1. Introduction
Welcome to the Cookies Policy of ABC Bank Plc ("the Bank", "we", "us", or "our"). This policy explains what cookies are, how we use them on our website and mobile applications (our "digital channels"), the different categories of cookies we deploy, how long cookies remain on your device, and how you can manage or disable them through your browser settings or our cookie consent management tool.
This Cookies Policy should be read alongside our main Privacy Policy, which sets out the broader framework for how we collect, use, and protect your personal information. The use of cookies and similar technologies involves the processing of personal data in certain circumstances, and our Privacy Policy applies to all such processing in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or reject non-essential categories of cookies before they are set on your device. You can change your cookie preferences at any time by clicking on the "Cookie Preferences" link in the footer of our website or by using the manage cookies functionality within our mobile applications. Your preferences will be stored and honoured on subsequent visits.
We are committed to ensuring that our use of cookies is transparent, fair, and proportionate, and that we only deploy cookies that are genuinely necessary for the operation of our digital channels or that provide a clear benefit to our users. We regularly review the cookies used on our digital channels to ensure that this policy remains accurate and up-to-date, and to remove any cookies that are no longer required.
2. What Are Cookies
Cookies are small text files containing a string of characters that are sent to your computer or mobile device when you visit a website. They are widely used by website operators to make websites work, or work more efficiently, as well as to provide reporting information, to personalise content and advertising, and to analyse website traffic and usage patterns. When you return to a website, the cookie is read back by the website, allowing it to recognise your device and remember important information that will make your use of the site more convenient or efficient.
Cookies can be classified in a number of ways. One common distinction is between "session cookies" and "persistent cookies". Session cookies are temporary cookies that are stored in your browser's memory only during your browsing session, and are automatically deleted from your device when you close your browser. Persistent cookies, by contrast, remain stored on your device for a specified period of time (which may range from a few minutes to several years, depending on the cookie's purpose) after you close your browser, and are reactivated each time you visit the website that set the cookie, until they either expire or you manually delete them.
Other Similar Technologies
In addition to standard HTTP cookies, we may also use the following similar tracking technologies on our digital channels from time to time, each of which is subject to the same consent and management requirements as cookies under this policy:
- Local Storage and Session Storage: HTML5 web storage mechanisms that allow us to store small amounts of structured data on your device for purposes such as saving your preferences or maintaining the state of your online banking session between page loads.
- IndexedDB: A low-level client-side storage API that allows us to store larger volumes of structured data on your device, enabling certain offline functionality in our mobile and web applications.
- Web Beacons (Pixel Tags / Clear GIFs): Tiny, invisible graphic images embedded in web pages and email communications that are used to track user activity, to count page views and email opens, and to verify that content has been delivered and viewed.
- JavaScript Tags and Tracking Scripts: Embedded script code that collects information about how you interact with our digital channels, including page load times, error events, button clicks, and form interactions, which is used for performance monitoring, analytics, and A/B testing.
- Fingerprinting Techniques: Passive device and browser fingerprinting may be used for fraud prevention and security purposes, by collecting information about your device's characteristics (such as screen resolution, installed fonts, operating system version, and browser plugins) to help identify and block suspicious activity.
- SDKs and Mobile Device Identifiers: In our mobile applications, we may use software development kits (SDKs) and mobile device identifiers such as the Apple Advertising Identifier (IDFA) or Android Advertising ID (AAID) for analytics, attribution, and marketing purposes, subject to your device-level permission settings.
Cookies may be set either by us directly (referred to as "first-party cookies") or by third-party service providers acting on our behalf (referred to as "third-party cookies"). First-party cookies are typically used for core functionality such as session management and preference storage, while third-party cookies are commonly used for analytics, advertising, and content personalisation services provided by external partners. Where we use third-party cookies, we ensure that appropriate data processing agreements are in place with our service providers, and that their use of your data is subject to appropriate safeguards.
For the avoidance of doubt, any technology that stores or accesses information on your device (including cookies, local storage, and similar technologies) is treated as a "cookie" for the purposes of this policy and our cookie consent management, in line with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) and the guidance issued by the Information Commissioner's Office (ICO) on the use of cookies and similar technologies.
3. Categories We Use
We use cookies and similar technologies that fall into the four categories described below. In accordance with the Privacy and Electronic Communications Regulations, Strictly Necessary cookies may be set on your device without requiring your consent, as they are essential for the operation of our digital channels and the provision of the services you have explicitly requested. All other categories of cookies (Functional/Preference, Analytics/Performance, and Marketing/Advertising) are non-essential and will only be set on your device if you have given us your explicit, freely-given, specific, and informed consent to do so via our cookie consent management banner or preference centre.
Strictly Necessary
Always active — cannot be disabled.
These cookies are essential for the fundamental operation of our digital channels and for enabling you to use our online and mobile banking services. Without these cookies, certain core features of our website and applications would not function properly, and we would be unable to provide many of the services that you have requested from us. Strictly Necessary cookies do not require your consent to be set.
Examples of use:
- Maintaining your authenticated session during online banking
- Protecting against cross-site request forgery (CSRF) attacks
- Remembering your cookie consent preferences
- Enabling you to complete application forms across multiple pages
- Ensuring the secure transmission of data between your browser and our servers
- Implementing load balancing to distribute traffic across our servers
Functional / Preference
Active only with your consent.
These cookies enable our digital channels to remember choices you have made (such as your preferred language, region, font size, display settings, or login preferences) and to provide enhanced, more personalised features and functionality. They may also be used to provide services you have explicitly requested, such as the ability to remember your user ID on the login page, or to provide features such as saved calculators or tools.
Examples of use:
- Remembering your user ID to save you time on the login page
- Applying your preferred display theme, contrast mode, or accessibility settings
- Storing your preferred language and region settings
- Remembering whether you have accepted a prompt or notification that we have shown you
- Maintaining the state of forms or tools during a single visit
- Keeping you signed in across multiple pages if you choose the "remember me" option
Analytics / Performance
Active only with your consent.
These cookies allow us to collect information about how visitors interact with our digital channels, including which pages are visited most frequently, how long users spend on each page, the paths they take through the site, where they came from, and whether they encounter any errors or issues. This information is aggregated and anonymised wherever possible, and is used to measure and improve the performance, usability, and effectiveness of our website and applications.
Examples of use:
- Understanding which pages and content are most popular with visitors
- Measuring the effectiveness of our marketing campaigns
- Identifying pages with high exit rates or errors that may need improvement
- Analysing user journeys to identify friction points in application flows
- Monitoring website performance and page load times across different devices
- Segmenting audiences by device type, geography, or referral source for reporting
Marketing / Advertising
Active only with your consent.
These cookies are used to deliver advertisements that are relevant to you and your interests, based on information collected about your browsing behaviour across our digital channels and, in some cases, across third-party websites. They may also be used to limit the number of times you see a particular advertisement, to measure the effectiveness of advertising campaigns, and to attribute conversions to specific marketing touchpoints.
Examples of use:
- Delivering personalised product recommendations and promotional offers on our website
- Showing you relevant advertisements for our products on third-party websites and social media platforms
- Ensuring you do not see the same advertisement repeatedly
- Measuring the number of conversions (e.g., account openings, applications) resulting from specific adverts
- Enabling social media features such as sharing buttons and content feeds
- Building audience segments for re-marketing and lookalike advertising campaigns
Please note that our marketing partners, advertising networks, social media platforms, and analytics providers may combine the information they collect through cookies on our digital channels with information they have collected from other sources, in accordance with their own privacy policies. We encourage you to review the privacy policies of our third-party service providers to understand how your information may be used by them for their own purposes, where applicable.
