Why cookies are a compliance topic at all
Cookies and similar browser storage (localStorage, sessionStorage) can carry identifiers that make a visitor individually recognizable across visits or sites. Once that's possible, several privacy laws treat the cookie as personal-data processing that needs a lawful basis, disclosure, and often the visitor's consent before it happens.
GDPR (EU/UK) — the short version
- Strictly necessary cookies (e.g. session/auth, load balancing, shopping cart) generally don't require consent, but you should still disclose them.
- Analytics, marketing, and personalization cookies generally do require prior, informed, freely-given consent before they load — not just a notice banner that's ignored.
- Consent must be as easy to withdraw as it was to give, and "reject all" should be no harder to find than "accept all."
- Regulators expect a record of what was consented to and when.
CCPA/CPRA (California) — the short version
- Built around opt-out rather than opt-in for most cookies: the default is generally "on" until a visitor exercises their right to opt out of "sale" or "sharing" of personal information (which can include certain advertising/analytics cookies).
- Sites typically need a "Do Not Sell or Share My Personal Information" link or an equivalent, honored across the site.
- Global Privacy Control (GPC) signals are increasingly expected to be honored automatically.
Where a technical tool like CFT fits
CFT is not a law firm and does not generate jurisdiction-specific legal templates. What it does provide:
- Discovery — Deep Scan tells you what cookies and storage keys your site actually sets, including third-party trackers you may not know about, so you can classify them correctly.
- Technical blocking — the Managed CMP can hold non-essential scripts back until a visitor makes a choice, and re-enable them per category once consent is given.
- Security posture — independent of consent law, CFT flags cookies missing
Secure/HttpOnly/SameSite, which is a security hygiene issue regardless of jurisdiction.
What still requires your own (or your counsel's) judgment: correctly categorizing every vendor script, writing an accurate privacy policy and cookie disclosure, choosing opt-in vs. opt-out defaults per audience, and keeping consent records for the retention period your applicable law requires.
A practical starting checklist
- Run a Deep Scan and get a full inventory of first- and third-party cookies plus storage keys.
- Classify each finding: strictly necessary, analytics, marketing, or preferences.
- Decide your consent default (opt-in vs. opt-out) based on where your visitors are.
- Install the Managed CMP banner and map each category to the scripts it should hold back.
- Re-scan periodically — new marketing tags and analytics snippets get added to sites constantly, and consent categorization drifts out of date.