COOKIE CONSENT & GLOBAL PRIVACY CONTROL PACKAGE

1. Overview Statement (for Privacy Policy)

We use cookies and similar technologies to operate our Services, analyze traffic, personalize content, and support advertising. You can manage your preferences through our Cookie Settings tool or by submitting a Global Privacy Control (“GPC”) signal in compatible browsers.

2. Consent Banner Copy Variants

2.1 First-Layer Banner (Web)

Headline: We respect your privacy

Body: We and select partners use cookies to make our site work, improve performance, and deliver personalized offers. Choose “Accept All” to consent to all cookies, “Reject Non-Essential” to use only strictly necessary cookies, or “Customize Choices” to adjust your preferences. We honor browser-based Global Privacy Control signals. For details, see our [Privacy Policy] and [Cookie Notice].

Buttons:
- Accept All (primary)
- Reject Non-Essential (secondary)
- Customize Choices (link button)

[// GUIDANCE: Ensure no pre-ticked boxes; provide equal prominence per state guidance.]

2.2 Second-Layer Preferences Modal

Organize categories and default states:

Provide a “Save Choices” button and an “Accept All” button within the modal.

2.3 Mobile SDK Prompt

Include a concise prompt that links to the full preferences center and recognizes device-level tracking settings (iOS ATT/Android Privacy Sandbox).

3. Global Privacy Control & Universal Opt-Out Handling

1. Detect Sec-GPC headers or navigator.globalPrivacyControl signals on page load.
2. Treat a valid signal as an opt-out of sales/sharing and targeted advertising for that browser session, honoring universal opt-out requests for Colorado and Texas users without requiring additional clicks.
3. Log the opt-out in your consent database with timestamp, IP hash, and browser agent for audit purposes.
4. Sync the opt-out signal across subdomains and authenticated user profiles within 24 hours.
5. Provide a confirmation banner stating: “We received your Global Privacy Control signal and updated your preferences.”

4. Do Not Sell/Share & Opt-Out Links

Place persistent footer links labeled: “Do Not Sell or Share My Personal Information,” “Manage Cookies,” and “Limit Use of Sensitive Personal Information” (California). Link each to the preferences modal or opt-out form.

5. Email & SMS Disclosure Language

Include the following statement in marketing communications:

You are receiving this message because you subscribed to updates from [COMPANY NAME]. We respect opt-out signals, including Global Privacy Control. To manage preferences, visit [LINK] or call [TOLL-FREE NUMBER].

6. Recordkeeping Checklist

• [ ] Maintain change logs of banner copy, styling, and functionality.
• [ ] Capture consent receipts with consent type, timestamp, and IP hash.
• [ ] Retain audit records for at least [YEARS] years or the period required by applicable law.
• [ ] Review vendor contracts to confirm downstream honoring of opt-out signals.

7. Implementation Notes for Developers

• Load consent management script asynchronously to avoid blocking.
• Ensure that tracking scripts for non-essential cookies fire only after affirmative consent.
• Provide API endpoints to update preferences when users change settings from their account pages.
• Test cross-device synchronization and ensure opt-out persists after login.

8. Attachments

• Annex A: Sample JSON structure for consent receipt records.
• Annex B: Screenshot placeholders for banner variants.
• Annex C: QA test plan covering multiple browsers, devices, and repeat visits.
• Annex D: Accessibility checklist (WCAG 2.1 AA) for modal interactions.

[// GUIDANCE: Review state AG enforcement updates quarterly and refresh copy accordingly.]