We embed a typeform on our site as a plain iframe, loaded only after the visitor agrees to functional cookies on our side and clicks "Load form". Our CSP only needs frame-src https://form.typeform.com. We also switched on Cookie consent in the form settings, and we're happy with how it behaves:
- After "Reject all", no requests go to tracking.typeform.com or cdn.rudderlabs.com, and no rl_* or attribution_user_id cookies appear.
- After "Accept all", those come in as expected.
What we can't explain yet is what is stored before the respondent makes any choice, and stays after "Reject all":
- Cookies: _dd_s, AWSALBTG, AWSALBTGCORS
- localStorage: tf_random_id and the keys rudder.<id>.ack, rudder.<id>.reclaimStart, rudder.<id>.reclaimEnd
AWSALBTG looks like load balancing, so that one is clear to us. Two questions:
- Is _dd_s (Datadog, we assume) collecting anything about the respondent before consent, or is it purely error and performance monitoring?
- Do the rudder.* entries in localStorage send anything while consent is pending or rejected, or are they just placeholders for the SDK?
We'd like our privacy notice to describe this precisely, so a short line from the team on which of these count as strictly necessary would help a lot. Thanks!