# Regulatory and platform sources
Generated from [the catalog](). Dates below record retrieval/search, not legal effective dates. `read` means source content was retrieved; `search-result` means the recorded finding was found in search output and needs full-text review; `blocked` is an unresolved gap. Neither retrieval nor search is a legal review.
## SRC-EU-GDPR
[GDPR official text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
## SRC-EU-EDPB
[EDPB cookie banner taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
## SRC-FR-CNIL
[CNIL: tracker requirements](https://cnil.fr/fr/cookies-et-autres-traceurs/que-dit-la-loi)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Read prior consent, new consent-requiring purposes, withdrawal and conditional exemptions. This page is dated 29 September 2020; checking it is not a legal review.
## SRC-DE-TDDDG
[Germany TDDDG section 25](https://www.gesetze-im-internet.de/ttdsg/__25.html)
**Type:** law. **Checked:** 2026-10-19. **Access:** read.
Read section 25(1)-(2): prior informed consent and the transmission-only/requested-service exceptions. Qualification remains operator review.
## SRC-IT-GARANTE
[Garante: cookie guidelines and repeated prompts](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9679893)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read official guidance and summary; repeat-prompt mechanics are in guideline sections 6.2 and 7.1. Legal applicability/review remains open.
## SRC-IT-GUIDE
[Garante cookie guidelines](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read official guidance and summary; repeat-prompt mechanics are in guideline sections 6.2 and 7.1. Legal applicability/review remains open.
## SRC-ES-AEPD
[AEPD: cookie consent and choice visibility](https://www.aepd.es/preguntas-frecuentes/17-internet-y-redes-sociales/FAQ-1707-importancia-de-las-cookies-en-la-proteccion-de-datos)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Retrieved official FAQ. Accept/reject paragraph explicitly requires simultaneous, same-level, equally visible choices.
## SRC-IE-DPC
[Irish DPC: cookies and tracking guidance](https://www.dataprotection.ie/en/dpc-guidance/guidance-cookies-and-other-tracking-technologies)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Retrieved the guidance page and its linked April 2020 PDF. The two exemptions, analytics, per-purpose controls and remembered-consent duration need separate treatment. The linked statute could not be retrieved in this pass; these references establish regulator guidance rather than a fresh statutory-consolidation review.
## SRC-UK-ICO
[ICO: storage/access exception conditions](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Read statistical/appearance qualifications and the simple objection guidance; legal applicability and actual provider behavior require separate review.
## SRC-CH-FDPIC
[FDPIC: updated cookie guidance](https://www.edoeb.admin.ch/en/cookie-guidelines-updated-version)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read the 7 October 2025 clarification on selected advertising/location contexts and high-risk profiling. The linked full guidelines remain separate research.
## SRC-BR-ANPD
[ANPD: final cookies and personal-data guide](https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf/@@display-file/file)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Final guide version 1.0, October 2022, retrieved again for printed pages 30–33 (PDF indexes 29–32). Publication date is distinct from this access date. Do not use the separate administrative-process bundle containing drafts.
## SRC-CA-OPC
[OPC: meaningful consent](https://www.priv.gc.ca/media/4957/info_mc_eng.pdf)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
## SRC-CA-OBA
[OPC: online behavioural advertising](https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
## SRC-QC-CAI
[Québec CAI: private-sector collection and profiling functions](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/collecte-renseignements-personnels_entreprises)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Full private-sector collection page read. Relevant headings: necessity; technologies of identification, location and profiling; distinct biometric and automated-decision guidance. Functions described as off by default with prior information and means of voluntary activation. This is regulator guidance, not a full applicability determination.
## SRC-AU-OAIC
[OAIC: tracking pixels and privacy obligations](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/tracking-pixels-and-privacy-obligations)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Full guidance inspected: ongoing tracking-technology review, collection notice and sensitive-information considerations. Discovery supplies limited observations only.
## SRC-NZ-STATEMENT
[NZ OPC: what a privacy statement must cover](https://www.privacy.org.nz/resources-and-learning/knowledge-base/view/312/)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Full regulator page retrieved. Lists collection awareness, purpose/use, recipients, optionality/consequences and access/correction; context and applicable exceptions remain separate review.
## SRC-NZ-IPP3A
[NZ OPC: indirect-collection notification](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Full regulator guidance read. Covers notification content, reasonable steps, timing, collector/holder roles, lawful indirect collection and exceptions. Implementation remains legally unreviewed.
