When someone asks what your website knows about them, you can now take the request, track it and find their consent records without leaving Kukie.io. Every site has its own privacy request form and an inbox under Privacy Requests, and the Consent Log can find every record of one visitor's browser from a single consent ID. You answer each request yourself, from your own email: Kukie.io never answers for you.
All of it is on every plan, Free included. The form and the consent ID in the banner are off until you turn them on.
One more change needs nothing from you: on your US region rules, a browser that sends Global Privacy Control is now recorded as an opt-out, and the banner tells the visitor it was honoured.
A request form and an inbox for each site
The form lives on its own page on app.kukie.io, one per site. A person fills in their name, email address, what they would like to do (see their data, delete it, correct it, withdraw consent, or stop it being sold or shared) and where they live. They can add details and, if your banner shows it, their consent ID.
Kukie.io then sends them one email with a link, and the request reaches you only after they open it and confirm. A request nobody confirms within 24 hours is deleted.
The form also has spam protection, and limits per network, per email address and per site. To turn it on:
- Open your site and go to Privacy Requests.
- Under Request form, turn on Accept privacy requests.
- Choose the language of the form and its email: English or Português (Brasil).
- Select Save, then Copy to copy the form's address or Open to see it as your visitors do.
People need a way to reach the form, so there are two links you can switch on. A privacy policy you generate in Legal Documents links to the form while it is on, if you leave URL where people can submit privacy requests blank. Generate and publish the policy again after you turn the form on. In the Banner Editor, the Preferences modal tab has Show a link to your privacy request form, which adds the link below the modal's description, with its text in each of your banner's languages.
A confirmed request lands in the inbox with its status (New, In progress, Completed or Declined), a deadline you can edit, private notes, Reply by email and Export CSV. Owners and admins of the organisation get an email when a confirmed request arrives and a reminder three days before an open request's deadline. Neither email names the person. Requests carry names, email addresses and messages, so only owners and admins can see them. Editors see the page without any request on it.
Deadlines that follow where the person lives
Each request gets a suggested deadline from the place the person chose on the form, counted from the day they sent it. The General Data Protection Regulation (GDPR), for example, gives a controller one month to act on a request under Article 12(3), which it can extend by two further months for complex or numerous requests. Other laws set other clocks.
| Where the person lives | Suggested deadline |
|---|---|
| European Union, EEA and United Kingdom | One month |
| Switzerland, Canada, South Africa and any other country | 30 days |
| Brazil | 15 days |
| United States | 45 days, or 15 business days for a request to stop selling or sharing |
| South Korea | 10 days |
The deadline is a suggestion. The law that applies to your business decides the real one, so change the date where it differs. Requests you complete or decline stay in the inbox for 24 months after you close them, the same 24 months for which California's rules ask a business to keep a record of the requests it received. Export the CSV if you need it for longer.
If you are new to these requests, the guides to data subject access requests under Article 15, the right to erasure and LGPD data subject rights explain what each kind of request asks of you.
One consent ID now leads to every record of a browser
Under Article 7(1) GDPR, a controller that relies on consent must be able to show that the person gave it. Each consent record in Kukie.io has a consent ID, a new one every time a visitor saves a choice. The new Find a visitor's records box at the top of the Consent Log takes one of those IDs and finds the record, then every record from the same browser on your site, newest first.
The search goes back one month at a time to the oldest record your site still holds and shows its progress as it runs. On a busy site that can take a while, and Stop search ends it. Everyone with access to the site can search. Owners and admins of the organisation can then export the records as a CSV file, with the whole of each record, or delete them all after a confirmation. Export and delete cover every record of that browser, even when there are more than the 1,000 the list shows. Kukie.io notes each export and deletion in its audit log with the number of records, but not the consent ID, so keep the ID with your own record of the request.
The search follows the ID stored in the visitor's browser. Records from another browser or device, or from before the visitor cleared their storage, are not found, and several people can share one browser, so check whose records they are before you send them anywhere.
Visitors need their consent ID to give it to you. In the Banner Editor, on the Preferences modal tab, Show the visitor's consent ID adds it to the end of the banner's preferences with a Copy button and the line "Quote this ID if you contact us about your consent.", in all 71 banner languages. It appears once a visitor has made a choice, and only while the consent log is on. The Consent Log and consent records article in the Help Centre covers the search step by step.
Global Privacy Control is now recorded as an opt-out in the US
Global Privacy Control (GPC) is a signal a browser sends to say its user does not want their personal information sold or shared. California's regulations treat it as a valid request to opt out, and the version of the California Consumer Privacy Act (CCPA) regulations in force since 1 January 2026 also asks the business to say so.
A business must display whether it has processed the consumer's opt-out preference signal as a valid request to opt-out of sale/sharing on its website.
Section 7025(c)(6) gives "Opt-Out Request Honored" as an example of that display, and that is what your banner now shows.
On region rules that use the opt-out, notice-only or hidden model, which Kukie.io's US rules use, a browser that sends GPC is now recorded once as an opt-out in your Consent Log. No banner appears for it, and the page does not reload. The Do Not Sell or Share dialog shows the box ticked with "Opt-Out Request Honored" and a sentence explaining that the browser's signal was applied, and the preferences modal shows the same status. An acceptance a visitor saved before their browser sent the signal gives way to it.
The visitor can still allow the sale or sharing of their data, which California's rules permit: unticking the box in the Do Not Sell or Share dialog and saving, or Accept all in the preferences modal, stores that choice. It then holds on later visits, and both places say the visitor allowed it although their browser sends the signal. In opt-in regions, such as the EU and Brazil, nothing changes.
This works on every site where Respect Global Privacy Control is on in the Banner Editor's Behaviour tab, which it is by default. The guide to the Do Not Sell or Share link explains the rest of the CCPA's opt-out rules.
What Kukie.io keeps about the people who ask
Someone who sends a request may never have visited your site, so the Data Processing Agreement now names them as Requesters and describes what the form stores: name, email address, request type, message, where they live and an optional consent ID. No IP address is stored with the request. Unconfirmed requests are deleted after 24 hours and closed ones 24 months after closing, and deleting the site deletes all its requests at once. The DPA, the Terms and the privacy policy were updated on 2 November 2026, and no new sub-processor is involved.
For the laws behind each region rule, see global compliance, and for the rest of what your banner can do, the full feature list.
Questions about privacy requests in Kukie.io
Does Kukie.io answer the requests for me?
No. Kukie.io sends the person one email with a confirmation link and nothing after it. You decide what to do and reply from your own email, using Reply by email in the inbox.
Does the confirmation link prove who the person is?
It proves only that they control that email address. Check that they are who they say they are before you send anyone personal data.
Can I translate the form?
The form and its email are available in English and Brazilian Portuguese, one language per site. The banner link to the form and the consent ID line use your banner's languages.
What if a visitor cannot find their consent ID?
The ID shows in the banner's preferences only on sites that turn it on, after the visitor has made a choice. If a visitor cannot give you one, contact Kukie.io support.
Turn on the form on the site that gets the most questions
Start where people already write to you about their data: turn on the form, add the link to your privacy policy and your banner, and decide whether visitors should see their consent ID. The Help Centre guide to privacy requests walks through every setting. New to Kukie.io? Start free: the Free plan includes the form, the inbox and the Consent Log search.
