1. Consent model
Royal Baltic uses four categories: necessary, functional,analytics and marketing. Necessary storage is active because it is required to provide the website or a feature explicitly requested by the user. All other categories start disabled.
The consent interface is Klaro, hosted locally by Royal Baltic. The consent manager itself therefore does not require a request to an external consent-management vendor.
2. Necessary storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| rb_consent | first-party cookie | stores consent categories, version, timestamp, source and a random consent identifier; no name, email or IP | up to 1 year |
| rb_klaro_internal | localStorage | local UI synchronisation state for Klaro; cleared when the canonical consent cookie is absent/reset | until consent reset/expiry handling |
| lang | localStorage | remembers the language explicitly selected by the user | until cleared or changed |
| authentication/session storage | first-party storage managed by the authentication SDK | sign-in, session continuity and security when the user requests an account/session | session/token lifetime and account security settings |
rb_consent uses Secure; SameSite=Lax; Path=/ and a one-year maximum age. It is deliberately not HttpOnly because the browser-side privacy interface must read and update the user's choice. It contains no personal profile data.
3. Functional category
Functional consent may enable third-party content such as YouTube video, maps or support widgets. Until consent is granted, the external iframe/script is not created and a local placeholder is shown instead. YouTube embeds should use the privacy-enhanced youtube-nocookie.com domain after activation.
4. Analytics category
Analytics is disabled by default. If Google Analytics is enabled in production and the user opts in, Google may set first-party identifiers such as _ga,_ga_*, _gid or related measurement cookies. The exact set may change with the configured Google service.
5. Marketing category
Marketing is disabled by default. If Google Ads or another advertising service is configured and the user opts in, conversion/remarketing identifiers such as _gcl_* or service-specific identifiers may be created. Meta Pixel, TikTok Pixel or similar services must not be added outside the Royal Baltic consent service registry.
6. Google Consent Mode v2
Royal Baltic uses a strict Basic Consent Mode design. The local default is denied for analytics_storage, ad_storage, ad_user_data and ad_personalization. Google analytics or advertising scripts are not loaded until the corresponding category has been accepted. This prevents optional Google network requests before opt-in.
7. Withdrawal and deletion
You may change or withdraw optional consent at any time through Cookie settings. On withdrawal Royal Baltic changes the consent state to denied, clears accessible first-party cookies registered for the disabled service and reloads the page when needed to ensure previously loaded third-party SDKs or iframes are no longer present.
Browser JavaScript cannot delete cookies owned by a third-party domain. Royal Baltic therefore stops loading/calling the relevant service and reloads where appropriate.
8. Consent versioning
Consent version 1.0 applies to this policy version. A material change to purposes or categories increments the consent version. An older stored choice is then invalidated and the banner is shown again before optional services can load.