Question 1

tb_site_consent_v1

Accepted Answer

Type: localStorage (not an HTTP cookie). Domain: www.toobloom.com. Provider: first party (TooBloom). Purpose: storing the consent choice (status, analytics category, date/time, version of the text shown). Category: technical/necessary. Duration: indefinite in the browser, until manually cleared or until a new version of the consent text is published. First or third party: first party. Consent required: no — this is the technical mechanism that records the choice itself. Loading condition: created on first page load, populated on the first explicit choice. How to revoke: the "Cookie e privacy" button (bottom-left, always visible after the first choice), or manually clearing browser data.

Question 2

tb_attribution_v1

Accepted Answer

Type: localStorage (not an HTTP cookie). Domain: www.toobloom.com. Provider: first party (TooBloom). Purpose: storing traffic attribution parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid, msclkid) to connect a visit's origin to a later app registration. Category: analytics for campaign parameters; marketing for gclid. Duration: in the browser until the relevant consent is withdrawn or browser data is cleared manually; gclid is deleted immediately when marketing consent is withdrawn. First or third party: first party. Consent required: yes. Analytics parameters are stored only with analytics consent; gclid only with marketing consent. Loading condition: written only after consent to the relevant category, if the URL contains authorised campaign parameters. How to revoke: the "Cookies and privacy" button or manually clearing browser data. Withdrawal removes parameters that are no longer authorised.

Question 3

showcases_auth

Accepted Answer

Type: HTTP cookie, httpOnly, not readable from JavaScript. Domain: www.toobloom.com. Provider: first party (TooBloom). Purpose: authentication for an internal preview/showcase area, not used by public site visitors. Category: technical/necessary. Duration: session cookie (until the browser is closed), or 7 days if "remember me" is selected; the internal token has an equivalent 8-hour or 7-day validity. First or third party: first party. Consent required: no — strictly necessary for an authenticated-access area. Loading condition: only when an authorized account logs in to the showcase area. How to revoke: logging out, or natural cookie expiry.

Question 4

Google Tag Manager (GTM)

Accepted Answer

Type: external script (gtm.js), container GTM-NNCLBGMZ. Domain: googletagmanager.com. Provider: Google Ireland Limited. Purpose: managing and delivering the measurement tags configured for the site. Category: technical tag-delivery — it does not track by itself, but enables other tags (e.g. GA4). Duration: loaded for the browsing session; it does not set its own cookies — the tags it delivers do. First or third party: third party. Consent required: yes (measurement/analytics category). Loading condition: only after clicking "Accetta e continua" or "Salva preferenze" with measurement enabled. Verified: no request to this domain before the choice. How to revoke: "Cookie e privacy" button → "Rifiuta non necessari", or turning off the "Attiva" toggle.

Question 5

Google Analytics 4 (GA4)

Accepted Answer

Type: script (gtag/js) and Google Analytics' standard measurement cookies (e.g. _ga, _ga_*). Domain: googletagmanager.com (script load) and google-analytics.com/region1.google-analytics.com (data collection); cookies set on .toobloom.com. Provider: Google Ireland Limited, GA4 property G-Z5JN8KW4QV. Purpose: site usage statistics and page-view measurement. Category: analytics. Duration: setting verified in the linked GA4 property — event-level data 2 months, user-level data 14 months. The "Reset user data retention period on new activity" option is active (ON). First or third party: third party. Consent required: yes. Loading condition: only after consent, delivered via Google Tag Manager. Verified: no request to these domains before the choice. How to revoke: "Cookie e privacy" button → "Rifiuta non necessari".

Question 6

Google Ads

Accepted Answer

Type: third-party cookie set by the Google Ads conversion tag (_gcl_au) and, where present in the landing URL, the gclid parameter stored in the browser. Domain: googleadservices.com and googletagmanager.com for loading; cookie set on .toobloom.com. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: measuring advertising campaign conversions, that is recognising that a visit originating from an ad led to a trial activation. It is not used for personalised advertising or remarketing. Category: marketing. Duration: _gcl_au 90 days; the gclid parameter stored browser-side is deleted when consent is withdrawn. First or third party: third party. Consent required: yes, marketing category. Without consent no Google Ads tag is loaded and no advertising identifier is created. Loading condition: only after consent to the marketing category, delivered through Google Tag Manager with Consent Mode v2 (ad_storage and ad_user_data set to granted). Personalisation: the ad_personalization signal remains set to denied in all cases: TooBloom does not run personalised advertising or remarketing. Provider privacy notice: policies.google.com/privacy — business.safety.google/privacy

Question 7

Consent Mode v2 — how consent signals work

Accepted Answer

TooBloom uses Google Consent Mode v2. Before any choice is made, all four signals are set to denied: no measurement or advertising cookie is created and no data is sent to Google. analytics_storage — follows the analytics category. Enables website usage statistics. ad_storage — follows the marketing category. Enables reading and writing the identifiers used to measure advertising conversions. ad_user_data — follows the marketing category. Enables sending Google the data required to measure conversions. ad_personalization — always remains denied. TooBloom does not run personalised advertising or remarketing: this signal is never granted, regardless of the choices expressed. Choices can be changed or withdrawn at any time through the "Cookies and privacy" button available on every page. On withdrawal the signals return to denied, tags stop loading and attribution data stored in the browser is deleted.

Question 8

How to reject

Accepted Answer

Click "Rifiuta non necessari" in the banner on first load. Only necessary technical tools remain active; Google Tag Manager is not loaded.

Question 9

How to accept

Accepted Answer

Click "Accetta e continua" in the banner, or turn on the "Measurement and third-party tools" toggle and click "Salva preferenze".

Question 10

How to change or withdraw your choice

Accepted Answer

Click the "Cookie e privacy" button, always visible in the bottom-left corner after your first choice. This reopens the preferences panel where you can change the toggle and save a new choice at any time.

Question 11

What happens if you close the X

Accepted Answer

Closing the popup with the X (or clicking outside it) closes the banner but does not record any choice: no consent is saved, Google Tag Manager stays blocked, and the banner reappears on the next page load until you make an explicit choice.

Question 12

How long the preference lasts

Accepted Answer

Your choice is stored indefinitely in the browser (localStorage), with no automatic expiry, until you clear it manually or until we publish a new version of the consent text — in which case the previous choice is invalidated and the banner reappears.

Question 13

Difference between technical, analytics, functional, and marketing

Accepted Answer

Technical (necessary): always active, essential for the site to function (e.g. tb_site_consent_v1, showcases_auth); no consent required. Analytics: measure site usage in aggregate form (Google Analytics 4 via GTM) and authorise non-advertising attribution parameters; explicit consent required. Functional: improve the experience without being strictly necessary; they are not used to bypass analytics or marketing choices. Marketing: tools that measure advertising campaign effectiveness. They require explicit consent and are never loaded without it. TooBloom uses them solely to count conversions, never for personalised advertising or remarketing.

SITE

APP

API

tb_site_consent_v1+

tb_attribution_v1+

showcases_auth+

Google Tag Manager (GTM)+

Google Analytics 4 (GA4)+

Google Ads+

Consent Mode v2 — how consent signals work+

How to reject+

How to accept+

How to change or withdraw your choice+

What happens if you close the X+

How long the preference lasts+

Difference between technical, analytics, functional, and marketing+