Cookies, consent and UK GDPR in web apps
The ICO expects cookie banners to offer a genuine choice: rejecting as prominent as accepting, no non-essential cookies before consent and no pre-ticked boxes. We implement consent with a consent management platform or a lightweight custom banner, connect it to Google Consent Mode, and verify in the browser that tags fire only after opt-in.
Privacy by design shows up in the data model: retention periods enforced by scheduled jobs, subject access requests answered from an admin export, and erasure that reaches backups and analytics on a documented schedule. Our GDPR compliance team can run a DPIA alongside the build.
