Skip to content
Start free Sign in

Privacy requests and consent records

Every request, answered by you.

Give each site a privacy request form and an inbox with suggested deadlines. Find every consent record of one visitor from their consent ID, and show visitors under an opt-out rule, such as California's, that their browser's opt-out was honoured.

Start free (opens in a new tab) Read the setup guide

On every plan. The form and the consent ID line are off until you turn them on.

An example of the Privacy Requests page and the Consent Log search. The people and the requests are invented.

How it works

One request, from the form to your reply.

The request reaches you only after the person confirms their email address. From then on it is in your inbox, with a suggested deadline, until you close it.

  1. 1, The person

    Sends the form

    From a link in your privacy policy, your banner's preferences or anywhere you paste it.

  2. 2, Kukie.io

    Asks them to confirm

    One email with a link that works once, for 24 hours. A request nobody confirms is deleted.

  3. 3, Kukie.io

    Tells your team

    The request lands in Privacy Requests, and owners and admins get an email that names the site, not the person.

  4. 4, Your team

    Finds the records

    The consent ID, if the person gave one, finds their records in the Consent Log, ready to export or delete.

  5. 5, Your team

    Replies and closes it

    From your own email. Mark it Completed or Declined, and the 24-month clock for deleting it starts.

The confirmation link proves only that the person controls the email address. Before you send anyone personal data, check that they are who they say they are. California's rules do not allow that kind of check before a business stops selling or sharing, so keep the banner's Do Not Sell link on your US rules as well.

Every screen, start to finish.

What the person sees, what your team works with and what the banner shows. Each card opens the guide for that part.

  • Request form

    A form for each site

    Name, email address, what the person wants, where they live and, if your banner shows it, their consent ID.

  • Email check

    Confirmed before it counts

    The person opens a link within 24 hours and confirms. Until then, nothing reaches your inbox.

  • Privacy Requests

    An inbox with deadlines

    Statuses, notes, a suggested deadline you can change and a reminder three days before it.

  • Consent Log

    Every record of one browser

    Paste a consent ID to find the records of that browser, then export or delete them all.

  • Cookie banner

    The ID the visitor can quote

    Turn it on and the banner's preferences show the visitor their consent ID with a Copy button.

  • Global Privacy Control

    Opt-Out Request Honored

    On opt-out region rules, a browser's opt-out signal is recorded and the banner's privacy choices say it was honoured.

Who does what

You answer. Kukie.io does the paperwork around it.

Under the laws Kukie.io's region rules cover, the business answers a privacy request. Kukie.io runs the form and keeps the inbox, and never replies for you.

Only the owners and admins of the site's organisation see requests. Editors see the page with no request on it.

  • Turn the form on, choose its language and copy its address
  • Get an email when a confirmed request arrives and a reminder three days before an open request's deadline
  • Set the status (New, In progress, Completed or Declined), change the deadline and keep private notes
  • Reply by email from your own address, and export every request as a CSV file
  • Find, export or delete a visitor's consent records from the consent ID they gave

Kukie.io runs the form for you, as your processor. It does not decide anything about a request.

  • Hosts the form on app.kukie.io, with a spam check and limits per network, per email address and per site
  • Sends one email with a confirmation link, and nothing else to the person
  • Deletes, with a daily clean-up, unconfirmed requests once their 24 hours have passed and closed ones once 24 months have passed
  • Notes each export and deletion of a visitor's records in its audit log, with the number of records but not the consent ID

Deadlines

A deadline from where the person lives.

Each request gets a suggested deadline from the country the person chose on the form, counted from the day they sent it. The GDPR, for example, gives one month, which can be extended by two more for complex or numerous requests1.

It is a suggestion. The law that applies to your business decides the real deadline, so change the date in the inbox where it differs.

Suggested deadline, in calendar days

  • South Korea 10 days (PIPA)
  • Brazil 15 days (LGPD)
  • United States, a request to stop selling or sharing 15 business days (CCPA opt-out of sale or sharing)
  • Switzerland 30 days (Swiss FADP)
  • Canada 30 days (PIPEDA)
  • South Africa 30 days (POPIA and PAIA)
  • Any other country 30 days (suggested)
  • European Union, EEA One month (GDPR)
  • United Kingdom One month (UK GDPR)
  • United States, any other request 45 days (US state privacy laws)
Bar lengths for a request sent on 1 April. A month and business days vary with the calendar, and public holidays are not counted out.

Global Privacy Control

A browser's opt-out, recorded and shown.