## SRC-NZ-IPP3A-PRINCIPLE
[NZ OPC: Principle 3A and reproduced principle text](https://www.privacy.org.nz/privacy-principles/3a/)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Full regulator page read, including reproduced IPP3A(1)-(7). Particulars, timing and exceptions are separately assessed; not independent legal review.
## SRC-ZA-DM
[South Africa: POPIA direct-marketing guidance](https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
## SRC-US-CA
[California agency: consumer rights and 2026 regulation update](https://www.cppa.ca.gov/faq.html)
**Type:** official-explanation. **Checked:** 2026-10-18. **Access:** read.
FAQ expressly disclaims legal/regulatory interpretation. Current regulation-level GPC requirements are separately sourced from the January 2026 regulations.
## SRC-US-CA-UI
[California agency: avoiding dark patterns](https://www.cppa.ca.gov/announcements/2024/20240904.html)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
## SRC-US-CO
[Colorado AG: universal opt-out mechanisms](https://coag.gov/opt-out/)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Current official page retrieved; selected GPC processing, notice and conflict provisions verified. Broader law amendments and applicability still require review.
## SRC-US-CT
[Connecticut AG: CTDPA and opt-out signals](https://portal.ct.gov/en/ag/sections/privacy/the-connecticut-data-privacy-act)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Current official page retrieved; selected GPC processing, notice and conflict provisions verified. Broader law amendments and applicability still require review.
## SRC-US-VA
[Virginia AG: VCDPA summary](https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** search-result.
## SRC-US-COPPA
[FTC: revised COPPA rule](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** search-result.
## SRC-US-COPPA-RULE
[2025 COPPA final rule and compliance dates](https://www.govinfo.gov/content/pkg/FR-2025-04-22/html/2025-05904.htm)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Read dates and final §312.5(a)(1)–(2) text. No parental-verification implementation or full COPPA support claim.
## SRC-TR-KVKK
[KVKK: processing conditions](https://www.kvkk.gov.tr/Icerik/6607/Conditions-for-Processing-Personal-Data-)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** search-result.
## SRC-TR-COOKIES
[KVKK: cookie-processing enforcement decision summary](https://www.kvkk.gov.tr/Icerik/7408/Summary-of-the-Board-Decision-on-the-processing-of-personal-data-by-the-data-controller-operating-in-e-commerce-sector-through-cookies-used-by-the-websites-mobile-applications-)
**Type:** regulator-decision. **Checked:** 2026-10-18. **Access:** search-result.
Case-specific; do not generalize every finding to all cookies or transfer arrangements.
## SRC-EU-CONTRACTS
[European Commission: unfair contract terms](https://commission.europa.eu/law/law-topic/consumer-protection-law/consumer-contract-law/unfair-contract-terms-directive_en)
**Type:** official-explanation. **Checked:** 2026-10-18. **Access:** read.
## SRC-EU-WITHDRAWAL
[Directive 2023/2673: online contract withdrawal function](https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32023L2673)
**Type:** law. **Checked:** 2026-10-18. **Access:** search-result.
Official indexed text provides Article 11a labels/fields, confirmation function and acknowledgement content/time; direct full text/PDF remained behind a script/robot challenge. National implementation and sector/window review remain open.
## SRC-DE-CANCEL
[Germany BGB section 312k: cancellation](https://www.gesetze-im-internet.de/bgb/BJNR001950896.html#BJNR001950896BJNE030201160)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Consolidated BGB section 312k read directly. Direct confirmation-page fields/action, savable declaration, immediate electronic text confirmation and default earliest termination are distinct requirements. Current case law and contract/sector applicability still need review.
## SRC-DE-WITHDRAW
[Germany BGB: electronic withdrawal function](https://www.gesetze-im-internet.de/bgb/BJNR001950896.html#BJNR001950896BJNE028702123)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Consolidated BGB section 356a read directly: accessible continuously available function during the right, identification/acknowledgement details, confirmation action and durable acknowledgement. Date/window/sector eligibility is not inferred by the module.
## SRC-BR-CONSUMER
[Brazil Consumer Defence Code](https://www.planalto.gov.br/ccivil_03/leis/l8078compilado.htm)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Article 49 read directly. The initial module does not infer a universal eligibility window or implement refunds.
