Contract analysis

1. Executive Summary This memorandum sets out Calderwood & Harkness LLP's ("C&H") legal analysis overlaid onto the technical cookie audit and data flow mapping conducted by Thistlewood Consulting Ltd ("Thistlewood") between 22 January 2024 and 16 February 2024. The Thistlewood technical audit report (the "Thistlewood Report") was delivered to C&H on 20 February 2024 and forms the factual foundation for the legal anal

2. Scope and Methodology 2.1 Engagement Background Calderwood & Harkness LLP was retained by Aurelius Global Media Group PLC on 12 January 2024 pursuant to an engagement letter of the same date, executed by Rachel Bernstein, Partner, Privacy & Data Security Practice, on behalf of C&H and by Sanjay Redworth, Group General Counsel & Company Secretary, on behalf of AGMG. The engagement encompasses the provision of legal

1. Aurelius Stream (iOS) — Version 4.7.2, available on Tidewater Industries App Store

2. Aurelius News (iOS) — Version 3.12.1, available on Tidewater Industries App Store

3. Aurelius Stream (Android) — Version 4.7.1, available on Severin Industries Play Store The consent management platform deployed across all AGMG European properties is Brightleaf ConsentShield, provided by Brightleaf Consent Technologies EU B.V., registered at Herengracht 520, 1017 CC Amsterdam, the Netherlands (KvK Registration No. 81294503). Brightleaf ConsentShield is certified under the IAB Transparency and Cons

3. Cookie Audit Findings — Technical Summary with Legal Overlay 3.1 Overview of Cookies Identified The Thistlewood technical audit identified a total of 312 unique cookies deployed across AGMG's 14 European websites during the audit period. These cookies were categorised by Thistlewood in accordance with the classification taxonomy adopted by the IAB TCF 2.2 framework and the CNIL's recommended cookie categorisation,

4. Server-Side Tracking Pixel Analysis 4.1 Overview. The Thistlewood network traffic analysis identified 19 unique server-side tracking pixels deployed across AGMG's European digital properties. Server-side tracking pixels differ from traditional client-side tracking pixels in that they are executed on AGMG's servers rather than in the user's browser. When a user loads a page, the AGMG server makes a server-to-server

5. Dark Pattern Analysis 5.1 Overview of Consent Mechanism Deficiencies The Thistlewood audit identified dark-pattern issues in the consent mechanisms deployed on all 14 AGMG European websites and all 3 mobile applications. The consent mechanisms are implemented through the Brightleaf ConsentShield CMP, which is configured and managed by AGMG's internal digital team under the direction of CTO Leander Voss. The EMEA r

1. Locate and click a "Privacy Settings" or "Cookie Settings" link in the website footer (1 click);

2. Navigate within the privacy centre to a "Cookie Preferences" section (1 click);

3. Toggle individual cookie categories from "accepted" to "rejected" (1 or more clicks, depending on the number of categories); and

4. Click "Save Preferences" to confirm the changes (1 click). On 3 of the 8 affected sites, the footer link is not labelled "Cookie Settings" but is embedded within a general "Privacy" or "Legal" page, requiring the user to first identify and click the correct sub-link, adding an additional click to the process. In the worst case (aurelius-stream.fr), the withdrawal process requires 6 clicks from the homepage. By con