour or build profiles for analytics or advertising. Tracking cookies require informed, freely given, specific, and unambiguous consent before they are set, per EDPB guidelines.
Why don't you show a cookie banner?
Cookie banners are required only when a site sets cookies that need consent. The ePrivacy Directive and EDPB cookie guidelines require consent for tracking, not for strictly-necessary functional cookies. Because we set only one strictly-necessary cookie, no consent is legally required. CNIL and ICO guidance both confirm this; a banner would mislead readers into thinking we track them.
Do I need to consent to anything?
No. The single NEXT_LOCALE cookie is strictly necessary to deliver the language you chose, which is the legal basis for the consent exemption under Article 5(3) of the ePrivacy Directive. We process no personal data via cookies, so GDPR consent obligations do not attach. CCPA opt-out rights do not apply because we sell or share no personal information.
Does Plausible use cookies?
No. Plausible Analytics is cookieless by design. It computes a daily-rotating, salted hash of IP plus User-Agent to estimate unique visitors, then discards the hash within 24 hours. No cookie, no localStorage, no fingerprint persisted across days. Plausible publishes its data model openly; we self-host the open-source edition on our own VPS infrastructure.
How do YouTube embeds handle cookies?
We use the youtube-nocookie.com privacy-enhanced domain for any YouTube embed, which delays cookie setting until you press play. Until then, no YouTube cookie is set. Once you click play, YouTube sets cookies under Google's privacy policy. We label every video with a "starts YouTube cookies on play" note above the player so the choice is informed.
What happens if I block your one functional cookie?
The site still works. Without NEXT_LOCALE, every page reload resets your language preference to whatever your browser sends in its Accept-Language header. Pages, links, citations, methodology, FAQs, and affiliate disclosures all render normally. The only consequence is that switching languages becomes a per-visit action instead of a sticky choice.
Where can I file a complaint about cookies?
Contact [email protected] first; we read every message and correct errors on the record. If unsatisfied, you can file with your national data-protection authority. EU: your country's regulator listed at the European Data Protection Board. UK: Information Commissioner's Office. France: CNIL. United States: state attorneys general or the FTC.
How do GDPR and ePrivacy interact with this policy?
The ePrivacy Directive 2002/58/EC governs cookie placement; GDPR 2016/679 governs personal data processing. Cookies that process personal data trigger both regimes. Our single functional cookie processes no personal data and is strictly necessary, so neither regime imposes consent or transparency duties beyond this cookie policy. The CCPA, LGPD, and PIPEDA reach the same outcome.
Related trust pages: About · Editorial Process · Methodology · Affiliate Disclosure · Privacy Policy · DMCA · Terms · Errata · Age Verification · Contact
Per-jurisdiction notice
I write trust pages the way I'd want them written to me: short, structured by what you actually need to know, no hidden tab, no asterisk. If you spot a divergence between what this page claims and what your DevTools panel shows, write to [email protected]. The correction lands on this page within a week.
Last verified 2026 · See errata log for any post-publish corrections · Editor: Alexandra Joly · Privacy policy · Terms of service · Affiliate disclosure