Customer Consent and Privacy

Cockato tracks individual marketing consent for each customer across three channels, ensuring compliance with GDPR, CCPA, and other privacy regulations.

Consent Channels

All marketing features respect these consent flags. A customer will never receive a campaign on a channel they have not opted into.

How Consent Is Collected

During Signup

When customers register through your signup form:

1. Consent checkboxes are displayed for each channel.
2. All checkboxes default to unchecked (opt-in model).
3. Customers actively choose which channels to allow.
4. Consent timestamps are recorded for audit purposes.

⚠️ Important: Consent defaults to opt-in (unchecked) to comply with GDPR and similar regulations. Pre-checked consent boxes are not permitted under most privacy laws.

Terms and Conditions

If your signup form includes terms acceptance:

Customer Self-Management

Customers can update their consent preferences at any time through the Customer Portal:

1. Customer visits the portal link.
2. Verifies identity via email OTP code.
3. Toggles their communication preferences on/off.
4. Changes take effect immediately.
5. A consent_updated_at timestamp is recorded.

💡 Tip: Include a link to the Customer Portal in your email footers so customers can easily manage their preferences.

Admin View

In Customer Management, each customer's consent status is visible:

⚠️ Important: Admins cannot override customer consent choices. Only customers themselves can change their marketing preferences through the portal. This is by design for regulatory compliance.

Impact on Campaigns

Consent is enforced automatically at every level:

Example

If you send an email campaign to a segment of 500 customers, but only 350 have email consent:

• Estimated recipients: 350
• Emails sent: 350
• The 150 without consent are silently excluded

Data Retention and Audit Trail

Cockato maintains a complete consent audit trail:

This data is available for regulatory audits and customer data requests.

Compliance Features

GDPR (Europe)

• Explicit opt-in consent model
• Right to withdraw consent at any time
• Data portability (customer data export)
• Right to erasure (account deletion)

CCPA (California)

• Do Not Sell compliance
• Right to know what data is collected
• Right to delete personal information

General Best Practices

• Never pre-check consent boxes on signup forms
• Provide easy opt-out via Customer Portal links in every communication
• Honor requests promptly — consent changes take effect immediately
• Document everything — timestamps provide your compliance evidence
• Review regularly — audit consent rates to ensure healthy opt-in percentages