# Cookie and Advertising Choices — Draft

**Version:** `draft-2026-10-13-v1` · **Operator:** `[LEGAL ENTITY NAME]`

This notice must be completed using a live inventory of browser storage, mobile SDKs, pixels, ad tags, server-side event flows, and vendors. Do not say “we use no cookies” until browser and native-client scans verify it.

## Current engineering position

The web app uses an HttpOnly, SameSite refresh cookie for authentication. Essential security/session storage is used to provide a sign-in the user requests. The app does not currently have a verified, fully wired optional advertising/analytics consent manager. Third-party ad delivery is not to be enabled until provider policy, regional consent, age restrictions, and opt-out propagation have been verified. The exact live inventory must be confirmed for each deployed app.

## Categories

- **Essential:** authentication, account security, load balancing, fraud prevention, and remembering a privacy choice. These are used only as needed to provide the requested service or meet a legal requirement.
- **Preferences:** language and interface choices, if stored on the device.
- **Analytics:** optional measurement technologies, if later added; disabled until the required consent and controls work.
- **Advertising:** ad selection, measurement, and frequency controls, if later added; disabled until consent, provider and age policies, and opt-out signals work.

## User controls

Where consent is required, users must be able to reject optional categories as easily as accept them, change their choice later, and withdraw without losing unrelated core access unless a specific feature legally depends on the choice. Do not condition ordinary video access on accepting personalized advertising. Contextual/non-personalized advertising may still require local disclosures or choices and must follow provider rules.

## Implementation release gate

Before activating optional technologies: maintain an SDK/tag inventory and purpose map; classify technologies by market; block optional tags before consent; offer granular controls; record notice version, purpose, choice, timestamp, and jurisdiction basis; propagate withdrawal to browser, mobile SDKs, ad decisioning, and vendors; test reject-all, accept-selected, withdrawal, and child/age-restricted states; and review the flow with counsel. This notice itself does not implement those controls.