4. Cookie Inventory Table
The table below lists the most commonly used cookies and similar technologies deployed on our digital channels, organised by category. Please note that this list is illustrative and may not be exhaustive, as the specific cookies used may be updated from time to time due to changes in functionality, service providers, or regulatory requirements. In particular, third-party cookies set by our service providers are subject to change by those providers and may be updated without notice. The "Expiry" column indicates the maximum period that each cookie may remain stored on your device before automatically expiring, unless manually deleted by you earlier.
| Cookie Name | Purpose | Category | Expiry |
|---|---|---|---|
| STRICTLY NECESSARY COOKIES | |||
| PHPSESSID | Native PHP session identifier used to maintain the state of your authenticated banking session across page requests, ensuring you remain securely logged in while navigating our online banking services and that your data is associated with the correct server-side session. | Strictly Necessary | Session (deleted on browser close) |
| csrf_token | Cryptographically secure, randomly generated token used to protect against Cross-Site Request Forgery (CSRF) attacks, by validating that each form submission or state-changing request received by our servers originated from a legitimate, authenticated user session and not from a malicious third-party website. | Strictly Necessary | Session (deleted on browser close) |
| cookie_consent | Stores a record of your cookie consent preferences, including which categories of non-essential cookies you have accepted or declined, so that we do not present you with the consent banner on every page load and so that we honour your choices consistently throughout your visit and subsequent visits. | Strictly Necessary | 6 months |
| ts | Load balancing and request routing cookie set by our web application firewall and content delivery infrastructure to ensure that subsequent requests from your browser during a single session are routed to the correct backend server, maintaining session affinity and ensuring consistent service delivery. | Strictly Necessary | Session (deleted on browser close) |
| FUNCTIONAL / PREFERENCE COOKIES | |||
| remember_me | If you select the "Remember me" option on the login page, this cookie stores a long-lived, encrypted authentication token that allows you to be automatically recognised on your next visit, pre-populating your user ID and enabling faster re-authentication without requiring you to re-enter your full credentials every time. | Functional / Preference | 30 days |
| user_prefs | Persists your user interface and experience preferences, such as your chosen language (English/Welsh), default dashboard layout, font size, display theme (light/dark), high-contrast mode preference, and any accessibility settings you have enabled within our digital banking platform. | Functional / Preference | 1 year |
| saved_user | Stores an obfuscated version of your user ID on the login page, so that when you return to log in, your user ID field is automatically pre-populated, saving you time and reducing the risk of typos during the login process. | Functional / Preference | 6 months |
| region | Remembers your selected region or jurisdiction (e.g., England, Scotland, Wales, Northern Ireland), so that we display content, product information, branch details, and regulatory disclosures that are appropriate and relevant to your location. | Functional / Preference | 1 year |
| ANALYTICS / PERFORMANCE COOKIES | |||
| _ga | Primary Google Analytics 4 cookie used to distinguish unique visitors by generating a random, pseudonymous client identifier that is stored on your device. This enables Google Analytics to count the number of unique visitors to our website and to attribute page views, sessions, and events to the correct user across multiple page requests. | Analytics / Performance | 2 years |
| _gid | Supplementary Google Analytics 4 cookie that stores a per-session identifier for the current visit, used to distinguish different sessions of the same user, to calculate session duration and bounce rate, and to group analytics events together within a single browsing session. | Analytics / Performance | 24 hours |
| _ga_XXXXXXXXXX | Google Analytics 4 session state cookie (where the placeholder XXXXXXXXXX represents our property-specific measurement ID), used to persist and update the session state for GA4 data collection, including the timestamp of session start, session count, and engagement time during the current visit. | Analytics / Performance | 2 years |
| _vwo_uuid_v2 | A/B testing and experience optimisation cookie set by our testing platform to assign a unique user identifier, so that we can consistently serve the same variant of a page or feature to a given user across multiple sessions, and to accurately measure which variant drives the best user experience outcomes. | Analytics / Performance | 100 days |
| MARKETING / ADVERTISING COOKIES | |||
| _fbp | Meta (Facebook) Pixel browser identifier cookie used by Meta to attribute visits, conversions, and actions on our website to users who have interacted with our advertisements on Facebook and Instagram, to build custom and lookalike audiences for re-marketing, and to optimise the delivery of our social media advertising campaigns. | Marketing / Advertising | 90 days |
