When I visit the ICO site I also get a "civicCookieControl" cookie which you don't list. I guess that this is probably coming from javascript and your site isn't processing this?
I'd be interested in the solutions you used to solve issues like that if it's not proprietary / private.