## SRC-GOOGLE-CONSENT
[Google Consent Mode overview](https://developers.google.com/tag-platform/security/concepts/consent-mode)
**Type:** platform-policy. **Checked:** 2026-10-18. **Access:** read.
## SRC-GOOGLE-CMP
[Google publisher CMP requirements](https://support.google.com/adsense/answer/13554116?hl=en)
**Type:** platform-policy. **Checked:** 2026-10-18. **Access:** read.
## SRC-IAB-TCF
[IAB Europe TCF](https://iabeurope.eu/transparency-consent-framework/)
**Type:** industry-standard. **Checked:** 2026-10-18. **Access:** read.
## SRC-WCAG
[WCAG 2.2](https://www.w3.org/TR/WCAG22/)
**Type:** technical-standard. **Checked:** 2026-10-18. **Access:** read.
## SRC-IUB-OVERVIEW
[iubenda legal requirements overview](https://www.iubenda.com/en/help/5720-legal-requirements-overview/)
**Type:** secondary-explainer. **Checked:** 2026-10-18. **Access:** search-result.
## SRC-IUB-COOKIES
[iubenda regional cookie consent comparison](https://www.iubenda.com/en/blog/gdpr-cookie-consent-cheatsheet-2/)
**Type:** secondary-explainer. **Checked:** 2026-10-18. **Access:** read.
Useful discovery index, not authority; regional cells and older summaries need primary-source checks.
## SRC-IUB-US
[iubenda US privacy implementation guide](https://www.iubenda.com/en/help/21165-how-to-comply-with-us-state-privacy-laws-using-iubenda/)
**Type:** secondary-explainer. **Checked:** 2026-10-18. **Access:** read.
## SRC-IUB-BR
[iubenda LGPD product/requirements outline](https://www.iubenda.com/en/lgpd/)
**Type:** secondary-explainer. **Checked:** 2026-10-18. **Access:** search-result.
## SRC-IUB-WITHDRAWAL
[iubenda online withdrawal-function article](https://www.iubenda.com/en/blog/online-withdrawal-function-eu-directive-2023-2673/)
**Type:** secondary-explainer. **Checked:** 2026-10-18. **Access:** read.
## SRC-IUB-TERMS
[iubenda terms legal changelog](https://www.iubenda.com/en/help/64425-terms-and-conditions-generator-legal-changelog/)
**Type:** secondary-explainer. **Checked:** 2026-10-18. **Access:** search-result.
## SRC-SG-PDPC
[Singapore PDPC selected-topics guidelines](https://www.pdpc.gov.sg/guidelines-and-consultation/2020/02/advisory-guidelines-on-the-personal-data-protection-act-for-selected-topics)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** blocked.
Current page/PDF blocked by bot verification. Older indexed 2018/2021 excerpts are insufficient to mark a current pack researched.
## SRC-JP-PPC
[Japan PPC legal-text index](https://www.ppc.go.jp/en/legal/)
**Type:** official-explanation. **Checked:** 2026-10-18. **Access:** read.
Index links a 2023 consolidated translation; linked law fetch returned 403. A separately found June 2020 PDF has obsolete numbering and was not used to encode a rule.
## SRC-EU-CRD-20260927
[Consumer Rights Directive 2011/83/EU, consolidated 27 September 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02011L0083-20260927)
**Type:** primary-law. **Checked:** 2026-10-19. **Access:** read.
Selected current Articles 6, 8 and 22a reread in browser after direct tool retrieval encountered a challenge. Article 8(2) now includes 6(1)(la), the conditional durability label, alongside (a), (e), (o), (p). Consolidation, scope and national implementation still require review.
## SRC-EU-EDPB-CONSENT
[EDPB Guidelines 05/2020 on consent, version 1.1](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read sections 3.1.3, 3.3.1, 3.4 and 5.1–5.2: purpose granularity, informed affirmative action, evidence and easy withdrawal. Scope/duration need contextual review; no prescribed software schema.
## SRC-MDN-IFRAME
[MDN iframe element reference](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe)
**Type:** platform-documentation. **Checked:** 2026-10-18. **Access:** read.
Sandbox, referrer policy, source navigation and load/error limitations. Technical behavior, not a legal applicability rule.
## SRC-MDN-IMAGE
[MDN image element reference](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/img)
**Type:** platform-documentation. **Checked:** 2026-10-18. **Access:** read.
Resource source and image alternative/error behavior. Visibility or lazy loading does not establish permission.
