---
doc_id: POL-COOK-001
title: Cookie Notice (website) — draft with drafting notes
type: policy-public
status: draft
version: 0.3
created: 2026-09-25
last_reviewed: 2026-09-25
next_review: 2026-10-09
law_checked: 2026-09-25 (UK PECR reg. 6 and Sch. A1 as substituted by the Data (Use and Access) Act 2025 read by AI reviewer — Reported; 11 CCR §7025 partly; ePrivacy Art. 5(3) not opened)
owner: Marketing Lead (named person TBD) with Legal Lead
reviewers: [hidzo-counsel-reviewer (AI), EU/UK privacy counsel, U.S. privacy counsel]
counsel_needed: yes
counsel_status: none
jurisdictions: [EU, UK, CH, US-CA, US-FL, GLOBAL]
related: [POL-PRIV-002, POL-ID-001, BRF-2026-001]
sources: [EV-001, EV-006, EV-212, EV-233, EV-237]
supersedes: POL-COOK-001 v0.2 (2026-09-25)
print: true
confidentiality: INTERNAL — LEGAL (Part B becomes PUBLIC on publication)
---

# Cookie Notice — draft

> **Prepared for review by licensed counsel. Not legal advice.** Part B is the proposed public text; Parts A and C are internal. The cookie
> table **cannot be completed** until the Google Tag Manager container is exported and a production cookie scan is run (EV-212). No cookie may
> be listed from assumption.

## Part A — Drafting brief (internal)

| Item | Value |
|---|---|
| Question presented | Which cookies and similar technologies does the HidzoVPN website use, for what purpose and for how long, and how can visitors control them? |
| Known facts | Google Tag Manager container GTM-PMPZP23K observed on the website (EV-006, Level B, not snapshotted); no consent banner observed (RSK-007); the published Privacy Policy says "We do not use cookies for advertising or third-party tracking" (CLM-021), in EN, AR, TR and ID versions |
| App SDK storage | Storage of or access to information on devices by app SDKs is covered in the Privacy Policy §8 (POL-PRIV-002 v2.3), not here |
| Legal drivers | ePrivacy Directive Art. 5(3) (EEA); UK PECR reg. 6 and Sch. A1 as substituted by the Data (Use and Access) Act 2025, in force 5 Feb 2026 (Reported); CCPA opt-out and GPC (11 CCR §7025, §7026) if the CCPA applies; wiretap and pen-register claims over website tags (California and Florida) |

## Part B — Proposed public text

# Cookie Notice

**Last updated:** `[OPEN: date]`

This notice explains how HidzoVPN, Inc. uses cookies and similar technologies on hidzovpn.com and its subdomains `[OPEN: list other domains,
e.g. help center]`. Our apps are covered by our Privacy Policy.

## 1. What cookies are

Cookies are small files that a website stores in your browser. Similar technologies, such as local storage and pixels, work in a similar way.
We call them all "cookies" in this notice.

## 2. The cookies we use

`[ENGINEERING and MARKETING: complete from the GTM export and a production cookie scan (EV-212). One row per cookie. Remove any category that
is not used. Cookie lifetimes must not exceed the periods in Privacy Policy §11.]`

| Category | Purpose | Cookie name | Provider (and link to its privacy notice) | Duration | European Economic Area | United Kingdom |
|---|---|---|---|---|---|---|
| Strictly necessary | Security, checkout, remembering your cookie choices `[ENGINEERING: and sign-in, if the website has sign-in]` | `[ ]` | HidzoVPN / `[ ]` | `[ ]` | No consent needed | No consent needed |
| Preferences | Remembering your language | `[ ]` | `[ ]` | `[ ]` | `[COUNSEL]` | `[COUNSEL: PECR Sch. A1 para. 6]` |
| Analytics | Understanding how the website is used | `[ ]` | `[ ]` | `[ ]` | Consent | `[COUNSEL: opt-out under PECR Sch. A1 para. 5, or consent as a policy choice]` |
| Advertising and measurement | Measuring our advertising campaigns | `[ ]` | `[ ]` | `[ ]` | Consent | Consent |

Some cookies are set by other companies, which may use the information under their own privacy notices. For more about who receives
information and international transfers, see Sections 9 and 10 of our Privacy Policy.

