Guides & Documentation
Everything you need to implement cookie consent on your website
Showing 203 guides in Compliance
Cookie Consent for Telecom and ISP Websites
The EU cookie law started as a telecoms rule. Telecom operators and ISPs carry a double obligation: consent for cookies on their websites, and consent for the traffic and location data their networks generate. Here's how to handle both.
GPP, MSPA & US State Signals: A Publisher's Guide
The US Privacy String you built for CCPA was deprecated in January 2024. GPP, the US National string, and the MSPA replaced it, and getting the signal wrong can be a misrepresentation. Here's how the new US privacy signals move through the ad stack.
Cookie Consent for Online Marketplaces and Multi-Vendor Platforms
A marketplace tracks two audiences at once, buyers and sellers, and the platform and its sellers can end up as joint controllers of the same data. Here's how multi-vendor platforms handle cookie consent, controller roles, and the DSA's advertising limits.
Laravel Cookie Consent: Blade Setup Guide 2026
Laravel renders Blade on the server, so the tag your team pasted into the master layout head fires on every request before consent. Here's how to control script placement with Blade stacks, gate server-side tracking, and read a JS-set consent cookie past Laravel's cookie encryption.
Implementing the IAB GPP __gpp() API
How the Global Privacy Platform's __gpp() function actually works: the six synchronous generic commands, the PingReturn object, applicableSections, and why the stub has to load first.
Data Portability Requests: What You Actually Have to Provide
Data portability is the most misunderstood data subject right. It is narrower than access, it only covers certain data, and a scanned PDF does not count. Here is exactly what GDPR Article 20 requires, what to leave out, and how the CCPA version differs.
Is Your Analytics Vendor a Controller or Processor?
When you run Google Analytics, is Google acting on your instructions or its own? The answer decides who's liable, what contract you need, and whether the setup is even lawful. It varies by vendor, and sometimes by a single checkbox.
Cookie Data Retention: How Long Should You Keep the Data?
GDPR's storage limitation principle says personal data can't sit around forever. This guide covers how long cookies should live, how long the data they collect can be kept, and how to write a retention schedule that survives a regulator's question.
Consent Receipts and ISO/IEC 27560: A Standard for Provable Consent
GDPR Article 7 says you must be able to demonstrate consent. ISO/IEC 27560 gives that record a defined structure, and a receipt you can hand back to the user. Here's what the standard covers and how to use it without over-engineering.
The California Delete Act and DROP: 2026 Data Broker Rules
California's Delete Act lets consumers erase their data from every registered broker with one request through DROP. Here is how it works, who counts as a broker, and the 2026 deadlines.
YouTube & Vimeo Embeds: Consent Without Breaking Video
A standard YouTube or Vimeo embed connects to Google or Vimeo and sets storage before the visitor does anything. Here is how to gate video embeds properly, including what youtube-nocookie and dnt=1 actually do.
Virginia VCDPA Cookie Compliance for 2026
Virginia was the second state after California to pass a broad consumer privacy law, live since January 1, 2023. It uses an opt-out model, requires opt-in for sensitive data, and, unlike Colorado or Texas, does not make you honor the Global Privacy Control.
Cookie Consent for Video Game Studios
Epic Games paid $520 million to the FTC over Fortnite, and Genshin Impact's developer paid $20 million in 2025. Here's how game studios handle cookie consent on their marketing sites, web stores, and account pages, with COPPA and age-gating built in.
Verifying a Data Subject's Identity for a Privacy Request
Verify too little and you hand someone's data to an impostor. Verify too much and you break the law you are trying to follow. This is how to set the identity bar correctly under GDPR and the CCPA, including the requests where you are not allowed to verify at all.
Answering Vendor Privacy Questionnaires Without the Panic
Enterprise deals stall on a spreadsheet: the security and privacy questionnaire. Here's what SIG and CAIQ ask, which documents actually close the loop, and how the cookie consent questions get answered from your logs instead of a guess.
Utah UCPA Cookie Compliance: The 2026 Guide
Utah wrote the most business-friendly privacy law in the country. Live since December 31, 2023, the UCPA skips the universal opt-out mandate, asks only for notice-and-opt-out on sensitive data, and covers far fewer companies thanks to a $25 million revenue gate.
Universal Opt-Out Mechanisms: Which States Require Them
A universal opt-out mechanism lets people opt out of data sales across every site at once. Roughly a dozen states now make honoring one legally mandatory. Here is the map and how to comply.
Turkey KVKK Cookie Consent: 2026 Guide
Turkey's data authority published dedicated cookie guidance in June 2022 and amended the underlying law in 2024. Here's how the KVKK treats cookies: explicit consent by default, two narrow exceptions, and what the reforms changed.
Thailand PDPA Cookie Consent: 2026 Rules
Thailand's PDPA has been fully enforceable since June 2022, and the PDPC moved to active enforcement in 2024 and 2025. Here's how the law treats cookies: explicit opt-in consent, no implied consent from browsing, and records you have to keep.
Texas TDPSA Cookie Compliance: The 2026 Rules
Texas has no cookie-banner law. It has the TDPSA (live since July 1, 2024), a universal opt-out mandate that turned on January 1, 2025, and an attorney general running one of the most aggressive privacy enforcement operations in the country.
How to Test Your Cookie Banner Is Compliant
A 2023 study found most EU cookie banners still fail. Building one right and verifying it works are different jobs. This is the QA pass you run after launch: the network-tab tests, the button rules, and the signals that trip up real audits.
The TCF and GPP Stub: Async Loading Done Right
Vendor scripts call the CMP API before the CMP finishes loading. The stub is what keeps those early calls from throwing. Here's how the stub, the locator iframe, and the command queue work together.
TCF and Google Additional Consent Explained
Google runs ad tech partners that aren't on the IAB Global Vendor List, so TCF alone can't signal consent for them. The Additional Consent (AC) string fills the gap. Here's the format and how a CMP produces it.
Managing the TCF Global Vendor List (GVL)
The Global Vendor List is a large JSON document that changes weekly. Here's how to load it without slowing every page, why the slim and full variants exist, and how the version field ties back to the TC String.