Cookie Notices and File Upload Tools: What Users Should Know

A cookie banner does not tell you where the file goes. Compress PDF, Merge PDF, and Compress Image can run in the browser and still set analytics or consent cookies. Reject non-essential cookies, then confirm in the privacy policy whether processing stays local. Cookies track the visit. An upload sends the file. Those are different systems, and a banner often puts them in one dialog.

The banner can cover half the merge button on a phone. Accept all, and you have agreed to analytics, marketing, and personalization. The privacy page may say the file never leaves the browser. Marketing cookies are not what rotates that PDF.

The confusion comes from batching unrelated purposes into one modal. File tools add a second worry: people connect cookies with access to the file. Usually the cookie and the file are separate.

What cookies do on a tool site

| Cookie type | Typical purpose | File access? | | --- | --- | --- | | Essential | CSRF, load balancing, remembering consent | No | | Preference | Dark mode, language | No | | Analytics | Page views, funnels | No | | Advertising | Ad targeting, AdSense | No |

A file reaches a server when the tool uploads it, not because a cookie exists. A malicious site is a different threat. See Browser File Processing Risks.

Local processing and server upload

Browser processing keeps the file in memory, often with WebAssembly or Canvas. The privacy policy should say the server does not retain the file. Cookies can still record that you visited.

A server upload sends the file to a backend. A cookie may tie your session to a job ID. Read the retention terms.

How Browser PDF Tools Protect Privacy is the page to read for the processing model. That model matters more than the wording on the banner.

Consent under GDPR

GDPR Browser Processing separates the lawful basis for analytics from the lawful basis for handling the file.

Reject non-essential cookies when the control exists:

• The tool should still run
• The theme may reset on the next visit
• You will not get personalized ads

People in the EU have stronger rights here. In the US it varies by state.

Checks before you upload

1. The HTTPS padlock
2. The privacy policy: upload, or local processing
3. The cookie policy: categories listed
4. Reputation, and whether the client code is open source
5. No executable download dressed up as a tool. See Phishing PDF Attachments

For a vendor review, see Vendor Security Questionnaire PDFs.

What IT browsers already block

IT may block third-party cookies and break analytics. The tool should still work. If it does not, it depends on tracking scripts for a job those scripts are not needed for.

Free tools that show ads

Sites covered by AdSense Content Depth may show ads behind a consent framework. An ad is not access to your file. Read the policy anyway.

Clear the site after a sensitive file

In browser settings, clear site data for that tool's origin after you finish a sensitive PDF. Preference cookies go with it. That trade is acceptable.

Consent platforms

Cookie management platforms such as OneTrust and Cookiebot should put analytics in a different category from essential cookies. Test Reject all. A local tool should still process the file. If the tool breaks when you reject, analytics was labeled essential by mistake.

Rules differ by region

EU ePrivacy and GDPR, UK PECR, and US state laws such as CPRA do not match each other. A site that serves several regions may change the banner by location. Legal counsel owns the classification. Engineering implements it.

First-party and third-party cookies

A file tool rarely needs a third-party ad cookie to function. If an ad network sets a third-party cookie before consent in the EU, that is a compliance problem. Delay the ad script until consent. The same timing question shows up in AdSense Content Depth.

A short check before you drop a file

1. Decline non-essential cookies and see whether the file picker still works. A client-side tool does not need a marketing cookie to merge a PDF or resize an image.
2. Open DevTools (F12, then Network) and filter by Fetch/XHR while you process a sample. An analytics ping to google-analytics.com is a small metadata beacon. A multi-megabyte POST means the file is going to a server.
3. Read the privacy note under the workspace. Do not assume the cookie banner describes how long documents are kept.

What rejecting cookies does not do

Rejecting analytics or advertising cookies stops those beacons. It does not stop a server-based converter from receiving the file if the tool uploads documents to a backend. Check local versus server processing on its own, apart from the cookie choice.

Cookies track how the site is used. An upload sends the file. They meet when a server-side tool ties a session cookie to a job ID.

Reject non-essential cookies when the tool still works. Read whether processing is local before you merge anything confidential. The banner is about tracking. File handling is in the privacy policy.