Ketch

What Ketch is

Ketch is a privacy operations platform from Ketch.com Inc., a San Francisco software company founded in 2018. The platform combines four major components: a Consent Management Platform with banner, preference centre and TCF v2.2 support; a data mapping and inventory tool that tracks where personal data flows across the organisation; a Data Subject Rights (DSR) automation layer that captures, routes and fulfils access, deletion, portability and opt out requests; and a Global Privacy Control (GPC) and Universal Opt Out Mechanism support layer that interprets browser level privacy signals across US state laws. European operators typically engage Ketch for the CMP and DSR features, often in environments that also need to comply with US state laws like California's CCPA and CPRA.

What data Ketch collects

The CMP writes ketch_consent (12 month default), a JSON encoded record of the per purpose decision and timestamp, plus _swb (also 12 months), a backend identifier used to look up the consent record in Ketch databases. When TCF v2.2 is enabled for European programmatic advertising, the same SDK writes the standard euconsent-v2 cookie. The backend stores the consent log against an IP address and user agent for proof purposes. For data subject rights workflows, Ketch processes the requester's name, email address, phone, free text request description and any verification documents the operator chooses to collect. GPC signals are read from the navigator.globalPrivacyControl property and converted into an automatic opt out decision under the configured policies.

GDPR and ePrivacy implications

Recital 30 of the ePrivacy Directive accepts that storing the user's consent record is necessary processing, so the Ketch banner can load before consent. GDPR Art. 7(1) places the burden of proof on the controller to demonstrate consent, which justifies storing the consent log under legitimate interest or legal obligation. For DSR workflows, the legal basis is generally legal obligation (Art. 6(1)(c)) because the GDPR itself mandates handling Art. 15 to 22 requests, with retention limited to what is needed to demonstrate compliance to supervisory authorities. The TCF integration carries the same considerations as for any TCF based CMP, including the Belgian APD ruling on IAB Europe and ongoing EDPB scrutiny.

Consent flow and downstream vendors

Ketch exposes the standard __tcfapi() global when TCF is enabled, plus its own ketch() command queue for non TCF vendors. Operators wire each downstream tag (Google Analytics, Meta Pixel, custom pixels) to the corresponding Ketch purpose by either using server side gating, GTM consent triggers, or the Ketch tag inventory and policy engine. The platform supports Google Consent Mode v2 mapping, so granting analytics purpose triggers analytics_storage and granting advertising purpose triggers ad_storage, ad_user_data and ad_personalization. For mobile apps, the Ketch SDKs cover Android and iOS with App Tracking Transparency integration.

Data transfers and residency

Default Ketch infrastructure runs on AWS us-west-2 and us-east-1. The CMP banner can be served from CloudFront edges close to European visitors, but the consent log and DSR data land on US infrastructure unless the operator negotiates EU residency on eu-west-1 (Ireland) or eu-central-1 (Frankfurt) under separate contract terms. Ketch is self certified under the EU US Data Privacy Framework and uses Standard Contractual Clauses for transfers outside the DPF. Operators handling sensitive DSR data, or those with strict EU only commitments to their users, should request the EU residency contract option before deployment.

Practical compliance steps

Configure equal prominence between accept and reject in the banner, with no pre ticked boxes, granular per purpose controls accessible in one click, and a clear withdrawal link in the footer. Map all tags to Ketch purposes through the policy engine, and run regular cookie scans to confirm tags honour the consent. Enable Global Privacy Control honouring for EU visitors (some authorities now recognise GPC as a valid opt out signal), and align GPC handling with US state laws when applicable. Document the data residency option chosen, the transfer mechanism, and any DSR retention period in the record of processing activities. Test the DSR flow end to end before launch, including the verification step.