Sklik, Heureka, Smartsupp and Smartlook: which cookies they set and where they belong in your banner

Open the cookie policies of ten Czech e-shops and you will find Google Analytics, Facebook Pixel and Hotjar. You will almost never find Sklik, Heureka or Smartsupp. Yet those three sit on more Czech sites than Hotjar does. The reason is simple: policy generators and cookie databases are written for the US market and have never heard of Czech services. We had to dig this up ourselves when we added them to our scanner. For each service we list what it stores, for how long, and which banner category it belongs in. Where the vendor does not document something, we say so.

Why it matters

The Czech Electronic Communications Act (section 89(3)) has required consent before storing anything non-essential since January 2022. An inspection by the Czech data protection office compares three things: what the banner says, what the policy says, and what the browser actually stores. If Sklik retargeting runs on your site and the policy never mentions it, that is the easiest discrepancy to find.

Then there is the category. A cookie in the wrong category either runs without consent (if you file it as necessary) or drops out of your measurement for no reason (if you file the chat under marketing and the visitor rejects marketing).

Sklik and Seznam retargeting

The Sklik retargeting code loads c.seznam.cz/js/rc.js and calls rc.retargetingHit(). The cookies live on the seznam.cz domain, so they are third-party. Seznam's documentation names two: sid (a user identifier across Seznam services) and udid (a device identifier). Seznam does not publish their lifetime anywhere. Write "per Seznam.cz settings" in your policy and do not invent a number.

Category: marketing. No debate. The retargeting code takes a consent parameter (1 or 0) and Sklik's help centre says it should receive 0 without consent. In Consentio you enter the retargeting ID in settings and the banner sends the right value itself. If you paste the code by hand, wrap it in a blocked script:

<script type="text/plain" data-category="marketing" src="https://c.seznam.cz/js/rc.js"></script>
<script type="text/plain" data-category="marketing">
  window.rc.retargetingHit({ rtgId: 12345, consent: 1 });
</script>

Heureka conversion measurement

Heureka's conversion measurement uses the cookie hg_ocm_id, which stores the click identifier from Heureka on your domain so an order can be attributed to its source. Heureka's help centre calls it analytical. We file it under marketing, because it measures the performance of a paid channel and regulators see that as an advertising purpose. Either is defensible. What is not defensible is filing it as necessary, because the order goes through exactly the same without it.

Heureka's "Verified by customers" programme is a separate matter. It uses a different key and sends the customer's email to Heureka after checkout. That is not a cookie but a transfer of personal data to a third party. It belongs in your privacy policy and is handled at checkout under Heureka's own rules, not in the cookie banner.

Smartsupp

The Smartsupp chat stores two cookies: ssupp.vid (visitor identifier) and ssupp.visits (visit counter). Cookie catalogues list a lifetime of roughly six months; Smartsupp's own help centre does not state one. Both exist so the chat recognises a returning visitor and picks up an open conversation.

Category: functional. The chat gives the visitor something, and without the cookie it would greet them as a stranger on every visit. One caveat: Smartsupp can also record sessions. If that is switched on, it is the same case as Smartlook below and belongs under analytics.

Smartsupp has its own cookie consent switch in the admin. When it is on, the chat stores only necessary cookies until consent and deletes the visit counter after a rejection. Turn it on. Then all the banner has to do is start the chat script after consent to functional cookies.

Smartlook

Smartlook records what the visitor does on the page: mouse movement, clicks, scrolling, form input. It stores the cookie SL_C_23361dd035530_SID and a local storage copy SL_L_23361dd035530_SID, both for 13 months. That is one of the few things this vendor documents precisely.

Category: analytics. And because a recording can contain anything the visitor typed into a form, treat this as personal data in full, not anonymous statistics. Smartlook can mask form fields. Switch that on before you touch the banner.

Leady

Leady guesses which company a visitor came from, based on IP address and behaviour. It stores leady_session_id, a session cookie that disappears when the browser closes. A short lifetime does not make it necessary. The purpose is purely commercial, so marketing.

YouTube and Google Maps: the cookies everyone forgets

An embedded YouTube video sets VISITOR_INFO1_LIVE (6 months) and YSC (session) once played, both on youtube.com and both used by Google for advertising among other things. An embedded map sets NID for 6 months, a preferences and advertising cookie. On a restaurant or clinic website with no other marketing, this is often the only reason the banner needs a marketing category at all.

Two ways out. For YouTube use the youtube-nocookie.com domain; nothing is stored until the visitor presses play. Or block the iframe until consent:

<iframe data-src="https://www.youtube-nocookie.com/embed/VIDEO_ID" data-category="marketing"></iframe>

Consentio loads the iframe only after consent to that category. The same works for the map.

Everything in one table

What to do in the next ten minutes

1. Open your site in a private window, then DevTools, the Application tab, Cookies. Walk through the pages with a chat, a video or a map. You will see what is really stored.
2. File each service from the table into a category and check that its script only starts after consent. Sklik and Smartsupp have their own settings for this; for the rest use a blocked script or iframe.
3. Add them to your cookie policy with their lifetime. Where the vendor does not publish one, say so.

The Consentio scanner recognises these Czech services and adds the cookies from the table to your inventory and policy by itself. What it cannot see are cookies that appear only after someone clicks play or opens the chat. Check those by hand, per step one. And if you want the rest covered too, go through the cookie compliance checklist.