## 3. Your choices

- **Cookie settings:** you can accept or reject non-essential cookies, and change your choice at any time, using `[ENGINEERING: "Cookie
  settings" link in the website footer]`. `[ENGINEERING: the first layer offers Accept and Reject with equal prominence]`
- **Your Privacy Choices:** `[OPEN: link]` — applies where U.S. state law gives you a right to opt out of the sale or sharing of personal
  information or of targeted advertising `[COUNSEL: which state laws apply]`.
- **Global Privacy Control:** if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing
  of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account,
  and we show on the website that your signal has been honored `[ENGINEERING: confirm; status display]` `[COUNSEL: which state laws apply — EV-233]`.
- **Browser settings:** you can also block or delete cookies in your browser. If you block strictly necessary cookies, parts of the website,
  such as checkout, may not work.

## 4. Changes

We update this notice when we add or change a category of cookies. The "Last updated" date at the top shows the latest change. If we add
cookies that need consent, we will ask for your consent again.

## 5. Contact

`[OPEN: privacy@hidzovpn.com]` · See also our Privacy Policy. This notice is written in English; if a translation differs, the English version
prevails unless the law of your place of residence requires otherwise.

## Part C — Drafting notes (internal)

### C.1 Sources
| Element | Basis | Label |
|---|---|---|
| Consent before non-essential storage/access (EEA) | ePrivacy Directive 2002/58/EC Art. 5(3) | `[VERIFY: EUR-Lex not opened]` |
| UK rules and exceptions (statistics; appearance/functionality) — only with clear information, a free and simple way to object, and no sharing except to help improve the service | PECR reg. 6 and Sch. A1 paras. 4–6 as substituted by the Data (Use and Access) Act 2025 (in force 5 Feb 2026, S.I. 2026/82) | Reported (EV-237, EV-256) |
| GPC scope (browser, device, known account); display that the signal was honored; cookie banner not a valid sale/sharing opt-out | 11 CCR §§7025(c)(1), (c)(6), 7026(a)(4) (regulations eff. 1 Jan 2026) | Verified first-hand (EV-253) |
| Opt-out link; notice at collection | 11 CCR §§7012, 7026 | §7026(a)(4) Verified (EV-253); §7012 `[VERIFY]` |
| Google Ads/GA tags for EEA/UK/CH users | Google EU User Consent Policy; Consent Mode | `[VERIFY]`; `[COUNSEL: whether GTM may load before consent]` |
| Wiretap and pen-register claims over website tags | Cal. Penal Code §§631(a), 638.51; SB 690 (enrolled; would leave §638.51 website/app claims to the Attorney General; §631 unaffected); Fla. Stat. §§934.03, 934.10 | SB 690 status Reported (EV-258); Florida `[VERIFY]`; trend Level C `[COUNSEL]` |
| Correction of CLM-021 | Claims register | Internal |

### C.2 Prerequisites before publication (in order)
1. Snapshot hidzovpn.com with the current GTM container (PDF, HTML, HAR, SHA-256) and export the container into 03-Evidence/snapshots **before**
   any tag or consent change `[COUNSEL: preservation]`.
2. Production cookie scan with and without consent; complete the table.
3. Consent management deployed for the EEA, UK and Switzerland; tags fire only according to consent; "Cookie settings" footer link.
4. Cookie lifetimes configured within Privacy Policy §11 periods.
5. CLM-021 corrected in every language version of the published Privacy Policy and the website (EN, AR, TR, ID) at the same time.
6. Any new GTM tag requires a legal ticket before release.

### C.3 Limits of this analysis
(a) Not reviewed: Swiss FADP; Turkey KVKK cookie guidance; Brazil LGPD; Indonesia PDP Law; U.S. state universal opt-out laws other than
California; Florida Security of Communications Act in detail. (b) Not opened: ePrivacy Directive text (EUR-Lex); CCPA regulations as amended in
2026. (c) Facts unknown: every cookie; the consent tool; which state laws apply. (d) Counsel required: EU/UK privacy; U.S. privacy.

### C.4 Review log
| Date | Reviewer | Verdict | Notes |
|---|---|---|---|
| 2026-09-25 | Drafted | — | v0.1 |
| 2026-09-25 | hidzo-counsel-reviewer (AI) | REVISE (10 Majors) | v0.2: EEA and UK columns (UK post-DUAA 2025 exceptions); app SDK storage moved to Privacy Policy §8; GPC wording aligned with Privacy Policy §7; Your Privacy Choices link; provider notices and third-party sentence; cookie lifetimes; Google consent policy and GTM question; Florida wiretap statute; all language versions of CLM-021; snapshot before remediation; change mechanics; scope of domains; CH added |
| 2026-09-25 | hidzo-counsel-reviewer (AI) — cross-document final audit; research memos EV-232–235 | REVISE (set: 1 Blocker, 8 Majors) | v0.3: cross-document redlines X-01–X-31 applied where they concern this document; authority labels updated from first-hand and research-memo checks (EV-238–264) |