MyLOL
Legal · Cookies

Cookie and similar technologies policy

How MyLOL uses cookies, local storage and similar technologies across mylol.com and the app — what is strictly necessary, what is optional, and how to accept, reject or change your choices.

What we can verify today

One thing has been checked directly rather than assumed, and it is recorded here so the difference between verified and unverified is visible.

www.mylol.com (current marketing build)
app.mylol.com and app18.mylol.com

What are cookies?

A cookie is a small text file that a website asks your browser to store on your device. When you come back, your browser sends it again, so the site can recognise your session — for example, to keep you logged in rather than asking for your password on every page.

Some cookies are set by the site you are visiting (first-party). Others are set by another company whose service is embedded in the page, such as a payment or verification provider (third-party).

Some last only until you close your browser (session). Others stay for a defined period (persistent).

For teen members: Short version: a cookie is a little note your browser keeps for a website so the site remembers your visit. Some notes are needed for the site to work. Others are optional, and you get to say no to those.

Cookies and similar technologies

This policy is not only about cookies. It covers every technology that stores information on your device or reads information from it, including:

  • Local storage and session storage

    Browser storage a site can write to, often used for preferences or to hold a session token.

  • Software development kits (SDKs)

    Code from another company included in an app, which may create or read a device or installation identifier.

  • Pixels and tracking tags

    Tiny image or script requests used to record that a page or action occurred.

  • Authentication tokens

    Credentials issued after you log in, stored on your device so you stay logged in.

  • Device and fraud signals

    Information read from your browser or device to detect automation, account takeover and fraud.

  • Embedded media

    Players or content loaded from another service, which may set their own storage.

  • Cache and similar identifiers

    Other local mechanisms that can be used to store or retrieve an identifier.

Where the law treats access to, or storage on, your device as requiring consent, it generally does so regardless of whether the technology is technically a "cookie". That is why this policy is written around technologies, not just cookie files.

How MyLOL uses cookies and similar technologies

Categories below describe purposes, not confirmed technologies. A category stays in the published policy only if the inventory shows it actually exists.

Strictly necessary

Always active

Technologies without which the service you asked for cannot be delivered. Purposes in this category are expected to include:

  • — Authentication — keeping you logged in and tied to the correct account
  • — Session management — maintaining state as you move between pages
  • — Security — protecting against account takeover, cross-site request forgery and abuse
  • — Fraud prevention — detecting automated sign-ups, ban evasion and misuse
  • — Load balancing and routing — sending your request to a working server
  • — Recording your cookie choices, so we do not ask again on every page

Consent: Consent not generally required where the technology is strictly necessary to provide the service you requested — but the exemption is narrow and each item must be justified individually.

Preferences

Optional

Technologies that remember a choice you made, so the product behaves the way you set it. Possible purposes:

  • — Language or region preference
  • — Theme or display preference
  • — Remembered interface settings, such as a collapsed panel

Consent: Consent required in jurisdictions with a consent rule for non-essential storage.

Analytics

Optional

Technologies used to understand how the product is used and where it fails. Purposes on www.mylol.com include:

  • — Page and feature usage counts
  • — Referral and traffic source measurement
  • — Visitor journey and engagement measurement

Consent: Consent required in the UK and EU/EEA before any analytics storage is set or read. Also relevant to opt-out rights in some US states.

Functional

Optional

Optional enhancements that are not required for the service to work. Where these exist they may include embedded media players, support chat widgets, or content loaded from another service.

    Consent: Consent required where the function is not strictly necessary.

    Advertising and tracking

    Not asserted either way

    MyLOL is intended to operate primarily through subscriptions rather than advertising. This draft deliberately does not include an advertising section, and equally does not yet claim that no advertising technologies exist.

    • — The confirmation must cover: advertising pixels, conversion tags, retargeting tags, social share/embed scripts that set identifiers, affiliate or attribution SDKs, and any marketing-platform script on the marketing site

    Consent: Consent required where such technologies exist. Additional restrictions apply where users are minors.

    If the confirmation comes back clean, this category is replaced by a single plain statement that MyLOL uses no advertising or cross-site tracking technologies. If anything is found, it must be disclosed in full, and its use on teen surfaces reviewed separately before launch.