Global Privacy Control is a signal a browser sends to say its user does not want their personal information sold or shared. California's regulations treat it as a valid opt-out and ask the business to show that it was processed.

"A business must display whether it has processed the consumer's opt-out preference signal as a valid request to opt-out of sale/sharing on its website."2

  • Recorded once per browser as an opt-out, with no banner and no page reload, and kept in your Consent Log while the consent log is on
  • The Do Not Sell or Share dialog shows the box ticked and Opt-Out Request Honored, and the preferences show the same status
  • A visitor can still allow the sale or sharing there, and that choice then holds and is shown as theirs
  • An earlier acceptance saved without the signal gives way to it
  • On region rules with the opt-out, notice-only or hidden model. Opt-in regions such as the EU and Brazil are unchanged

It works on any region rule with one of those models, wherever Respect Global Privacy Control is on in the Banner Editor's Behaviour tab, which it is by default. On the Agency and Unlimited plans, new sites start with ready-made rules for the United States and California that use them. On other plans, add a US rule with one of those models.

Learn more about region rules Read how to set up the Do Not Sell link

Data

What Kukie.io keeps about the people who ask.

Someone who sends a request may never have visited your site. The Data Processing Agreement names them as Requesters and describes what the form stores and for how long.

What Kukie.io stores for a privacy request, and how long it keeps it
Data What happens to it
The requestName, email address, the request type, where the person lives, the country detected from their connection when it lies in the region they chose, their details and an optional consent ID. A daily clean-up deletes it once 24 months have passed since you closed it.
A request nobody confirmsNever shown in your inbox. The daily clean-up deletes it once its 24 hours have passed.
IP addressNot stored with the request.
Your notes and statusSeen only by the owners and admins of the organisation, never by the person, and deleted with the request.
The emails to your teamThey name the site, the request type and the suggested deadline, not the person.
Deleting the siteDeletes every request of that site at once.

The Data Processing Agreement, the Terms and the privacy policy describe this processing. No new sub-processor is involved.

Help Centre

Set it up with the guides.

Questions about privacy requests

Does Kukie.io answer privacy requests for me?
No. Kukie.io runs the form and sends the person one email with a confirmation link. After that the request is yours: you decide what to do and reply from your own email, with Reply by email in the inbox. Kukie.io does not answer the person about their request.
Does the confirmation link prove who the person is?
It proves only that the person controls that email address. Before you send anyone personal data, check that they are who they say they are, in the way the law that applies to you expects.
Which plans include privacy requests?
Every plan. The request form, the inbox, the visitor search in the Consent Log, the consent ID line in the banner and the Global Privacy Control status have no plan limit of their own. How long consent records are kept depends on your plan.
What happens to a request nobody confirms?
It never reaches your inbox. A daily clean-up deletes it once its 24 hours have passed, and deletes a completed or declined request once 24 months have passed since it was closed. Deleting a site deletes all of its requests.
Can a visitor find their consent ID?
Only on sites that show it. With Show the visitor's consent ID turned on in the Banner Editor, the end of the banner's preferences shows the ID of the visitor's latest choice with a Copy button, once they have made a choice and while the consent log is on. A visitor reopens it with the revisit button or a link on your page.
Which languages is the form in?
The form and its confirmation email are in English or Brazilian Portuguese, one language per site. The banner link to the form, the consent ID line and the Global Privacy Control status use your banner's languages, 71 built in.

Take privacy requests on your site.

Turn on the form, link it from your privacy policy and your banner, and every confirmed request arrives in one inbox with its deadline.

Start free (opens in a new tab) See pricing

Related features

Requests lead to consent records, policies link to the form, and region rules decide where Global Privacy Control applies.

See all features

More on privacy requests

What each kind of request asks of you, under the GDPR and Brazil's LGPD, and the announcement of these tools.

See all articles

Footnotes

Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.

  1. 1. Article 12(3) of the General Data Protection Regulation (EU) 2016/679: information on action taken on a request must be provided without undue delay and in any event within one month of receipt, a period that may be extended by two further months where necessary. Back to footnote 1 in the text
  2. 2. California Code of Regulations, title 11, section 7025(c)(6), in the California Privacy Protection Agency's text effective 1 January 2026. Back to footnote 2 in the text

Listed on

Kukie.io on Trustpilot (opens in a new tab) Kukie.io on G2 (opens in a new tab) Kukie.io on SaaSHub (opens in a new tab) Kukie.io on AlternativeTo (opens in a new tab)