| IDE | Google DoubleClick advertising cookie used to store a pseudonymous advertising profile identifier that enables Google ad services to show you relevant, interest-based advertisements for our products across the Google Display Network, YouTube, and partner websites, based on your previous visits to our digital channels. | Marketing / Advertising | 13 months |
| MUID | Microsoft Advertising universal identification cookie used by Bing Ads and Microsoft's ad network to identify users across their browsing sessions on Microsoft properties and partner sites, enabling cross-device conversion tracking, audience re-targeting, and personalised ad delivery for our Microsoft Advertising campaigns. | Marketing / Advertising | 13 months |
| bcookie / lidc | LinkedIn advertising and analytics cookies: bcookie stores a unique browser identifier for LinkedIn's ad platform to enable conversion tracking, retargeting, and audience measurement for our LinkedIn marketing campaigns, while lidc is used for server-side load balancing and session routing on LinkedIn's advertising infrastructure. | Marketing / Advertising | 1 year |
Important Notes
- Cookie names are shown exactly as deployed; however, third-party service providers may periodically change the names, identifiers, or expiry periods of their cookies, and our table may not reflect such changes immediately. For the most accurate and up-to-date information, please refer to the privacy policy of each respective service provider.
- Where a cookie is shown with a "Session" expiry, it will be automatically deleted from your device when you completely close your browser application (not just the individual tab). If you have set your browser to restore previous sessions, session cookies may persist longer than expected.
- Analytics and marketing cookies are set by third-party service providers acting as independent data controllers in their own right. The processing of your data by such third parties is governed by their respective privacy policies, which we strongly recommend you review before granting consent.
- The specific cookies set on any given visit may vary depending on the particular pages you visit, the actions you take, and whether you have already granted or withdrawn consent for non-essential categories.
5. Managing Cookies
You have a number of options for managing, controlling, and deleting cookies and similar technologies on your device. In addition to our own cookie consent management tool (which allows you to accept or reject entire categories of non-essential cookies at any time), most modern web browsers and mobile operating systems provide settings that allow you to block or restrict the setting of cookies, to delete existing cookies, or to receive a notification before cookies are stored on your device. This section provides general guidance on how to access cookie controls in the most commonly used browsers and devices.
Using Our Cookie Preference Centre
The easiest and most granular way to manage cookies on our website is through our Cookie Preference Centre, which you can access at any time by clicking on the "Cookie Settings" or "Cookie Preferences" link located in the footer of every page on our website, or by re-opening the consent banner if it is still visible on your current visit. Within the preference centre, you can view a description of each cookie category, see which categories are currently active, and toggle your consent for each non-essential category on or off individually. Strictly Necessary cookies cannot be disabled, as they are essential for the operation of the website. Any changes you make to your preferences will be saved immediately and will take effect for the remainder of your current visit and all subsequent visits from the same browser and device.
Browser-Specific Cookie Controls
You can also control cookies through the settings menu of your web browser. The process for accessing and modifying cookie settings varies slightly between browsers and versions — links to the official support documentation for the most popular desktop and mobile browsers are provided below for your convenience:
Effects of Disabling Cookies
Please be aware that blocking or restricting cookies through your browser settings may impact the functionality of our website and your ability to use our services. In particular:
- If you block all cookies (including Strictly Necessary cookies), you may be unable to log in to online banking, to complete application forms, to maintain an authenticated session, or to access other core functionality of our digital channels.
- If you block Functional/Preference cookies, your language, accessibility, and display preferences will not be remembered between visits, and some convenience features (such as saved user ID and remember me) will not work.
- If you block Analytics/Performance and Marketing/Advertising cookies, you may still use our services normally, but we will not be able to gather data that helps us improve our website or show you advertisements that may be relevant to your interests.
