Secure Privacy

What Secure Privacy is

Secure Privacy is a Consent Management Platform from Secure Privacy AS, a Norwegian company founded in 2018 with operations in Norway, Switzerland and Poland. The product bundles a configurable cookie banner, an automated cookie scanner that crawls the site to build the vendor inventory, a privacy policy generator that drafts a policy from the scanner output, and IAB Europe TCF v2.2 support for publishers monetising through programmatic advertising. The platform is positioned as a European alternative to US headquartered CMPs, with fixed pricing tiers and EU/EEA data residency by default.

What data Secure Privacy collects

The CMP writes sp_consent (12 month default lifetime), a JSON encoded record of the per category decision and timestamp, plus sp_landing for first visit detection. When IAB TCF v2.2 is enabled, the same SDK writes the standard euconsent-v2 cookie. The backend stores a truncated IP address and user agent string for proof of consent, along with the policy version shown to the visitor. The automated cookie scanner runs on a configurable schedule from Secure Privacy servers, reads first party cookies and the list of network requests, and produces the vendor inventory displayed in the banner. The policy generator simply transforms the inventory into draft text in the configured language.

GDPR and ePrivacy implications

Recital 30 of the ePrivacy Directive accepts that storing the consent decision is itself necessary processing, so the Secure Privacy banner can load before consent. GDPR Art. 7(1) requires the controller to demonstrate consent, which justifies the proof log on legitimate interest or legal obligation grounds. The banner UI must meet CNIL, ICO, Garante and EDPB guidance: equal prominence between accept and reject, no pre ticked boxes, no nudging colours, no obstruction of content, granular per category controls accessible in one click, and a clearly accessible withdrawal link. Secure Privacy provides templates that align with these requirements out of the box, but the operator remains responsible for the final configuration.

Consent flow and downstream vendors

Secure Privacy exposes the standard __tcfapi() interface when TCF is enabled, plus a JavaScript event bus for non TCF vendors. Operators wire each downstream tag (Google Analytics, Meta Pixel, custom pixels) to the corresponding Secure Privacy category through GTM consent triggers, custom script wrapping, or the Secure Privacy tag blocking feature that pre wraps known tags by name. Google Consent Mode v2 integration maps Marketing to ad_storage, ad_user_data, ad_personalization and Analytics to analytics_storage.

Data residency and transfer position

The default Secure Privacy deployment processes the consent record and audit log on EU/EEA infrastructure (Norway, Switzerland under the Swiss FADP, Ireland and Germany on AWS). For European operators this removes the Schrems II transfer assessment burden that applies to US headquartered CMPs. Optional integrations with US tools such as Google Consent Mode, Facebook Conversions API or US scanner partners bring back transfer considerations for those downstream services, but they are not part of the core CMP processing. Norway and Switzerland are recognised as having adequate data protection regimes under GDPR and Swiss FADP respectively.

Practical compliance steps

Run the cookie scanner before launch and review the inventory for accuracy: the scanner detects most cookies but cannot infer purposes that depend on operator context, so manual review is needed. Configure the banner with equal prominence between accept and reject, granular per category controls, and a 13 month consent lifetime as per CNIL guidance. Map all downstream tags to Secure Privacy categories through GTM or the built in tag blocking feature, then test with a cookie scanner to confirm tags honour the decision. Re scan the site monthly to catch new cookies, and document the data residency option chosen in the record of processing.