## SRC-US-CA-REGS-2026
[California CCPA regulations effective 1 January 2026](https://www.cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Read section 7025(b)–(c), pp. 44–48: qualifying signals, conflicts, known profiles/accounts, status and absence after a prior signal. Financial-incentive exceptions and re-opt-in require separate reviewed workflows.
## SRC-W3C-GPC
[W3C Global Privacy Control editor draft](https://w3c.github.io/gpc/)
**Type:** platform-specification. **Checked:** 2026-10-18. **Access:** read.
Current editor draft: header field value and duplicates, boolean navigator property, top-level navigation caching and optional support resource. This is not a finalized standard or a legal rule.
## SRC-W3C-RESOURCE-TIMING
[W3C Resource Timing candidate recommendation draft](https://www.w3.org/TR/2026/CRD-resource-timing-20260901/)
**Type:** technical-standard. **Checked:** 2026-10-18. **Access:** read.
Work in progress dated 1 September 2026. Resource inclusion, frame boundaries, cross-origin masking and bounded buffers limit discovery; an entry is not proof of successful network delivery.
## SRC-US-VA-CODE
[Virginia Code: Consumer Data Protection Act](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Read definitions, §59.1-578(A)(5) sensitive-data provision and §59.1-577(C) appeals. Other provisions, including specialized minor/social-platform rules, are not implemented by the generic scope guard.
## SRC-EU-RIGHTS-GUIDE
[EDPB small-business guide: respecting individuals’ rights](https://www.edpb.europa.eu/sme/be-compliant/respect-individuals-rights_en)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read rights-entry procedures, identity-doubt guidance and distinctions among rights. The software does not implement request fulfillment.
## SRC-US-CA-AG-RIGHTS
[California Attorney General: CCPA consumer request methods](https://www.oag.ca.gov/privacy/ccpa)
**Type:** official-explanation. **Checked:** 2026-10-18. **Access:** read.
Read request-to-know/delete/correct methods and existing-account provisions, and the distinct sale/sharing opt-out verification discussion. Methods differ by business and request context; no universal email-only rule is inferred.
## SRC-CF-DO-EXPORTS
[Cloudflare: Durable Object class exports](https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/)
**Type:** platform-documentation. **Checked:** 2026-10-18. **Access:** read.
Read the current declarative exports flow, SQLite class binding example and its mutual exclusion with legacy migrations. Deployment and destructive namespace operations remain explicit host actions.
## SRC-CF-WRANGLER-CONFIG
[Cloudflare: Wrangler configuration](https://developers.cloudflare.com/workers/wrangler/configuration/)
**Type:** platform-documentation. **Checked:** 2026-10-18. **Access:** read.
Checked JSON/JSONC configuration, Worker entry, worker-first assets, bindings and class exports. Named Durable Object bindings and vars do not inherit; assets/exports whole-object inheritance was checked against installed Wrangler 4.151.1. Account, routing and endpoint behavior remain host decisions.
## SRC-CF-DO-SQLITE
[Cloudflare: SQLite-backed Durable Object storage](https://developers.cloudflare.com/durable-objects/api/sqlite-storage-api/)
**Type:** platform-documentation. **Checked:** 2026-10-19. **Access:** read.
Read SQLite-backed storage, asynchronous KV and transaction semantics used by scoped adapters and paid-order local admission. The host callback must use local transaction reads and return writes; external payment/network side effects are excluded. No universal retention or locality claim is inferred.
## SRC-EU-EPRIVACY-MARKETING
[ePrivacy Directive consolidated 19 December 2009, Article 13](https://eur-lex.europa.eu/eli/dir/2002/58/2009-12-19/eng)
**Type:** legislation. **Checked:** 2026-10-18. **Access:** read.
Read Article 13(1)–(5). Selected electronic direct-marketing rules, conditioned customer exception and national choices; national transposition remains separate research.
## SRC-CA-CASL-S10
[CASL section 10: express consent and implied-consent circumstances](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/section-10.html)
**Type:** legislation. **Checked:** 2026-10-18. **Access:** read.
Read subsection 10(1) request purpose/identity/prescribed information, and 10(9)–(10) implied-consent conditions. Page states current to 2026-09-30; exceptions are not inferred by the toolkit.
