Tracking Consent Management

Last Updated: October 25, 2026

With tracking consent management you decide whether we collect non-essential product analytics when you use Vasion's web applications. We record each decision, as part of Vasion's compliance with ePrivacy Directive, so that we can show regulators and customers when and how you gave consent.

Key Points

Review the following key points:

  • You accept or reject each category of non-essential tracking. Essential tracking is listed for your information only.
  • A consent banner appears after you sign in, the first time we have no recorded consent for your user account.
  • Your choice belongs to your user account, not your browser, so it applies across sessions and devices.
  • You can change your choice at any time from the preferences page.
  • Your detected location determines the default settings and the banner wording.
  • We honor Global Privacy Control (GPC) and other browser privacy signals as an opt-out.
  • We keep an audit record of every consent event for ten years.
  • Tenant admins cannot configure tracking consent management.

How Tracking Consent Management Works

Consent Categories

We divide tracking into two types:

  • Essential: Tracking that is required to run the service. The banner lists essential tracking so that you know what is in use. You cannot turn it off.
  • Non-essential: Product analytics and similar tracking. Each non-essential category has its own toggle, so you can accept some categories and reject others.

Consent Banner

When you sign in and we have no recorded consent for your user account, a banner appears. The banner lists essential tracking and shows a toggle for each non-essential category. We display the banner after you sign in, not before, because we save your choice to your user account.

Preferences Page

After you make your first choice, you can review and change it at any time from the preferences page. Refer to Change Tracking Consent Preferences.

Location-Based Defaults

We use your detected location to decide which rules apply. The banner wording and your available choices depend on the consent model for your location:

  • Opt-in: The European Union (EU), the United Kingdom, Brazil, and Quebec.
  • Opt-out: California, Texas, Colorado, and any user whose browser sends a GPC signal.
  • Notice-only: The rest of the United States.

Defaults follow your detected location, not the country in your organization’s contract. For example, if you work for a French company but you are located in Germany, the rules for Germany apply. We never reverse an explicit opt-out without your action, even when your detected location changes.

Browser Privacy Signals

When your browser or a browser extension sends a GPC signal, we treat it as an opt-out of non-essential tracking. You do not need to take any action.

Policy Changes

When we materially change our privacy policy or the consent categories, we notify you and give you the chance to review your choices.

Audit Record

We record every consent and opt-out event, including the version of the privacy policy in force at the time. We cannot change a record after we write it. We retain audit records for six years and can provide them as evidence to a regulator or customer on request.

FedRAMP and Virtual Appliance Environments

Non-essential tracking does not run in Federal Risk and Authorization Management Program (FedRAMP) and Virtual Appliance environments. Because there is nothing to consent to, no toggles appear. You still see a disclosure of the cookies that are required to run the service and what each cookie does.

Requirements

Review the following requirements:

  • Access to the Vasion Platform.

Next Steps

Refer to the following: