QuarterLink cookies

Cookie Policy

The essential cookies and browser storage QuarterLink uses for account access, HMRC connection, fraud-prevention data, billing, support, and cookie preferences.

Last updated: 15 June 2026

Legal centre

Essential-first

The current public banner is for essential service cookies and preference storage. Marketing analytics cookies are not added by this policy.

HMRC browser data

Some browser details support HMRC fraud-prevention headers when an HMRC workflow needs them.

Stripe-hosted payments

Stripe may set cookies on hosted checkout, invoice, and billing portal pages. Stripe notices apply there.

On this page

Cookies and storage we use

Authentication and session cookies	Keep users signed in, protect account areas, and clear on logout or expiry according to the authentication flow.
HMRC OAuth state cookie	Protects HMRC connection callbacks from state mismatch attacks during the HMRC sign-in flow.
Integration OAuth state cookies	Protects Google Drive or other integration callbacks from state mismatch attacks when those integrations are enabled.
MFA and step-up state	Records recent verification state for protected actions such as HMRC workflows and account security operations.
hmrc_device_id	Stores a browser/device identifier for HMRC fraud-prevention header support. Current implementation uses up to one year.
hmrc_browser_fph	Stores browser capability details used for HMRC fraud-prevention header support. Current implementation uses up to one day.
cookie-consent localStorage value	Remembers that the public cookie notice has been acknowledged so the banner does not keep reappearing.
Stripe hosted-flow cookies	Stripe may set cookies for checkout, customer portal, invoice payment, fraud prevention, and payment security on Stripe-hosted pages.

Why essential cookies are needed

To keep account sessions secure.
To protect HMRC, Google Drive, billing, and integration connection flows.
To remember security step-up state for protected actions.
To support HMRC fraud-prevention headers where the workflow requires browser/request context.
To remember the cookie notice choice.

Analytics and marketing cookies

QuarterLink does not add marketing analytics cookies through the current public cookie banner. If optional analytics or marketing cookies are introduced later, QuarterLink will explain the choice before those cookies are used.

Managing cookies

You can clear cookies in your browser. Clearing essential cookies may sign you out, interrupt HMRC or integration connection flows, or require MFA/HMRC verification again.

Related QuarterLink pages

Privacy Notice Terms and Conditions Security and Data Protection Profile

Useful sources

GOV.UK MTD Income Tax dates GOV.UK MTD software guidance ICO right to be informed ICO cookies guidance