Cookies, web and AI transparency

Template for review. This document was prepared for review by qualified counsel in each market where it is used. It is not legal advice.

This is a template prepared for review by qualified counsel. It is not legal advice.

Last reviewed: August 31, 2026

This covers the inotekplus.com/SMS-Bridge marketing site and any web app login/dashboard surface, plus the AI transparency questions raised by the classifier and any AI auto responder feature.

1. Cookie policy, plain language draft

Cookie Policy for SMS Bridge (inotekplus.com/SMS-Bridge)

We use cookies and similar technologies for the following purposes:

Strictly necessary cookies: required for the site and app to function, for example maintaining your login session or remembering your cookie preference. These do not require consent under any regime reviewed below, but we still disclose them.

Analytics cookies: help us understand how visitors use the site, for example page views and time on page. Not strictly necessary; require consent in the EU/UK and Quebec, and an opt-out mechanism in California.

Marketing/advertising cookies: used for retargeting or measuring ad campaigns, if we run them. Not strictly necessary; same consent treatment as analytics cookies.

You can manage your preferences using the cookie banner shown on your first visit, or by contacting info@inotekplus.com.

Verified against the live site on 31 August 2026: the SMS Bridge product page, the demo, and these legal pages set no cookies at all, use no analytics, and load no third party scripts. Typefaces are served from our own server, so no visitor request reaches a third party and no visitor IP address is disclosed to one. The demo keeps a role selection in the browser's own session storage, which is cleared when the tab closes and is never sent anywhere. If analytics or advertising are added later, this page and the banner must be updated before the first such cookie is set.

2. Consent banner requirements by region

Region	Model	What this means for the banner	Source
EU / UK	Opt-in. Under the ePrivacy Directive and UK PECR, non-essential cookies (analytics, marketing) may not be set until the visitor affirmatively consents. The ICO is currently reviewing this guidance following the UK's Data (Use and Access) Act, so the exact UK position may shift; I don't know whether that Act changes the strict opt-in requirement in a way that would let low-risk analytics cookies move to opt-out, needs counsel to check the current state of that review before this table is relied on (ico.org.uk, "Electronic mail marketing," accessed Aug 31 2026, notes the guidance is under review, though that specific page covers email/SMS marketing consent rather than cookies directly; the general EU/UK cookie opt-in principle under ePrivacy/PECR is well established separately from that specific review).	Banner must block non-essential cookies until the visitor clicks an affirmative "Accept" or equivalent; a pre-ticked box or continued browsing does not count as consent.	ePrivacy Directive; ICO PECR guidance, accessed Aug 31 2026
Quebec (Law 25)	Opt-in for profiling/identification technology; the law's privacy-by-default rule for technological products explicitly does not extend to browser cookies as such (mccarthy.ca, "Quebec's Law 25 and Cookies," accessed Aug 31 2026, citing Law 25 s.9.1's carve-out for browser cookies). However, s.8.1 requires that if a technology's function is to identify, locate, or profile a person, the business must inform the person of that use and the means available to deactivate it, before the tracking begins for that purpose, which functionally still means Quebec sites should give clear notice and a genuine opt-out for cookies used for profiling or analytics, even though the strict "privacy-by-default" rule does not itself apply to cookies.	Banner should clearly disclose any cookie used for identification/profiling and provide an accessible way to decline before it is used for that purpose.	mccarthy.ca, dated, accessed Aug 31 2026
Rest of Canada (CASL/PIPEDA)	No cookie-specific opt-in statute; general PIPEDA consent principles apply to any personal information collected via cookies (for example an identifier tied to a person).	A clear notice plus a reasonable ability to decline non-essential tracking is a defensible baseline.	General PIPEDA principles
California (CCPA/CPRA)	Opt-out, not opt-in, for the "sale" or "sharing" of personal information (which can include certain advertising cookie/pixel data shared with ad tech vendors). Requires a "Do Not Sell or Share My Personal Information" link or equivalent, and honouring the Global Privacy Control browser signal as an opt-out.	Banner or footer link providing an opt-out is sufficient for non-essential cookies that constitute a sale/share, no need for opt-in first.	General CPRA principle, well established; specific current GPC enforcement posture not independently re-verified for this draft.
Australia, Brazil, others in the regulatory map	I don't know the current specific cookie consent standard (opt-in vs opt-out) for Australia's Privacy Act or Brazil's LGPD with enough confidence to state a firm rule here; needs counsel before assuming either an EU-style opt-in or a CCPA-style opt-out approach is safe in those markets.

3. What the marketing site may and may not set before consent

May set before consent, in every region reviewed: - Session cookies strictly necessary for the site to function (for example, a cookie remembering the visitor already dismissed the cookie banner). - Security-related cookies (for example, CSRF protection tokens). - Load balancing cookies necessary for the site to serve the visitor correctly.

Must not set before consent, in the EU/UK and, per the profiling disclosure duty, functionally also recommended for Quebec: - Analytics cookies (for example, page view tracking). - Advertising/retargeting cookies or pixels. - Any cookie or script that builds a cross-site profile of the visitor.

May set in California and most of Canada outside Quebec's profiling rule, but must offer a clear opt-out: - Analytics and advertising cookies, provided a "Do Not Sell/Share" or equivalent opt-out is available and honoured, including honouring the Global Privacy Control signal in California.