## SRC-CA-CRTC-548
[CRTC 2012-548: consent requests and unsubscribe guidance](https://crtc.gc.ca/eng/archive/2012/2012-548.htm)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read paragraphs 5–20: sender/contact information, readily performed unsubscribe, separate requests and separation from general terms. Full prescribed particulars and sending workflow remain host/regional review.
## SRC-CA-CRTC-549
[CRTC 2012-549: affirmative express consent](https://crtc.gc.ca/eng/archive/2012/2012-549.htm)
**Type:** regulator-guidance. **Checked:** 2026-10-18. **Access:** read.
Read paragraphs 4–8: default opt-out does not obtain express consent; positive opt-in mechanisms and confirmation guidance. No sending or confirmation delivery is supplied.
## SRC-GOOGLE-CONSENT-SETUP
[Google consent mode implementation guide](https://developers.google.com/tag-platform/security/guides/consent)
**Type:** platform-policy. **Checked:** 2026-10-18. **Access:** read.
Reviewed defaults-before-measurement and update ordering; gtag and GTM template APIs differ.
## SRC-GOOGLE-PRIVACY-CONTROLS
[Google tag privacy controls and Analytics disable flag](https://developers.google.com/tag-platform/security/guides/privacy)
**Type:** platform-policy. **Checked:** 2026-10-18. **Access:** read.
Reviewed GA4 ga-disable flag and send_page_view control. This does not provide a general Ads unload or zero-network guarantee.
## SRC-BR-ECOMMERCE
[Brazil Decree 7,962/2013: electronic consumer contracts](https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2013/decreto/d7962.htm)
**Type:** law. **Checked:** 2026-10-18. **Access:** read.
Article 5 addresses the same contracting tool, immediate acknowledgement and application-side financial notification; the optional ledger/dispatch API does not perform those external operations.
## SRC-CF-DO-ALARMS
[Cloudflare: Durable Object alarms](https://developers.cloudflare.com/durable-objects/api/alarms/)
**Type:** platform-documentation. **Checked:** 2026-10-19. **Access:** read.
Read the at-least-once alarm contract, finite automatic failure retries and host-managed continuation. The dispatch helpers return outcome data; they do not install an alarm, queue, scheduler or retry policy.
## SRC-OPEN-COOKIE-DATABASE
[Open Cookie Database: cookie metadata CSV](https://github.com/jkwakman/Open-Cookie-Database)
**Type:** dataset. **Checked:** 2026-10-19. **Access:** read.
Seed candidate for cookie metadata. No dataset imported. Cookie-level categories do not establish actual site use, legal basis, necessity or a complete provider/product profile.
## SRC-OPEN-COOKIE-LICENSE
[Open Cookie Database repository license](https://github.com/jkwakman/Open-Cookie-Database/blob/master/LICENSE)
**Type:** license. **Checked:** 2026-10-19. **Access:** read.
Apache License 2.0. Any future import must pin its exact source revision, preserve applicable notices/attribution and identify modifications.
## SRC-BROWSER-GOOGLE-TAG
[Google Tag official technical reference](https://developers.google.com/tag-platform/gtagjs)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Google tag loader path and gtag bootstrap; one tag can have multiple product destinations. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-GOOGLE-GTM
[Google Gtm official technical reference](https://developers.google.com/tag-platform/tag-manager/protocol-relative-url?hl=en)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Tag Manager script/frame paths; only HTTPS is recognized by these rules. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-STRIPE-JS
[Stripe Js official technical reference](https://docs.stripe.com/js)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Documented script delivery host; no payment feature or provider-practice classification. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-STRIPE-VERSION
[Stripe Version official technical reference](https://docs.stripe.com/sdks/stripejs-versioning)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Versioned loader path and supported legacy v3 delivery. Rule is not a version recommendation. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-TURNSTILE
[Turnstile official technical reference](https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Widget loader path, div class marker and turnstile API object. No challenge is executed. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-INTERCOM
[Intercom official technical reference](https://developers.intercom.com/installing-intercom/web/installation)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Widget loader prefix and Intercom function; app/workspace suffix is never exported as a witness. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-POSTHOG-COOKIE
[Posthog Cookie official technical reference](https://posthog.com/tutorials/nextjs-analytics)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Official tutorial excerpt describes a project-token-derived cookie name; only the name pattern is matched, never its value. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-POSTHOG-LOADER
[Posthog Loader official technical reference](https://posthog.com/tutorials/framer-analytics)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Official tutorial excerpt describes asset-host rewriting and the array.js path. Custom hosts and proxies may not match. Technical reference reviewed, not legal/provider-practice verification; external documentation is not reproduced.