    Age assurance and security technologies

    Assessment required

    Age and identity checks are typically performed by a specialist provider whose code or hosted flow runs during registration. That provider may set its own storage or read device signals — for example to keep the state of a check, to detect a repeated attempt, or to detect spoofing.

      Consent: Depends on the specific technology and the market.

      How verification data itself is processed and retained is set out in the Privacy Policy, Section 5. This policy only addresses what is stored on, or read from, your device.

      Cookie and technology table

      This table is published with the policy. It is empty because the inventory has not been supplied, and it will not be populated with placeholder or example entries.

      NameProviderPurposeCategoryDurationFirst / third party

      Required technical cookie inventory

      Engineering must complete one row per technology, per surface, before this policy can be published. A technology may not be described in the policy until every field is answered.

      Fields required per technology

      • — Name / storage key
      • — Domain
      • — Provider
      • — Purpose
      • — Category
      • — First or third party
      • — Data accessed
      • — Duration
      • — Session or persistent
      • — Necessary or optional
      • — Countries where used
      • — Consent requirement

      Surfaces to inventory

      • — www.mylol.com — marketing site, including any font, media or embed host
      • — app.mylol.com — teen application
      • — app18.mylol.com — adult application
      • — Registration flow, including age assurance and any parental-authorisation step
      • — Login, session refresh and account recovery
      • — Payment and subscription flows, including any processor iframe or hosted page
      • — Chat and real-time social features, including websocket or presence identifiers
      • — Photo and media upload, including any CDN or transformation service
      • — Email and notification links, including any open- or click-tracking pixel
      • — Support and help surfaces, if any widget is embedded
      • — Native or mobile app SDKs and any installation identifier, if apps exist

      Additional questions per technology

      • — Whether the technology is set before or after a consent decision — anything non-essential set before consent is a compliance defect, not a documentation gap
      • — Whether it is present on teen surfaces, adult surfaces, or both
      • — Whether it can be disabled without breaking the service, and what degrades if it is
      • — Whether it is read cross-site or cross-device
      • — Whether the data reaches a third party, and in which country
      • — Whether the value is or contains an identifier that can be linked to an account
      • — The legal justification if it is claimed to be strictly necessary

      Your choices

      Where consent is required, we ask for it through a consent banner the first time you visit, and no optional technology is set or read until you make a choice. Strictly necessary technologies are always active because the service cannot work without them.

      You can accept optional technologies, reject them, or open the preference centre and choose category by category. Rejecting optional technologies keeps MyLOL working — you may lose optional conveniences, not access.

      You can also control cookies in your browser settings, including deleting existing cookies and blocking new ones. Blocking strictly necessary cookies will prevent login from working.

      No dark patterns

      • "Reject optional cookies" appears at the same level as "Accept optional cookies", with the same size, prominence and styling.
      • Rejecting takes one click, exactly like accepting. Rejection is never buried behind an extra screen.
      • No pre-ticked optional categories, no "legitimate interest" toggles switched on by default, no confirm-shaming language.
      • No cookie wall: content is not withheld from members who reject optional technologies.
      • The banner does not reappear on every page to pressure a change of mind.

      Teen members and cookie choices

      The teen community is designed to a higher privacy standard, and that extends to what runs on a teen member's device.

      Optional technologies on teen surfaces are treated with more caution than on adult surfaces. Where a consent-based technology cannot be explained clearly enough for a young member to make a real choice, the correct answer is not to run it.

      No claim about behavioural advertising or profiling of teen members appears in this draft, in either direction, until the confirmation in the advertising category above is complete.

      For teen members: Plain version: on the teen side we try to run only what the site genuinely needs. If we ever offer optional extras, we'll ask you first, in words that actually make sense.

      Changing your consent

      Open Cookie settings from the footer of any page, or from account settings when you are logged in, and change any category. Your choice takes effect immediately and is remembered on that browser.

      Because your choice is stored on the device, you may need to set it again on a different browser or device, or if you clear your browser storage.

      Cookie banner copy

      Proposed copy. The bracketed purpose list must be replaced with the categories that actually exist after the inventory, and any category that does not exist must be removed from both the banner and the preference centre.

      Preview

      Cookies on MyLOL

      Accept optional cookies Reject optional cookies Manage choices

      Links: Cookie Policy · Privacy Policy

      Banner rules

      • — Show before any optional technology is set or read.
      • — Do not include a category in the banner text that does not exist in the inventory.
      • — If, after the inventory, the only technologies used are strictly necessary, do not show a consent banner at all — show a short notice in the footer instead. A consent banner that asks permission for nothing is its own form of dark pattern.

