Cookies and consent on sealpost.app

What the site sets

Nothing else. No advertising cookies, no session replay, no chat widget, no embedded fonts from a third party (fonts are served from sealpost.app), no social buttons. The early-access form sets no cookie. The docs search runs in the browser and stores nothing.

The signing pages at sign.sealpost.app are a different surface: they set one session cookie to hold the signing session and nothing else, and show no banner because that cookie is strictly necessary for the page to work.

Why there is no banner for United States visitors

Written for the page and for our own record (checked Oct 21, 2026 against the state-law trackers; re-check before launch and once a year); plain enough that a visitor can follow it.

1. No US federal law requires a cookie banner. The banner regime comes from the EU ePrivacy Directive and its national versions, and from the UK’s PECR. They apply to visitors in those places, and the site shows them the banner.
2. US state privacy laws regulate sale, sharing and targeted advertising, not analytics cookies as such. As of Oct 2026 about twenty states have comprehensive privacy laws in force (California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Montana, Oregon, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, Rhode Island, and Florida’s Digital Bill of Rights, which applies only to companies over $1 billion in revenue). All of them require an opt-out for selling personal data, for sharing or processing it for targeted advertising, and for profiling with legal effects. None requires a consent banner for analytics. This site does none of the regulated things: GA4 runs with advertising features off, no Google Signals, no ad cookies, and the data is not sold or shared for advertising. There is therefore nothing to offer an opt-out for, and nothing that triggers a “Do Not Sell or Share” link.
3. Global Privacy Control is honoured anyway. About twelve of those states (California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas) require honouring a universal opt-out signal where an opt-out right exists. We honour it everywhere: a GPC signal turns analytics off for that browser, and the footer says so.
4. Disclosure is still made. The privacy notice section 2 lists the cookie, who sets it, why and for how long, which is what the state laws require of a privacy notice.
5. Thresholds. Most state laws apply only above revenue or record-count thresholds (for example 100,000 consumers a year in several states, or $25 million revenue in California). Sealpost is below every threshold at launch. The reasoning above does not rely on this, so the posture stays the same when the thresholds are crossed.

What would change this. Adding any advertising pixel, Google Signals, a remarketing audience, session replay, or sharing analytics data with any party for advertising would create an opt-out obligation under the state laws and would need a “Do Not Sell or Share” link and a GPC-driven opt-out. The website scope rules out ad pixels until there are ads; if ads start, this page is rewritten first.