## SRC-BROWSER-POSTHOG-REGIONS
[Posthog Regions official technical reference](https://posthog.com/docs/advanced/proxy/nextjs-middleware)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Official proxy guide names US and EU asset hosts. Technical endpoint reference only; no inference about an operator deployment region or transfers. External documentation is not reproduced.
## SRC-LINEAR-DESIGN-2026
[Linear — A calmer interface for a product in motion](https://linear.app/now/behind-the-latest-design-refresh)
**Type:** design-reference. **Checked:** 2026-10-19. **Access:** read.
March 2026 product-design reference: restrained navigation, hierarchy, compact controls, quieter separators and neutral surfaces. Visual direction only, not an accessibility or legal authority. No Linear assets are reproduced.
## SRC-CF-NO-TRANSFORM
[Cloudflare Web Analytics — automatic injection and no-transform](https://developers.cloudflare.com/web-analytics/get-started/)
**Type:** platform-documentation. **Checked:** 2026-10-19. **Access:** read.
Official technical documentation: automatic setup can inject the beacon; Cache-Control public,no-transform prevents payload modification and automatic injection. This is transport behavior, not a legal exemption or a guarantee about every hosting feature.
## SRC-PROFILE-CLOUDFLARE-PLACEMENT
[Workers placement](https://developers.cloudflare.com/workers/configuration/placement/)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-CLOUDFLARE-REGIONAL
[Regional Services for Workers](https://developers.cloudflare.com/data-localization/how-to/workers/)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-CLOUDFLARE-PRIVACY
[Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-CLOUDFLARE-DPA
[Cloudflare customer DPA](https://www.cloudflare.com/cloudflare-customer-dpa/)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-STRIPE-ROLES
[Stripe privacy center](https://stripe.com/legal/privacy-center)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-STRIPE-PRIVACY
[Stripe privacy policy](https://stripe.com/privacy)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-STRIPE-DPA
[Stripe DPA](https://stripe.com/legal/dpa)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Generic public DPA URL resolved to a localized page during retrieval. Check the agreement and entity for the actual account; no provider verification is implied.
## SRC-PROFILE-SUPABASE-REGIONS
[Supabase project regions](https://supabase.com/docs/guides/platform/regions)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-SUPABASE-RESIDENCY
[Supabase residency and transfers FAQ](https://supabase.com/legal/privacy-resources/data-residency-and-transfers-faq)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-SUPABASE-SELF-HOSTING
[Supabase self-hosting](https://supabase.com/docs/guides/self-hosting)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-SUPABASE-PRIVACY
[Supabase privacy policy](https://supabase.com/privacy)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-SUPABASE-DPA
[Supabase DPA](https://supabase.com/legal/customer-resources/data-processing-addendum)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-RESEND-STORAGE
[Resend GDPR and storage FAQ](https://resend.com/security/gdpr)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-RESEND-DOMAINS
[Resend domain settings](https://resend.com/docs/dashboard/domains/introduction)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-RESEND-PRIVACY
[Resend privacy policy](https://resend.com/legal/privacy-policy)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Public technical/legal reference read for these original notes. No provider practice or legal approval is implied; external text is not reproduced.
## SRC-PROFILE-RESEND-DPA
[Resend DPA](https://resend.com/legal/dpa)
**Type:** technical-documentation. **Checked:** None. **Access:** blocked.
Public reference URL recorded. Two retrieval attempts failed (timeout/internal error); its contents were not reviewed. Follow the link to review the current agreement.
## SRC-EU-GUARANTEE-REG
[Commission Implementing Regulation (EU) 2025/1960](https://eur-lex.europa.eu/eli/reg_impl/2025/1960/oj)
**Type:** primary-law. **Checked:** 2026-10-19. **Access:** read.
Articles 1-3 and Annexes I-II read in browser. Prescribed unchanged notice and limited editable label fields, online colour, optional nested display; applies from 27 September 2026.
## SRC-EU-GUARANTEE-GUIDE
[Commission practical guidelines on the guarantee notice and GARAN label, April 2026](https://commission.europa.eu/document/download/3e4dbee6-8184-4256-923d-c52551c7e9f0_en?filename=Practical%20guidelines%20Harmonised%20Label%26Notice%20product%20guarantees_ARES%2027042026.pdf)
**Type:** official-guidance. **Checked:** 2026-10-19. **Access:** read.
Selected sections 2-3 read, including digital display, producer edits, durations, font, QR destinations and product/order placement. Preliminary Commission-services guidance, not an authoritative Court interpretation.