      Preference-centre categories

      Only categories confirmed by the inventory may appear. Each category lists the technologies in it, their provider, purpose and duration, drawn from the same inventory that feeds the cookie table.

      CategoryDefaultStatus
      Strictly necessaryAlways on, no toggleExplain why each item qualifies; do not use this category as a dumping ground

      Developer implementation requirements

      What must be true in the codebase before this policy is accurate.

      Consent gating

      • — No optional script, pixel, SDK or storage write executes before a consent decision exists. Scripts must be loaded conditionally, not merely told not to report.
      • — Strictly necessary technologies are enumerated in code, not assumed by omission.
      • — A single consent state is the source of truth, read by every surface (marketing site and both apps).
      • — On withdrawal, stop the technology and clear the storage it set where technically possible.
      • — Server-side equivalents count: any server-set non-essential cookie must respect the same gate.

      Consent records

      • — Store what was consented to, the timestamp, the policy/banner version, and the categories accepted.
      • — Make the record retrievable for a regulator or a member request.
      • — Re-ask when categories or providers materially change.

      Teen surfaces

      • — Ability to disable optional categories entirely for teen accounts, enforced server-side and not only in the UI.
      • — Verify no third-party script on teen surfaces sets storage or identifiers.
      • — Confirm teen pages are excluded from any marketing or attribution tooling.

      Verification and maintenance

      • — Automated scan of each surface listing every cookie and storage key set, before and after consent, run in CI and reviewed on each release.
      • — Include third-party embeds, font hosts, CDNs, media players and payment iframes in the scan.
      • — Regenerate the published cookie table from the inventory rather than editing it by hand, so the page cannot drift from reality.
      • — Re-scan after adding any dependency that loads remote code.

      Jurisdictional legal-review issues

      Consent rules for device storage differ from general privacy rules and must be reviewed separately per launch market.

      United Kingdom

      • — PECR regulation 6 — consent required for storage or access unless strictly necessary for a service the user requested; confirm which items genuinely qualify.
      • — ICO guidance on cookies and on consent-or-pay/consent design, including that rejecting must be as easy as accepting.
      • — Any changes to the strictly-necessary exemption introduced by the Data (Use and Access) Act — confirm what is in force.
      • — ICO Children's Code implications for consent obtained from teen members.

      EU / EEA

      • — ePrivacy Directive Article 5(3) as implemented in each Member State — national variations are real and material.
      • — GDPR standard of consent: freely given, specific, informed, unambiguous, withdrawable, and no legitimate-interest fallback for storage consent.
      • — EDPB guidance on deceptive design patterns in consent interfaces.
      • — DSA restrictions on advertising based on profiling of minors.
      • — Whether any national authority requires a specific refusal mechanism or banner behaviour.

      France

      • — CNIL cookie guidelines — refusal as easy as acceptance, consent validity period and re-asking cadence, and documentation of consent.
      • — CNIL position on analytics exemptions: confirm whether the specific tool and configuration can qualify, rather than assuming it does.
      • — French-language presentation of the banner and policy.

      Canada

      • — PIPEDA meaningful-consent guidance, including express consent for sensitive purposes.
      • — Quebec Law 25 — privacy by default, transparency for technologies that identify or locate a person, and French-language requirements.
      • — Whether any provincial rule affects tracking technologies used with minors.

      United States

      • — State privacy laws in each state of operation — opt-out of sale/sharing and targeted advertising, and whether analytics or embeds fall within those definitions.
      • — Recognition of universal opt-out signals such as Global Privacy Control, where required.
      • — COPPA implications of any third-party technology present on surfaces where under-13 attempts occur.
      • — Restrictions on targeted advertising to known minors.

      Australia

      • — Privacy Act obligations relevant to online identifiers and tracking, and any reform provisions in force.
      • — Whether tracking technologies are permissible on surfaces subject to social-media age restrictions.

      All other markets

        Contact

        Questions about cookies, storage or your consent choices:

        Use the reporting and help options inside MyLOL — reports and requests go to our team from there.

        See also our Privacy Policy at /legal/privacy and our Terms of Service at /legal/terms.