Skip to content

Cookies Policy

PLOS's cookies page now shows a full table of every cookie on its site: what it does, who provides it, and how long it lasts. The previous captured version had no such list. The table reveals that PLOS uses advertising cookies from Google that build targeted ads, session-recording and A/B testing cookies from Crazy Egg, and visitor-tracking cookies from HubSpot, some lasting up to two years. Nothing in the page says these practices are new — but for readers this is the first time the details are spelled out.

Your browsing on PLOS is shared with Google, Crazy Egg, HubSpot and CloudflareThe new table shows that outside companies place cookies on the PLOS site. Google Ads…

The new table shows that outside companies place cookies on the PLOS site. Google Ads cookies track what you do after seeing an ad and are used to show you targeted ads elsewhere. Crazy Egg and HubSpot receive information about how you use the site. This means a nonprofit research publisher's pages feed data to advertising and marketing companies. The page does not say these arrangements are new — but it is the first time they are laid out for readers.

“Registers a unique ID that identifies a returning user's device. Used for targeted ads.”

What you can do — Reject non-essential cookies in the PLOS cookie banner, and turn off ad personalization in your Google account at myadcenter.google.com.

DATA SHARING
Your session on the site can be recordedCrazy Egg cookies are described as tracking "a recording visitor session," which usually…

Crazy Egg cookies are described as tracking "a recording visitor session," which usually means your clicks, scrolling and mouse movements on the page are captured and replayed for the site owner. HubSpot's cookies also link your browsing history on the site to your identity once you fill in a form. That is more than simple visitor counting.

“Tracks a recording visitor session unique ID, host, and start time.”

What you can do — Decline analytics and marketing cookies in the consent banner, and turn on Global Privacy Control in your browser — the page lists a cookie that responds to it.

DATA COLLECTION
Some tracking cookies stay on your device for two yearsThe Google IDE advertising cookie and the ga and gid analytics cookies are each listed as…

The Google IDE advertising cookie and the ga and gid analytics cookies are each listed as being stored for 2 years. Several Crazy Egg and HubSpot cookies last 6 months to a year. That means a single visit can leave an identifier on your device that keeps linking your future visits together for a long time.

“| IDE | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Marketing | 2 Years | Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads and present targeted ads. |”

What you can do — Clear your browser cookies periodically, or block third-party cookies in your browser settings.

DATA RETENTION
20260702_rev01 → 20260811_rev01COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED
1### List of Cookies, Purpose, and Storage Periods
2
3Below is a list of cookies on the PLOS website, information about the cookie provider, type of cookie, its purpose, and its storage period.
+ ADDEDA full cookie table was added

The page now lists each cookie by name, who provides it, its type, how long it is stored, and what it is for. Cookies are split into first-party (set by PLOS) and third-party (set by outside companies).

4
5#### First Party
6
7| Cookie | Provider Information | Type | Storage Period | Purpose |
8| --- | --- | --- | --- | --- |
9| JSESSIONID | PLOS, USA | Strictly necessary | Session | Manages a user's authentication and session |
10| plos-device-detected | PLOS, USA | Strictly necessary | 2 Hours | Manages display of desktop and mobile interfaces |
11| CASTGC | Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043 USA
12[Privacy Policy](https://policies.google.com/privacy) | Strictly necessary | Session | Ticket-granting cookie to support authentication and single sign-on. |
13| CSRF-TOKEN | PLOS, USA | Strictly necessary | Session | Cross Site Request Forgery Token for site security. |
14| flanders\_session | PLOS, USA | Strictly necessary | Session | Reduces database calls by remembering data about the user as they click between pages on the PLOS website. |
15| plosDataLinkSurveyHush | PLOS, USA | Strictly Necessary | 24 Hours | Manages the number of times users are asked to opt-in to a survey. |
+ ADDEDSix PLOS-run cookies listed as strictly necessary

PLOS's own cookies handle login sessions, mobile vs. desktop layout, site security, and how often you get asked to join a survey. These are basic site-function cookies and last from a session up to 24 hours.

