Production cookies must be inventoried by name, provider, purpose, duration and category.
Strictly necessary security/session cookies may be required for service operation. Analytics, personalization and advertising technologies must be enabled only under the consent/lawful-basis rules applicable to the user’s jurisdiction. Rejecting optional technologies must be as practical as accepting them where consent is required.
The consent manager must store the policy version, user choice, timestamp and jurisdiction context and allow later withdrawal.