Compliance Frameworks

CookieFrame supports multiple privacy compliance frameworks to help you meet legal requirements worldwide. Each framework has different consent requirements, default behaviors, and user interface elements.

Overview

Geo-Detection

CookieFrame automatically determines which framework to apply based on the user's location.

How It Works

1. User visits your site
2. CookieFrame reads geo headers from your CDN (Vercel, Cloudflare, AWS)
3. Country code maps to the appropriate framework
4. Correct consent UI and defaults are applied

Supported Headers

• x-vercel-ip-country
• cf-ipcountry (Cloudflare)
• cloudfront-viewer-country (AWS)

Disabling Geo-Detection

If you prefer to use a single framework for all visitors:

1. Go to Settings → Compliance
2. Disable Geo-targeting
3. Select your preferred framework

This is useful for region-specific sites where all visitors are from the same jurisdiction.

GDPR

The General Data Protection Regulation applies to users in the European Union, European Economic Area, and 27 additional countries with similar privacy laws.

Key Requirements

• Explicit consent before setting non-essential cookies
• Granular control over cookie categories
• Easy withdrawal of consent at any time
• Clear information about what cookies do and why

Covered Regions

EU member states, EEA countries (Norway, Iceland, Liechtenstein), plus:

• United Kingdom
• Switzerland
• Brazil (LGPD)
• Japan
• South Korea
• And others with adequacy decisions

Default Consent State

Banner Behavior

• Banner blocks non-essential scripts until consent
• Users must explicitly accept or configure preferences
• "Reject All" option must be equally prominent as "Accept All"

[SCREENSHOT PLACEHOLDER: GDPR consent banner example]

CCPA

The California Consumer Privacy Act (and similar US state laws) follows an opt-out model where cookies are allowed by default.

Key Requirements

• Opt-out option for sale/sharing of personal information
• "Do Not Sell or Share" link in footer
• Notice at collection about data practices
• Equal service regardless of opt-out choice

Covered Regions

• California (CCPA/CPRA)
• Virginia (VCDPA)
• Colorado (CPA)
• Connecticut (CTDPA)
• Utah (UCPA)
• And other US states with privacy laws

Default Consent State

Banner Behavior

• All cookies active by default
• Banner serves as notice, not consent gate
• Users can opt-out via preferences or "Do Not Sell" link

Do Not Sell Link

CCPA requires a "Do Not Sell or Share My Personal Information" link. Add it using:

<a href="#" data-cookieframe="do-not-sell">Do Not Sell or Share My Personal Information</a>

Or via JavaScript:

window.CookieFrame.doNotSell();

TCF 2.2

The IAB Transparency and Consent Framework version 2.2 provides granular consent management for advertising technology.

When to Use TCF

Enable TCF if you:

• Serve programmatic ads in the EU/EEA
• Work with ad tech vendors requiring TCF strings
• Need vendor-level consent tracking

Key Concepts

TCF Purposes

Special Features

CMP API

When TCF is enabled, CookieFrame exposes the standard __tcfapi interface:

__tcfapi('getTCData', 2, (tcData, success) => {
  if (success) {
    console.log('TC String:', tcData.tcString);
    console.log('GDPR applies:', tcData.gdprApplies);
  }
});

Consent Storage

TCF consent is stored in localStorage:

For detailed TCF configuration, see TCF Vendors.

Notice

The Notice framework is a simple acknowledgment mode for regions without specific consent requirements.

When Notice Applies

• Countries without cookie consent laws
• Internal tools or authenticated applications
• When you only use strictly necessary cookies

Default Consent State

Banner Behavior

• Single "I Understand" or "Got It" button
• No blocking of scripts
• Serves as notification only

[SCREENSHOT PLACEHOLDER: Notice banner example]

Framework Comparison

Configuration

Enable Frameworks

1. Go to Settings → Compliance
2. Enable the frameworks you need
3. Configure region assignments (if using geo-detection)

Framework Priority

When geo-detection is enabled, frameworks apply in this order:

1. TCF - If enabled and user is in TCF region
2. GDPR - If enabled and user is in GDPR region
3. CCPA - If enabled and user is in US state with privacy law
4. Notice - Fallback for all other regions

Custom Region Mapping

Override default region assignments:

1. Go to Settings → Compliance → Regions
2. Select a country
3. Choose which framework applies

This is useful for applying GDPR-style consent in countries without specific laws.

Google Consent Mode

CookieFrame automatically integrates with Google Consent Mode v2, mapping frameworks to Google's consent signals:

For setup instructions, see Google Tag Manager Integration.

Best Practices

1. Enable geo-detection for global sites to show appropriate consent UI
2. Use TCF only if you work with IAB-registered ad tech vendors
3. Test each framework using VPN or browser location spoofing
4. Review defaults to ensure they match your legal requirements
5. Consult legal counsel for jurisdiction-specific questions

Next Steps

• Consent Banner Design - Customize your banner appearance
• Cookie Scanning - Detect cookies on your site
• TCF Vendors - Configure IAB vendor consent
• Integrations - Install CookieFrame on your site