Cookie Consent Banner & Global Privacy Control Implementation Pack

COOKIE CONSENT & GLOBAL PRIVACY CONTROL IMPLEMENTATION PACKAGE

Organization: [________________________________]
Effective Date: [__/__/____]
Document Owner: [________________________________]
Version: [____]

TABLE OF CONTENTS

1. Overview and Legal Framework
2. Consent Banner Copy — Multi-Variant
3. Preferences Center / Second-Layer Modal
4. Global Privacy Control (GPC) and Universal Opt-Out Handling
5. "Do Not Sell or Share" and Opt-Out Links
6. State-by-State Compliance Matrix
7. Email and SMS Disclosure Language
8. Recordkeeping Requirements
9. Implementation Notes for Developers
10. Accessibility Requirements
11. Testing and QA
12. Governance and Review
13. Annexes

1. OVERVIEW AND LEGAL FRAMEWORK

1.1 Purpose

This package provides the policies, copy, technical requirements, and implementation guidance for cookie consent banners, preference management, and Global Privacy Control (GPC) signal recognition to comply with U.S. state privacy laws. Multiple states now require recognition of universal opt-out mechanisms (UOOMs) as valid consumer requests to opt out of the sale of personal data, sharing for cross-context behavioral advertising, and/or targeted advertising.

1.2 Legal Framework

1.3 Privacy Policy Statement

Insert the following (or substantially similar language) into your Privacy Policy:

We use cookies and similar tracking technologies to operate our Services, analyze traffic, personalize content, and support advertising. You can manage your preferences through our Cookie Settings tool. We honor browser-based Global Privacy Control ("GPC") signals and other universal opt-out mechanisms. When we detect a valid opt-out preference signal, we treat it as a request to opt out of the sale or sharing of personal information and targeted advertising for that browser or device. For details, see our [Cookie Notice] and [Privacy Policy].

2. CONSENT BANNER COPY — MULTI-VARIANT

2.1 First-Layer Banner (Web — Desktop/Mobile)

Headline: Your Privacy Choices

Body:

We and our partners use cookies and similar technologies to provide our services, understand how you use our site, and deliver relevant content and advertising. Choose "Accept All" to consent to all cookies, "Reject Non-Essential" to use only strictly necessary cookies, or "Manage Preferences" to customize your choices.

We honor Global Privacy Control signals and other universal opt-out mechanisms. [Learn more in our Privacy Policy].

Buttons (equal visual prominence):

Implementation Notes:
☐ No pre-ticked boxes or pre-selected non-essential categories
☐ "Reject Non-Essential" button must have equal visual prominence to "Accept All" per CA AG and CO AG guidance
☐ Banner must not use dark patterns (manipulative design, confusing language, asymmetric choices)
☐ Banner must be dismissible; dismissal without affirmative action = no consent for non-essential cookies

2.2 First-Layer Banner (Mobile App)

Body (concise version):

We use cookies and tracking technologies. Manage your preferences or learn more in our [Privacy Policy]. We honor Global Privacy Control signals.

Buttons:

• Accept All
• Reject Non-Essential
• Manage Preferences

2.3 Returning Visitor Banner

For returning visitors who have previously set preferences:

Body: Your cookie preferences are saved. You can update them at any time. [Manage Preferences]

3. PREFERENCES CENTER / SECOND-LAYER MODAL

3.1 Cookie Categories and Defaults

3.2 Additional Opt-Out Controls

3.3 Modal Buttons

4. GLOBAL PRIVACY CONTROL (GPC) AND UNIVERSAL OPT-OUT HANDLING

4.1 Detection

On every page load, the application shall check for:

☐ Sec-GPC: 1 HTTP header
☐ navigator.globalPrivacyControl === true JavaScript API
☐ Other recognized universal opt-out mechanism signals as designated by applicable state regulations

4.2 Processing Logic

When a valid GPC or UOOM signal is detected:

4.3 GPC and Authenticated Users

☐ When a user with a GPC signal logs in, apply the opt-out to their authenticated profile
☐ If the authenticated profile previously consented to sale/sharing, the GPC signal takes precedence unless the user re-affirms consent with a specific, informed action (per 11 CCR § 7025)
☐ Document any conflicting consent/GPC signal scenarios

4.4 GPC and Third-Party Tags/Pixels

☐ When GPC is detected, suppress loading of all third-party tags/pixels classified as "advertising" or "targeting"
☐ Notify advertising partners via contractual obligations that GPC signals must be honored downstream
☐ Ensure server-side tracking (if any) also respects GPC signals

5. "DO NOT SELL OR SHARE" AND OPT-OUT LINKS

5.1 Required Footer Links

The following links must be persistently visible in the website footer and accessible from all pages:

5.2 Combined Link Option

Per CCPA/CPRA § 1798.135(a)(3), businesses may use a single, clearly labeled link titled "Your Privacy Choices" or "Your California Privacy Rights" combined with a recognizable opt-out preference icon, provided it leads to a mechanism allowing consumers to exercise all applicable opt-out rights.

