Privacy

Food Additive Index is a reference work. There is no account to make to read it, nothing to log in to, no advertising, and nothing about you is sold or shared for anyone else's purposes. What follows is the whole of what happens when you read a page, and, separately, what is kept if you ask for a key to the data files.

What is collected

Every page loads Google Analytics (measurement id G-4L9SX380DV), which records that a page was viewed. It is here to answer one question: which of these pages anyone actually reads. That answer decides what gets written next, which on a site of1189 additive pages is a real question and not a pretext.

What it does depends on your choice (see below). Google receives the address of the page, the page that sent you to it if there was one, your browser and device type, and an approximate location worked out from your IP address; Google states that it does not store that address for Analytics.

• Accept all: Google sets two cookies on your device, _ga and a second beginning _ga_, which last two years by default and exist to tell a returning reader from a new one.
• Accept required, or no choice yet: the site tells Google it may not store anything on your device, and Google sets no cookies. Google's tag is still loaded, and Google describes what it then sends as a cookieless ping: the page view and the details above, with no identifier kept on your device to link one visit to the next. It uses these to model overall traffic.
• Global Privacy Control switched on in your browser: treated as Accept required, and you are not asked.

There is no advertising on this site. Analytics is not used for advertising, and the page tells Google's tag that advertising storage and ad personalisation are denied.

What is not collected

Nothing you type or photograph. The label lookup matches a pasted ingredients list, or a photograph of one, entirely inside your own browser: the text recognition engine, its WebAssembly core and its language data are served from this site and run on your own device. Neither the picture nor the text it produces is uploaded here or anywhere else. That is a property of how the page is built, described onHow this is built, and analytics does not change it.

This site sets no cookies of its own. It stores two things in your browser, and both stay there: your choice about analytics (one item in local storage, named fai-consent, holding “granted” or “denied”), and, if you use the photo reader on the label lookup, the text-recognition engine's English language data, which it may keep in the browser's own database so that a second photo does not download it again. Neither is sent anywhere. Reading the site asks for no name, no email address and no account. It has no comments and no newsletter. The one form that asks for personal details is the request for data access, described below.

The other requests a page makes

Only one, and it is not optional for anybody: Cloudflare serves this site, so it necessarily handles your request and sees the address it came from. It sets no cookies here; nor does this site.

Everything else a page needs comes from this site itself — the stylesheet, the typeface, the search index, the lookup data and the text-recognition engine. The typeface used to be fetched from Google Fonts, which meant handing Google your IP address on every page whether or not you had blocked analytics. It is now served from here, so blocking analytics blocks Google entirely.

Links to regulators

Nearly every fact on this site carries a link to the instrument it came from: the eCFR, EUR-Lex, legislation.gov.uk, Health Canada, the Federal Register of Legislation, e-Gov, FAO and WHO. Following one takes you to that body's own site, under its own terms and its own privacy practices, which are nothing to do with this one.

Your choice about cookies

The first time you visit, a box asks you to choose Accept required or Accept all. They are equal choices, and the whole site is open to you whichever you pick. The choice is kept in your browser so the box does not return. To change it, use Cookie choices in the footer of any page (it is on every page; reading this page without JavaScript does not show it, and without JavaScript no analytics cookie is ever set).

If you change from Accept all to Accept required, Google stops setting and reading its cookies from then on; cookies it has already set stay on your device until you delete them in your browser's settings. You can also block them in advance:

• Block third-party scripts, or googletagmanager.com specifically, in your browser or an extension.
• Refuse cookies for this site in your browser's settings.
• Install Google's own Analytics opt-out add-on.

Every page works identically with all of it blocked. Google Analytics does not act on a “Do Not Track” header, so setting one will not stop it; Global Privacy Control, which this site does act on, will.

Who holds what

This site holds no personal data about its readers — there is no database of visitors, no log of searches and no profile of anyone — with one exception, a request for data access (below). What Google collects through Analytics is held by Google, underits privacy policyand its own controls; a request about that data is one to make to Google, because this site cannot identify you in it and has nothing of yours to give back, correct or delete.

Asking for data access

The JSON records and the bulk CSV files are not open to everyone; they are given to people who ask, on the request page. That form is the only place this site asks for personal details. It collects:

• your name and email address, so the request can be answered;
• your organisation, if you give one;
• what you want the data for, which files you want, and whether the use is commercial;
• a one-way, salted hash of the network address the request came from. The address itself is not stored; the hash exists only so that one address cannot send a flood of requests in a day.

It is kept in a database on Cloudflare that belongs to this site, and is read by the person who runs it, who uses it to decide the request, to reply, to tie a key to its holder, and to check a use against the licences of the sources behind the rows. If you are approved, the number of times your key has been used and the date it was last used are recorded; which files you fetched are not. Nothing in it is sold, shared or used for any other purpose. To have your request removed, reply to the email you were sent about it, and it will be.

Changes

This notice is dated, like everything else here. It was last changed on18 October 2026, when the cookie choice was added: analytics cookies are now set only if you accept them. Before that, on 12 October 2026, data access by request was added, and on 26 September 2026 analytics were added. If what the site does changes, this page changes with it — and if this page ever disagrees with what the site actually loads, this page is the thing that is wrong.