## SRC-EU-GUARANTEE-ASSETS
[Commission official guarantee notice and label source files](https://commission.europa.eu/publications/practical-guidelines-and-high-resolution-vector-files-eu-notice-and-label-product-guarantees_en)
**Type:** official-assets. **Checked:** 2026-10-19. **Access:** read.
Page read and SVG/PDF notice archives plus GARAN template downloaded. Source archive and per-file hashes recorded. Notice SVGs contain outlined text and embedded PNG QR; GARAN template has live Inter text without embedded fonts. Actual source colours differ from statutory reference HEX values; no silent correction or conformity claim.
## SRC-EU-REUSE
[European Commission legal and reuse notice](https://commission.europa.eu/legal-notice_en)
**Type:** official-guidance. **Checked:** 2026-10-19. **Access:** read.
Reuse/copyright section read. General CC BY 4.0 policy has exceptions for logos/names/third-party rights. Prescribed artwork is not relicensed as Apache or represented as project branding.
## SRC-EU-ORDER-CONNY-SUMMARY
[CJEU C-400/22 Conny: official press summary](https://curia.europa.eu/jcms/upload/docs/application/pdf/2024-05/cp240090en.pdf)
**Type:** court-summary. **Checked:** 2026-10-19. **Access:** read.
Official press summary read. Full judgment is recorded separately as SRC-EU-ORDER-CONNY. The judgment takes precedence.
## SRC-EU-ORDER-CONNY
[CJEU C-400/22 Conny judgment](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62022CJ0400)
**Type:** court-judgment. **Checked:** 2026-10-19. **Access:** read.
Full primary judgment retrieved and read, including paragraphs 42–56 and the operative part. Payment-obligation action also applies where payment depends on a later condition. Current EUR-Lex direct requests can show a JavaScript verification challenge.
## SRC-EU-ORDER-FUHRMANN
[CJEU C-249/21 Fuhrmann-2 judgment](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62021CJ0249)
**Type:** court-judgment. **Checked:** 2026-10-19. **Access:** search-result.
Indexed primary judgment excerpts reviewed, including paragraphs 28 and 34; official press release also read. The wording on the button itself must unambiguously express payment obligation. Full judgment retrieval remains open; direct requests show a JavaScript verification challenge.
## SRC-CF-DO-LIMITS
[Cloudflare: Durable Object storage limits](https://developers.cloudflare.com/durable-objects/platform/limits/)
**Type:** platform-documentation. **Checked:** 2026-10-19. **Access:** read.
Read SQLite combined key/value 2 MB and legacy KV value 128 KiB limits. The paid-order archive uses its own portable 64 KiB chunk profile; these bounds are engineering constraints, not legal deadlines or retention rules.
## SRC-EU-DURABLE-CONTENT-SERVICES
[CJEU Content Services, C-49/11, 5 July 2012](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:62011CJ0049)
**Type:** primary-law. **Checked:** 2026-10-19. **Access:** search-result.
Official indexed judgment/summary: paragraphs 35, 42–51 and operative part reject the ordinary hyperlink arrangement in that case. Adequate future access and unchanged reproduction matter; the advanced-website question was left open. Direct full-text retrieval encountered a script/robot challenge. Prior Directive 97/7 context; current-law and national application require review.
## SRC-UK-DUAA-STORAGE
[Data (Use and Access) Act 2025: Schedule 12 storage/access amendments](https://www.legislation.gov.uk/ukpga/2025/18/pdfs/ukpga_20250018_en.pdf)
**Type:** legislation. **Checked:** 2026-10-19. **Access:** read.
Read Schedule 12 inserting PECR Schedule A1, especially paragraphs 5 and 6 (printed pages 233–234; PDF pages 243–244). This enacted source is read alongside current regulator guidance, not a complete commencement or national-applicability determination.
## SRC-IE-DPC-COOKIE-NOTE
[Irish DPC: cookies guidance note (April 2020)](https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
Linked from the current DPC guidance page. Read pp. 6-11 on exemptions, analytics, purpose choices, withdrawal and duration; the PDF says last updated April 2020.
