Ledger · cookies, storage keys and consent signals

Nothing that tracks an ad click is stored until you press Allow.

Effective October 6, 2026Last updated October 6, 2026Operator Go Tto, go-tto.shopYour current choice No choice made yet

site_consent_v2 12 months
gclid · Google Ads
msclkid · Microsoft Advertising
fbclid · Meta Ads
Consent Mode v2
ad_storage denied by default
Sec-GPC honored
No cookie wall

This is the cookie notice for go-tto.shop, the inquiry-only catalogue of meeting-room hardware run by Go Tto from 51 Oak Lane, Austin, Texas 02304. People reach these pages from paid search ads for things like a conference room video bar or a Teams Rooms kit, and the people who paid for that click want to know whether it turned into an inquiry. That is the whole reason advertising storage exists here.

We keep the list short on purpose. Three keys belong to the site itself. Everything else belongs to an ad or analytics platform and waits for your Allow. The banner sits at the bottom of the screen and never covers the catalogue, so you can read every page, price a room in the estimator and send an inquiry without answering it at all.

Ledger A · The three categories in use
Category	What it means in plain words	Why it applies here
A.1Strictly necessary	Storage the site cannot work without. It remembers your cookie answer and keeps an open support chat attached to your browser. It never identifies you to anyone outside Go Tto.	Without it the banner would ask you again on every page, and a chat you started about a boardroom would vanish when you clicked through to the catalogue. No consent is needed for this class, and it is on regardless of your choice.
A.2Analytics	Counts of visits and pages, the order people move through them, and which pages lead to an inquiry. Measured in aggregate by Google Analytics.	It tells us whether the speakerphone page answers the glass-wall question or whether people leave it. Off until you allow it, controlled by `analytics_storage`.
A.3Advertising	Cookies from Google Ads, Microsoft Advertising and Meta that link an ad click to what happened after it, so a campaign can be measured and, where you allow it, shown again to you elsewhere.	We pay for clicks on those platforms today. Off until you allow it, controlled by `ad_storage`, `ad_user_data` and `ad_personalization`.

Ledger B · Every cookie and storage key, by name
Name	Who sets it and what it is for	How long it lasts
Strictly necessary · set by go-tto.shop
B.1 · localStorage`site_consent_v2`	Set by this site. Holds one word, granted or denied, a flag saying whether Global Privacy Control made the choice, and the moment you chose. It is the only place this site persists a choice.	The record of your choice is kept for 12 months, then you are asked again. Clearing site data removes it at once.
B.2 · localStorage`gotto_chat_token`	Set by this site when you start a support chat. A random token that lets your browser fetch the replies to your conversation. It carries no name and no email.	Stays in your browser until you clear site data. The transcript itself is held on our server for 18 months.
B.3 · localStorage`gotto_chat_seen`	Set by this site. The number of the last chat message you have read, so the launcher can show a count of new replies.	Until you clear site data. Useless without the token above.
Analytics · only after Allow
B.4 · cookie`_ga`, `_ga_*`	Google Analytics. A random visitor number and the current session, used to count visits and pages in aggregate.	Up to 2 years.
Advertising · only after Allow
B.5 · cookie`_gcl_au`, `_gcl_aw`	Google Ads. Stores the gclid from the ad you clicked so an inquiry sent later can be counted as a conversion for that campaign.	90 days.
B.6 · cookie`_uetsid`, `_uetvid`, `MUID`	Microsoft Advertising, through its UET tag. Holds the msclkid and a visitor number so Bing ad clicks can be matched to inquiries.	`_uetsid` 1 day; `_uetvid` and `MUID` up to 13 months.
B.7 · cookie`_fbp`, `_fbc`	Meta. `_fbc` stores the fbclid from a Facebook or Instagram ad; `_fbp` is a browser number for measuring Meta campaigns.	90 days.

Our own servers also write access logs with your IP address, the browser's user-agent string and the page asked for. Those are logs, not cookies, nothing is placed on your device for them, and they are deleted after 90 days. The privacy policy covers them along with what the inquiry form stores.

