The regulations ikuad speaks
ikuad is a proof tool before it is a blocking tool: for each regime, here is what it needs from you and what we keep so you can show it on request.
Personal Data Protection Law — Saudi Arabia
The PDPL makes consent the basis for processing personal data for many purposes, and demonstrating it falls on the establishment. ikuad's record documents, for every choice: what the visitor saw (the banner version and its text fingerprint), what they answered (per category), when, and from which country. Exporting any period comes with completeness checksums. Because the data is processed in Europe, we rely on the appropriate cross-border transfer basis — the privacy policy has the detail.
GDPR — the European Union
Consent must be freely given, specific, informed and withdrawable before processing, and proving it is the controller's burden. The banner asks before anything optional runs, accept and refuse are equal, and withdrawal is available from every page and deletes the withdrawn categories' cookies. Every answer is tied to the exact text the visitor saw through its fingerprint — not to the words "current version".
Google Consent Mode v2
The four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) start denied before anything else, and update with every choice. On sites outside matgrk the snippet pushes them directly through gtag and a dataLayer event; on matgrk stores the storefront pushes them in step with the visitor's choice. Refusal means the scripts are actually blocked — not merely signalled.
Global Privacy Control
A GPC signal from the visitor's browser counts as a refusal of the advertising category unless they explicitly accept it. The signal's presence is recorded in the consent record itself, so you can show you honoured it when asked.
IAB TCF
Not in this release, and the record format does not prevent adding it later — we will say so when it ships, not before.