Consent-first data

Consent-first data is a simple commitment with hard engineering behind it: creator data is used only where consent has been given, and withdrawing consent actually stops the use. Most systems treat consent as a checkbox captured once and rarely honored afterward. We treat it as a live state that governs every use downstream, so that when someone withdraws, the withdrawal propagates to the places the data actually flows rather than sitting in a policy no one enforces.

This is now where the law is, not just where good practice is. As of 1 January 2026, twelve states including California, Colorado, Connecticut and Texas legally require businesses to honor the Global Privacy Control as a binding universal opt-out, and on 9 September 2025 the California, Colorado and Connecticut regulators announced a coordinated enforcement sweep against companies that ignore opt-out preference signals. The EU's GDPR and ePrivacy regime require a lawful basis and genuine, withdrawable consent. We honor the Global Privacy Control across our sites and build data flows so that consent is the gate, not an afterthought.

• Consent is recorded per purpose, per partner, with a date.
• Withdrawal takes effect in the system, not just on paper.
• Data with no consent behind it is not used at all.
• Creators can see what is held and who it reaches.

The forward view is that consent that actually propagates becomes the durable competitive asset as third-party identifiers disappear. With Privacy Sandbox shut down and cross-site tracking blocked by default in most browsers, the data worth having is first-party data held with real consent. We build for a world where the ability to prove consent, and to prove that a withdrawal was honored, is worth more than any amount of quietly harvested data that a regulator or a person can take away.