## SRC-IE-DPC-ANALYTICS
[Irish DPC: consent for analytics cookies](https://www.dataprotection.ie/en/faqs/cookies/do-i-need-consent-analytics-cookies)
**Type:** regulator-guidance. **Checked:** 2026-10-19. **Access:** read.
The answer applies to first-party as well as third-party analytics; vendor identity alone does not create an exception.
## SRC-LLMS-TXT
[llms.txt proposal: format and Markdown documentation discovery](https://llmstxt.org/)
**Type:** technical-specification. **Checked:** 2026-10-19. **Access:** read.
Voluntary documentation convention, not a regulatory obligation. Read format, proposal and alternate/describedby link guidance; no indexing, crawler adoption or legal-compliance guarantee.
## SRC-IUB-BR-COOKIE-GUIDE
[iubenda: Brazil cookie recommendations](https://www.iubenda.com/en/help/104366-brazil-new-cookie-requirements/)
**Type:** secondary-explainer. **Checked:** 2026-10-19. **Access:** read.
Discovery aid linking ANPD’s final guide. Its mandatory wording is not substituted for the regulator’s recommendation status or a purpose-specific LGPD legal-basis assessment.
## SRC-CHROME-COOKIE-HELP-PT
[Google Chrome: manage cookies (Portuguese)](https://support.google.com/chrome/answer/95647?hl=pt-BR)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Official help destination used in the host-authored example. Third-party-cookie blocking is not a claim to block all local/session storage or requests.
## SRC-FIREFOX-SITE-DATA-HELP-PT
[Mozilla Firefox: block site cookies and data (Portuguese)](https://support.mozilla.org/pt-BR/kb/impeca-que-sites-armazenem-cookies-e-dados-no-fire)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Official help destination used in the host-authored example; live instructions can change independently of archived link text and URLs.
## SRC-IUB-QC-LAW25
[iubenda: Québec new privacy law preparation overview](https://help.iubenda.com/wp-content/uploads/2023/02/Quebecs-New-Privacy-Law-PDF.pdf)
**Type:** secondary-explainer. **Checked:** 2026-10-19. **Access:** read.
One-page phased-implementation overview read for discovery. General transparency, governance and consent discussion; not authority for the specific default-off technology interpretation. No vendor wording reused.
## SRC-W3C-ARIA-HTML
[W3C ARIA in HTML: roles and author naming](https://www.w3.org/TR/html-aria/)
**Type:** technical-standard. **Checked:** 2026-10-19. **Access:** read.
Read the pre element row and author-naming requirements. Generic pre elements prohibit author naming; an explicit supported role can preserve a useful code-group name.
## SRC-AXE-CORE
[axe-core: rules and supported environments](https://github.com/dequelabs/axe-core/blob/develop/README.md)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Read rule scope, incomplete results and JSDOM limitations. The maintainer tool pins axe-core 4.14.0; browser-only contrast and canvas/layout-dependent label checks are separated from semantic tests. Automation does not establish conformance.
## SRC-WCAG-CONTRAST
[W3C: understanding minimum text contrast](https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Read SC 1.4.3, ratio thresholds and exceptions, and the use of underlying computed colors rather than antialiased screenshot pixels.
## SRC-WCAG-LABEL-NAME
[W3C: understanding Label in Name](https://www.w3.org/WAI/WCAG22/Understanding/label-in-name.html)
**Type:** technical-documentation. **Checked:** 2026-10-19. **Access:** read.
Read SC 2.5.3 and its explanation of visible label text in accessible names for speech interaction, including punctuation and symbolic characters.
## SRC-JSON-SCHEMA-2020-12
[JSON Schema draft 2020-12: core](https://json-schema.org/draft/2020-12/json-schema-core)
**Type:** technical-specification. **Checked:** 2026-10-19. **Access:** read.
Core specification read for local definitions/references, schema dialect and compound schema behavior. Used for an authoring-shape aid, not regulatory applicability or complete runtime validation.
## SRC-W3C-HIGH-RESOLUTION-TIME
[W3C High Resolution Time](https://www.w3.org/TR/hr-time-3/)
**Type:** technical-specification. **Checked:** 2026-10-19. **Access:** read.
Working Draft of 1 September 2026 read for monotonic performance.now timestamps and explicitly limited/coarsened resolution. Used for measurement semantics only, not a regulatory deadline or real-user performance claim.