- Browser-level cookie controls operate on a per-browser, per-device basis. If you use multiple browsers or multiple devices, you will need to adjust your settings separately for each combination.
In addition to browser-based cookie controls, both Apple iOS and Android operating systems provide device-level settings that allow you to restrict ad tracking, limit the use of advertising identifiers, and control the data that applications can access and store on your device. For iOS devices, you can manage ad tracking and app privacy settings under Settings › Privacy & Security › Tracking and Settings › Privacy & Security › Apple Advertising. For Android devices, you can manage advertising preferences under Settings › Privacy › Ads.
For information about opting out of interest-based advertising delivered by third-party ad networks and ad exchanges across the web, you may wish to visit the opt-out pages operated by the industry self-regulatory bodies, including the Network Advertising Initiative (NAI) opt-out at www.networkadvertising.org/choices and the Digital Advertising Alliance (DAA) Consumer Choice tool at www.youradchoices.com. Please note that these opt-out tools themselves rely on cookies to remember your choices, and that clearing your cookies or using a different browser or device will reset your opt-out preferences.
6. Changes
We may update, amend, or supplement this Cookies Policy from time to time to reflect changes in our practices, to incorporate the use of new cookies or technologies, to update our third-party service providers, to address changes in the law or regulatory guidance (including any revised guidance from the ICO or the European Data Protection Board on the use of cookies and tracking technologies), or to correct any errors, omissions, or inaccuracies. We reserve the right to make changes to this policy at any time and without prior individual notice to you.
Whenever we make a material change to this Cookies Policy — such as adding new categories of cookies, changing the purpose for which existing cookies are used, or introducing significant new third-party partners that set cookies on our behalf — we will take reasonable steps to bring the changes to your attention, such as by displaying a prominent notice on our website home page for a reasonable period, by re-surfacing the cookie consent banner to all visitors so that you can review and re-confirm your preferences, or by sending a secure message to registered online banking users if the changes are particularly significant.
The date on which the most recent version of this Cookies Policy was published will always be displayed prominently at the top of this page, alongside the previous last-updated date where applicable. We encourage you to review this page periodically to ensure that you remain informed of any changes. The archived history of previous versions of this policy is available on request from our customer services team, should you wish to review how our approach to cookies has evolved over time.
Your continued use of our digital channels after any changes to this Cookies Policy have been published (and, where required by law, after you have been re-presented with the cookie consent banner and have had the opportunity to review and update your preferences) will constitute your acceptance of the revised policy and of any changes to our use of cookies and similar technologies as described in the updated policy. If you do not agree with the revised policy, you should adjust your cookie preferences through our preference centre or your browser settings, or refrain from using our digital channels.
7. Contact
If you have any questions, comments, or concerns about this Cookies Policy, about our use of cookies and similar technologies, about how we obtain and manage your cookie consent preferences, or if you would like to request further information about any specific cookie or tracking technology that we use, please do not hesitate to contact us using any of the channels listed below. Our team will respond to all enquiries in a prompt and thorough manner, and will provide clarification or additional information wherever possible.
Contact Channels
Postal Address
100 King Street, London EC2V 8AH, United Kingdom
Telephone
Please refer to our contact page for telephone support lines
Additional Privacy Queries
If your query relates more broadly to how we process your personal data (including data collected through cookies and similar technologies), please refer to our main Privacy Policy for full details of our processing activities, your rights under data protection legislation, and the contact details of our Data Protection Officer. All personal data collected or processed through cookies and similar technologies is handled in accordance with our Privacy Policy and with the requirements of the UK GDPR and the Data Protection Act 2018.
If you are not satisfied with the way we handle your query or with any response we provide, you have the right to refer the matter to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection and privacy matters, including compliance with the Privacy and Electronic Communications Regulations 2003. The ICO can be contacted at their website at www.ico.org.uk or by telephone on 0303 123 1113. As always, we would appreciate the opportunity to address your concerns directly before you escalate them to the ICO.