16
17#### Third-Party
18
19| Cookie | Provider Information | Type | Storage Period | Purpose |
20| --- | --- | --- | --- | --- |
21| IDE | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Marketing | 2 Years | Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads and present targeted ads. |
+ ADDEDGoogle advertising cookies disclosed, including targeted ads

The list names Google Ads cookies (IDE, NID, 1P_JAR, gads) that track what you do after seeing or clicking an ad and are used to show you targeted ads. The IDE cookie sticks around for 2 years.

22| NID | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Marketing | 6 Months | Registers a unique ID that identifies a returning user's device. Used for targeted ads. |
23| 1P\_JAR | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Marketing | 30 Days | Remembers preferences. |
24| gid | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Performance and Analytics | 2 Years | Collects information about how visitors use our website. Used to compile reports and improve the website. |
25| ga | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Performance and Analytics | 2 Years | Collects information about how visitors use our website. Used to compile reports and improve the website. |
+ ADDEDGoogle Analytics cookies disclosed

Cookies named ga, gid, dc_gtm, gat_master and gat_journalsMaster send Google information about how you move around the PLOS site. The ga and gid cookies are listed as lasting 2 years.

26| gads | Google Ads (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Marketing | 1 Year | Collects information about how visitors use our website. Used to compile reports and improve the website. |
27| GCLB | Google Cloud (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Strictly Necessary | Session | Maintains continuity of session when IP addresses may change. |
28| dc\_gtm | Google Analytics (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Performance and Analytics | 1 Minute | Collects information about how visitors use our website. Used to compile reports and improve the website. |
29| gat\_master | Google Analytics (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Performance and Analytics | 1 Minute | Collects information about how visitors use our website. |
30| wordpress\_test\_cookie | WordPress (Automattic, Inc.), 60 29th Street #343, San Francisco, CA 94110 USA [Privacy Policy](https://automattic.com/privacy/) | Strictly Necessary | Session | Tests whether WordPress can place cookies. Does not identify the user. |
31| gat\_journalsMaster | Google Analytics (Google LLC), 1600 Amphitheatre Parkway Mountain View, CA 94043 USA [Privacy Policy](https://policies.google.com/privacy) | Performance and Analytics | 1 Minute | Collects information about how visitors use our website. |
32| \_ceir, is\_returning | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 1 Year | Tracks whether a visitor has visited the site before. |
33| \_CEFT | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 1 Year | Stores page variants assigned to visitors for A/B performance testing. |
34| \_cer.s | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | Session | Tracks a recording visitor session unique ID, host, and start time. |
+ ADDEDCrazy Egg session recording and A/B testing cookies disclosed

Nine Crazy Egg cookies are listed. Some record your browsing session with a unique ID, some remember whether you have visited before (up to a year), and one checks whether the site's security rules would block tracking.

35| \_cer.v | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | Up to 31 Days | Tracks whether a visitor has visited the site before. |
36| \_ce.s | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 1 Year | Tracks a recording visitor session unique ID, host, and start time. |
37| \_ce.cch | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 1 Second | Used to check if cookies can be added. |
38| \_ce.gtld | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 1 Second | Used to identify the top-level domain. |
39| ce\_need\_secure\_cookie | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 1 Second | Used to determine cookie security parameters. |
40| ce\_successful\_csp\_check | Crazy Egg, 16220 Ridgeview Ln La Mirada, CA 90638, USA [Privacy Policy](https://www.crazyegg.com/privacy) | Performance and Analytics | 24 Hours | Determines if the page has a Content Security Policy rule that would prevent tracking. |
41| \_\_hs\_opt\_out | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#f787859e8196948eb79f829584879883d994989a) | Necessary | 6 month | This cookie is used by the opt-in privacy policy to remember not to ask the visitor to accept cookies again. |
42| \_\_hs\_do\_not\_track | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#6515170c1304061c250d100716150a114b060a08) | Necessary | 6 month | This cookie can be set to prevent the tracking code from sending any information to HubSpot. |
+ ADDEDCookies that remember your privacy choices are listed

Several HubSpot cookies exist specifically to honor your choices: one remembers you opted out, one can stop tracking data from being sent to HubSpot at all, one records which cookie categories you agreed to, and one remembers that you dismissed the Global Privacy Control banner.