5.3 Mobile App

☐ Include opt-out controls in app settings
☐ Recognize device-level tracking settings (iOS App Tracking Transparency; Android Privacy Sandbox)
☐ Provide "Do Not Sell or Share" toggle within app privacy settings

6. STATE-BY-STATE COMPLIANCE MATRIX

7. EMAIL AND SMS DISCLOSURE LANGUAGE

Include the following in marketing communications:

You are receiving this message because you subscribed to updates from [________________________________]. We respect opt-out signals, including Global Privacy Control. To manage your privacy preferences, visit [PREFERENCES LINK]. To unsubscribe from marketing emails, click [UNSUBSCRIBE LINK] or call [________________________________].

8. RECORDKEEPING REQUIREMENTS

8.1 Consent Records

☐ Maintain consent receipts including: consent type (accept/reject/partial), timestamp, anonymized identifier, browser/device information, GPC signal status, consent version
☐ Retain records for at least [____] years or the period required by applicable law
☐ Store records in a format accessible for regulatory inquiry

8.2 Change Logs

☐ Maintain change logs for banner copy, styling, functionality, and preference options
☐ Document version history with dates of deployment
☐ Retain screenshots/recordings of each banner version

8.3 Vendor Contracts

☐ Review and document vendor/ad partner contracts for downstream GPC/opt-out signal honoring
☐ Maintain records of vendor certifications regarding opt-out compliance

9. IMPLEMENTATION NOTES FOR DEVELOPERS

9.1 Consent Management Platform (CMP)

9.2 Cookie Categorization

☐ Audit and categorize all cookies, pixels, and tracking technologies
☐ Maintain a cookie inventory with: name, provider, category, purpose, duration, type (first-party/third-party)
☐ Update inventory quarterly or upon adding new tracking technologies

9.3 GPC Implementation

// Detect GPC signal
const gpcEnabled = navigator.globalPrivacyControl === true ||
                   document.cookie.includes('Sec-GPC=1');

if (gpcEnabled) {
    // Suppress advertising/targeting cookies
    // Record opt-out in consent database
    // Display confirmation message
}

9.4 Cross-Device Synchronization

☐ Sync consent preferences across subdomains via shared cookie or server-side state
☐ When user authenticates, apply account-level preferences across devices
☐ Ensure opt-out persists after browser restart and cookie clearing (for authenticated users)

10. ACCESSIBILITY REQUIREMENTS

10.1 WCAG 2.1 AA Compliance

☐ Banner and modal must meet WCAG 2.1 Level AA standards
☐ All interactive elements keyboard navigable
☐ Screen reader compatible (proper ARIA labels and roles)
☐ Sufficient color contrast (4.5:1 minimum for text)
☐ Focus management: focus moves to modal when opened, returns when closed
☐ Banner must not obscure critical page content or navigation
☐ Toggle switches must have clear on/off state indicators

11. TESTING AND QA

11.1 Test Plan

12. GOVERNANCE AND REVIEW

13. ANNEXES

Annex A: Sample Consent Receipt JSON Structure

{
  "consent_id": "uuid-v4",
  "timestamp": "ISO-8601",
  "anonymized_id": "sha256-hash",
  "gpc_signal": true,
  "consent_version": "2.1",
  "categories": {
    "strictly_necessary": true,
    "performance": false,
    "functional": false,
    "advertising": false,
    "social_media": false
  },
  "opt_outs": {
    "do_not_sell_share": true,
    "limit_sensitive_pi": false,
    "targeted_advertising": true
  },
  "user_agent": "browser-agent-string",
  "jurisdiction_detected": "CA"
}

Annex B: Cookie Inventory Template

Annex C: QA Test Checklist

☐ Banner displays on first visit (no prior consent)
☐ "Reject Non-Essential" blocks all non-essential cookies
☐ "Accept All" enables all categories
☐ "Manage Preferences" opens modal
☐ GPC signal detected and opt-out applied
☐ Confirmation message displayed for GPC
☐ Consent persists across page navigation
☐ Opt-out syncs to authenticated profile
☐ Footer links functional
☐ Accessibility: keyboard navigation, screen reader

Annex D: Accessibility Checklist (WCAG 2.1 AA)

☐ Keyboard navigable
☐ ARIA labels on all interactive elements
☐ Focus trapping in modal
☐ Color contrast ≥ 4.5:1
☐ Toggle state announced to screen readers
☐ Escape key closes modal

SOURCES AND REFERENCES

• CCPA/CPRA, Cal. Civ. Code § 1798.120, § 1798.135
• 11 CCR § 7025 (Opt-Out Preference Signals)
• Colorado Privacy Act, C.R.S. § 6-1-1306; 4 CCR 904-3, Rule 5.11
• TDPSA, Tex. Bus. & Com. Code § 541.055(e)
• CTDPA, Conn. Gen. Stat. § 42-518(b)
• Montana MCDPA, Mont. Code Ann. § 30-14-2805
• Oregon OCPA, ORS § 646A.576
• Delaware DPDPA, 6 Del. C. § 12D-106
• Global Privacy Control Specification, https://globalprivacycontrol.org
• CA AG Enforcement Advisory on Dark Patterns (Mar. 2024)

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.