← Trust Center

How CookieHug processes consent data

Last updated: August 10, 2026

Below is a step-by-step description of what happens to the data from the moment a visitor sees the consent banner on a Client’s website to the consent record available in the CookieHug panel.

Data flow, step by step

  1. A visitor opens the Client’s website.
  2. The CookieHug script loads (the consent banner SDK).
  3. The visitor makes a choice in the banner.
  4. The choice is stored in the visitor’s own browser — in the first-party CookieHugConsent cookie (valid for 30 days) and in localStorage together with the Consent Mode signals.
  5. A consent record reaches CookieHug — with the contents described below.
  6. The Client reviews and exports the records — in the panel, as CSV/NDJSON exports, or via the API.
Field Details
Event type the type of consent event registered by the SDK
Consent categories analytics, marketing, preferences
Region e.g. “EEA”, “PL”, “US-CA” — derived from Cloudflare geolocation headers, not from the IP address on our side
Device type desktop, mobile or tablet — determined from the window width, not from the user agent
Consent method how the visitor made their choice
Language the banner language
Banner variant the banner variant shown to the visitor
GPC/DNT signals yes/no — whether the browser sent a Global Privacy Control or Do Not Track signal
Time to decision the time from the banner being shown to the choice being made
Timestamp the date and time of the event
Blocked services the number and list of blocked services

What a record does NOT contain

A consent record on the CookieHug side does not contain:

  • the IP address — in any form: full, truncated, or hashed,
  • the user agent,
  • a visitor identifier — the UUID generated by the SDK stays exclusively in the visitor’s browser and is never transmitted to CookieHug,
  • the URL of the visited page,
  • the raw Google signals string.

As a result, the records stored on the CookieHug side cannot be used to identify a person.

Based on the visitor’s choice, the SDK sets the Google Consent Mode v2 signals in the visitor’s browser: analytics_storage, ad_storage, ad_user_data and ad_personalization, as well as functionality_storage, personalization_storage and security_storage.

Retention and deletion of records

Raw consent records are kept for 90 days, and the Client can export them throughout that entire period. Records are deleted together with the deletion of the domain or account, and also on request — within 30 days.

Roles of the parties

With respect to consent records, the Client is the data controller and CookieHug (Alfabet Marki Sp. z o.o.) is the data processor. The details are set out in the data processing agreement (DPA). More information: the Trust page.

Language: English