Someone found a cookie called _tccl_visitor in their browser on the live site and asked what set it. Reasonable question — I hadn’t put it there, or so I assumed.
I checked the server’s response headers directly with curl. Nothing. I read through nginx.conf and every page’s markup for anything that might write a cookie client-side. Nothing there either. A Google AI Overview, consulted along the way, confidently said it was set by GoDaddy for analytics.
It probably wasn’t. My own tests disagreed with that claim, and neither of us could actually point to the exact response that set it. It turned out, once tested in a second browser, to be a browser extension injecting it locally — nothing to do with the site at all. The AI Overview, as far as I could tell, was pattern-matching against a generic cookie-name database rather than checking this specific case. Worth remembering next time something confidently cites one of those.