Practical recommendation: build the banner to the strictest applicable standard (EU/UK opt-in) and serve it globally, or geo-detect and serve the appropriate banner per region. Geo- detection avoids annoying non-EU visitors with an opt-in wall they do not legally need, but adds engineering complexity and a small risk of misdetection; which approach to take is a product/ marketing decision, not a legal one, though counsel should confirm the geo-detection approach if chosen still meets each region's standard.

4. EU AI Act: what applies to the classifier and the auto responder, and when

Article 50 transparency obligations became generally applicable and enforceable on August 2, 2026 (Mondaq, "Not Delayed, Not Deferred: EU AI Act Transparency Obligations Are Now In Force," dated 2026-08-05; JDSupra, "EU AI Act Transparency Obligations: What Your Company Needs to Know," dated 2026-08-19, both accessed Aug 31 2026). These apply regardless of whether a system is classified as "high-risk."
What Article 50 requires for us: any AI system "designed to interact directly with natural persons" (a chatbot or auto responder) must make clear to the person that they are interacting with an AI system, unless this is obvious from the context. If we ship an AI auto responder feature that replies to an EU end customer's text automatically, that reply must disclose it is automated, for example a first-message disclosure like "This is an automated assistant for [Company name]. A team member will follow up if needed." The exact required wording and placement (once per conversation vs. every message) is a detail I have not independently verified against the European Commission's Article 50 guidelines mentioned in the JDSupra source; needs counsel to review the published guidelines before finalizing the disclosure copy.
The classifier itself (deciding whether a message is a complaint, routing decisions) is not, on the facts as described to me, a system that "interacts directly with natural persons" in the sense Article 50 targets, since it operates behind the scenes rather than talking to the end customer. It is more likely to be assessed, if at all, under the AI Act's risk-classification provisions rather than the transparency article. High-risk system obligations do not take effect until December 2, 2027, per the AI Omnibus, Regulation (EU) 2026/1744, in force July 27, 2026 (Mondaq, dated 2026-08-05). Whether our classifier could ever be deemed "high-risk" under the Act's Annex III categories (none of which obviously match "routing a customer service text") is, on the facts given to me, unlikely, but I have not done a full Annex III mapping exercise and this needs counsel before we make any public claim that the classifier is definitively outside the high-risk category.
Deepfake/synthetic content marking obligations under Article 50 (marking AI-generated audio, image, video, or text in a machine-readable format) plausibly apply to any auto-generated text reply as well, though the practical marking mechanism for a text message is less developed in guidance than for images/video; I don't know the precise expected implementation for marking plain SMS text as AI-generated under current guidance, needs counsel.

5. Canada's AIDA, current status

The Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died on the order paper when Parliament was prorogued ahead of the April 28, 2025 federal election (Baker McKenzie, "An Election Is Looming, The Future of Canadian AI Legislation," dated 2025-04-17).
As of this review (August 2026), the federal government has not reintroduced AIDA or an equivalent omnibus AI statute. Instead, it released a National Artificial Intelligence Strategy, "AI for All," on June 4, 2026, that explicitly signals "no near-term return to AIDA" and instead favours a "targeted and more adaptable" approach built through privacy reform (notably Bill C-36, which would replace Part 1 of PIPEDA with a new Protecting Privacy and Consumer Data Act), online safety law, consumer protection, standards, and procurement policy (Fasken, "Canada's National AI Strategy," dated 2026-08-20).
ISED (Innovation, Science and Economic Development Canada) opened a public consultation, " Enhancing Trust in Artificial Intelligence Through Increased Transparency," open until September 23, 2026, covering possible future disclosure obligations, incident reporting, and AI agent tracking mechanisms (Miller Thomson, dated 2026-08-28). This could inform future legislation or standards but is not itself a binding rule yet.
Bottom line for Canada: there is currently no Canada-specific binding statute equivalent to the EU AI Act's Article 50 transparency duty. General consumer protection and privacy law (misleading representations under CASL/Competition Act-adjacent rules, meaningful consent under PIPEDA) already push toward disclosing automation, and we recommend applying the EU-style AI disclosure globally as good practice regardless of the absence of a Canadian mandate, but this is a recommendation, not a stated legal requirement in Canada as of this review; needs to be revisited after the ISED consultation closes September 23, 2026 and any resulting guidance is published.

6. Recommended baseline (pending regional legal review)

Ship the AI auto responder disclosure globally by default (it satisfies the EU's hard requirement and costs nothing elsewhere).
Build the cookie banner to the EU/UK opt-in standard by default, or implement region detection if the business wants a lighter-touch experience for visitors outside the EU/UK/Quebec.
Track the Canadian ISED consultation outcome (closing September 23, 2026) and the EU Commission's published Article 50 guidelines referenced by JDSupra, and revisit this document once either publishes a final position.

Reminder: this document mixes verified, dated sourcing with explicit "I don't know, needs counsel" flags on several open points, particularly the exact form of Article 50 disclosure wording, the current UK PECR cookie position pending the Data (Use and Access) Act review, and Australia/Brazil cookie consent standards. Do not publish or rely on this as final without counsel closing those gaps.