Consent choices should follow real technology—not a decorative banner.

The mizo-locale cookie stores fa, en, de or es for one year with path / and SameSite=Lax, and is sent to the server to render the selected language. After you choose a market, mizo-market stores the selected market identifier with the same path, SameSite setting and one-year lifetime.

This finding covers current code only. The final host, CDN, security layer, or future sign-in service may add technical storage and must be observed in the production environment.

localStorage is not the same as a cookie and is not automatically sent with a network request. The website uses it only to keep the theme you picked.

• mizo-theme — light or dark, only after you pick one
• Removal — clear site data in browser settings

If analytics, advertising, cross-session personalisation, or third-party content adds storage or tracking, the team must record purpose, provider, duration, and legal basis.

Where consent is required, the default should keep non-essential technology off, and the choice must be changeable and withdrawable.

The production environment should be inspected with browser and network tools for headers, infrastructure cookies, third-party resources, and runtime storage.

The audit should record name, domain, purpose, duration, category, and owner for every item.

Because no non-essential category is active, a consent preference centre is not shown.

If new technology is added, a permanent settings link and consent-version record should be available; a banner with only an accept button is not sufficient.