Ledger C · Platforms sending paid traffic, and the click identifier each attaches
Platform	What it attaches to the link	Why it reaches this site
C.1 · gclidGoogle Ads	Google Ireland Ltd and Google LLC add `gclid` to the address of the page when you click a Google Ads result for, say, a ceiling microphone array for a meeting room.	Google Ads sends traffic here today. The gclid is read from the address bar, and if you send an inquiry it travels in the form's hidden source field so we can tell which campaign brought it. Google also receives the four consent signals below.
C.2 · msclkidMicrosoft Advertising	Microsoft Ireland Operations Ltd adds `msclkid` to clicks from Bing and its partner network.	Microsoft Advertising sends traffic here today. Its UET tag reads the msclkid only once you allow advertising storage.
C.3 · fbclidMeta Ads	Meta Platforms Ireland Ltd adds `fbclid` to links clicked in Facebook and Instagram.	Meta Ads sends traffic here where a campaign runs there. The fbclid is ignored for storage purposes until you press Allow.

A click identifier sitting in a web address is not a cookie, and you can strip it out of the link yourself. It becomes stored data only when a platform tag writes it to one of the cookies in Ledger B, and that happens after Allow. No platform has reviewed or signed off this site; they deliver clicks, we measure them.

Ledger D · Consent Mode v2, the four signals
Signal	What it controls	Its state on this site
D.1`ad_storage`	Whether ad tags may read or write cookies such as `_gcl_aw`, `_uetvid` or `_fbc`.	Denied from the first byte of every page. Granted only by Allow.
D.2`ad_user_data`	Whether data about you may be sent to Google for advertising, such as a conversion tied to your click.	Denied until Allow.
D.3`ad_personalization`	Whether your visit may be used to show you ads again elsewhere, often called remarketing.	Denied until Allow.
D.4`analytics_storage`	Whether Google Analytics may store the `_ga` cookies.	Denied until Allow.

Consent mode is set before any other script on the page runs: the first thing cipu100.js does is declare all four signals denied, with ad data redaction on. Microsoft's UET tag gets the same default for ad_storage. While the signals are denied, Google's tags may send cookieless pings that carry no identifier, which is how consent mode is designed to work. When you press Allow, all four switch to granted. When you press Decline, or later withdraw, all four are set straight back to denied and Meta's tag receives a revoke.

Ledger E · Giving, changing and withdrawing consent
Action	How you do it	What happens next
E.1Giving it	Press Allow on the strip at the bottom of the screen. Scrolling, reading or sending a form is never treated as consent.	The four signals switch to granted and the choice is saved in `site_consent_v2`.
E.2Changing it	Press Cookie settings in the footer of any page, or the button just below this ledger. The strip comes back and you choose again.	The new choice replaces the old one on the spot, on every page.
E.3Global Privacy Control	Turn on GPC in your browser or extension. It sends the `Sec-GPC` signal.	We record Decline for you without asking, and an earlier Allow is set aside. Under California law this counts as an opt-out of sale and sharing.

Read the privacy policy

Ledger F · If you press Decline
Part of the site	What you get	Why
F.1Still works	The whole catalogue, every price band, the room estimator, the inquiry form, the support chat and the phone line. Nothing is grayed out and nothing is slower.	None of those depend on advertising or analytics storage. We would rather lose the measurement than the inquiry.
F.2Stops	No `_ga`, `_gcl`, `_uet`, `MUID` or `_fb` cookies are written. Your visit is not used to show you our ads elsewhere.	All four consent signals stay denied, and Meta's tag receives a revoke.
F.3Remains	The three strictly necessary keys in Ledger B, and the click identifier in the source field of an inquiry you choose to send.	The keys keep your answer and your chat. The source field tells us which ad you came from, and it is stored with the inquiry, not on your device.

Ledger G · The platforms' own privacy documents
Platform	Their document	What it covers
G.1Google	policies.google.com/privacy and policies.google.com/technologies/partner-sites	How Google Ads and Google Analytics use data from sites like this one, and how to adjust ad settings on your Google account.
G.2Microsoft	privacy.microsoft.com/privacystatement	The Microsoft privacy statement, which governs Microsoft Advertising, the UET tag and the msclkid.
G.3Meta	facebook.com/privacy/policy	How Meta uses data from its pixel and the fbclid, and the ad preferences on your Meta account.

Nothing that tracks an ad click is stored until you press Allow.

A question about one cookie in particular