Or, they set their cookies first and then ask.

Or, they don't ask anything, and just set their cookies. (case in point: each and every status page by Atlassian Statuspage)