43| \_\_hs\_initial\_opt\_in | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#4636342f3027253f062e3324353629326825292b) | Necessary | 7 days | This cookie is used to prevent the banner from always displaying when visitors are browsing in strict mode. |
44| \_\_hs\_cookie\_cat\_pref | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#31414358475052487159445342415e451f525e5c) | Necessary | 6 months | This cookie is used to record the categories a visitor consented to. |
45| \_\_hs\_gpc\_banner\_dismiss | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#d1a1a3b8a7b0b2a891b9a4b3a2a1bea5ffb2bebc) | Necessary | 180 days | This cookie is used when the Global Privacy Control banner is dismissed. |
46| \_\_hs\_notify\_banner\_dismiss | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#abdbd9c2ddcac8d2ebc3dec9d8dbc4df85c8c4c6) | Necessary | 180 days | This cookie is used when the website uses a Notify consent banner type. |
47| hs\_ab\_test | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#81f1f3e8f7e0e2f8c1e9f4e3f2f1eef5afe2eeec) | Necessary | End of the session | This cookie is used to consistently serve visitors the same version of an A/B test page they've seen before. |
48| \_key | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#91e1e3f8e7f0f2e8d1f9e4f3e2e1fee5bff2fefc) | Necessary | 14 days | When visiting a password-protected page, this cookie is set so future visits to the page from the same browser do not require login again. |
49| \_\_hsmem | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA[\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#3a4a48534c5b59437a524f58494a554e14595557) | Necessary | 7 days | This cookie is set when visitors log in to a HubSpot-hosted site. It contains encrypted data that identifies the membership user when they are currently logged in. |
50| hs-membership-csrf | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#addddfc4dbccced4edc5d8cfdeddc2d983cec2c0) | Necessary | End of the session | This cookie is used to ensure that content membership logins cannot be forged. |
51| \_\_cfruid |
52HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#e696948f9087859fa68e938495968992c885898b)
53
54Cloudflare, Inc. 101 Townsend St. San Francisco, CA 94107
55[\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#3f5b4f507f5c53504a5b59535e4d5a115c5052)
56
57 | Necessay | End of the session | This cookie is set by HubSpot's CDN provider because of their rate limiting policies. Learn more about Cloudflare cookies. |
58| \_\_cfuvid |
59
60HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#5b2b29322d3a38221b332e39282b342f75383436)
61
62Cloudflare, Inc. 101 Townsend St. San Francisco, CA 94107
63[\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#7612061936151a190312101a1704135815191b)
64
65 | Necessay | End of the session | This cookie is set by HubSpot's CDN provider because of their rate limiting policies. Learn more about Cloudflare cookies. |
66| \_\_cf\_bm |
67
68HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#b3c3c1dac5d2d0caf3dbc6d1c0c3dcc79dd0dcde)
69
70Cloudflare, Inc. 101 Townsend St. San Francisco, CA 94107
71[\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#6004100f20030c0f1504060c0112054e030f0d)
72
73 | Necessary | 30 minutes | This cookie is set by HubSpot's CDN provider and is a necessary cookie for bot protection. Learn more about Cloudflare cookies. |
+ ADDEDCloudflare bot-protection and CDN cookies disclosed

Three cookies set through HubSpot's content delivery network (Cloudflare) handle rate limiting and bot protection. Two of them are labeled with a typo, "Necessay" instead of "Necessary."

74| \_\_hstc | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#8ffffde6f9eeecf6cfe7faedfcffe0fba1ece0e2) | Performance and analytics | 6 months | The main cookie for tracking visitors. |
75| hubspotutk | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#3545475c4354564c755d405746455a411b565a58) | Performance and analytics | 6 months | This cookie keeps track of a visitor's identity. It is passed to HubSpot on form submission and used when deduplicating contacts. |
+ ADDEDHubSpot marketing and visitor-tracking cookies disclosed

HubSpot sets cookies that track visitors across the site for six months, tie your browsing to your identity when you submit a form, and manage logins to password-protected pages.

76| \_\_hssc | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#ec9c9e859a8d8f95ac84998e9f9c8398c28f8381) | Performance and analytics | 6 months | This cookie keeps track of sessions. |
77| \_\_hssrc | HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA [\[email protected\]](https://plos.org/cdn-cgi/l/email-protection#d6a6a4bfa0b7b5af96bea3b4a5a6b9a2f8b5b9bb) | Performance and analytics | End of the session | Whenever HubSpot changes the session cookie, this cookie is also set to determine if the visitor has restarted their browser |