PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE — ATTORNEY WORK PRODUCT
Cookie Audit & Data Flow Mapping Report
Legal Analysis Memorandum
20 February 2024
Matter No.: C&H Matter No. 1017-00008
From: Priscilla Wynn, Senior Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP Alan Burke, Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP
To: Sanjay Redworth, Group General Counsel & Company Secretary, Aurelius Global Media Group PLC Margaux Fontaine-Li, Group Data Protection Officer, Aurelius Global Media Group PLC
Reviewed By: Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
Re: Legal Analysis of Cookie Audit and Adtech Data Flow Mapping Findings — Aurelius Global Media Group PLC European Digital Properties
PRIVILEGE STATEMENT: This memorandum is a privileged and confidential communication prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Aurelius Global Media Group PLC ("AGMG"). It constitutes attorney work product and is protected by legal professional privilege (solicitor-client privilege) under English law and litigation privilege in connection with CNIL formal notice MED-2023-097 and ICO inquiry ICO/ENF/2023/LTR-11084. This memorandum and the underlying Thistlewood Consulting Ltd technical audit report were prepared in anticipation of regulatory enforcement proceedings and must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of privilege. Recipients are directed to treat this memorandum and all attachments with the highest degree of confidentiality and to restrict circulation on a strict need-to-know basis within AGMG.
Right-click to update Table of Contents
1. Executive Summary
This memorandum sets out Calderwood & Harkness LLP's ("C&H") legal analysis overlaid onto the technical cookie audit and data flow mapping conducted by Thistlewood Consulting Ltd ("Thistlewood") between 22 January 2024 and 16 February 2024. The Thistlewood technical audit report (the "Thistlewood Report") was delivered to C&H on 20 February 2024 and forms the factual foundation for the legal analysis contained herein. This memorandum should be read in conjunction with the Thistlewood Report, which is appended under separate cover and is equally subject to privilege.
Engagement Context. C&H's engagement was triggered by three distinct but interrelated regulatory events. First, on 8 November 2023, Digitale Rechte Europa e.V. ("DRE"), a Berlin-based digital rights advocacy organisation led by Executive Director Friederike Nolte and represented by Dr. Tobias Kreisel of Kreisel & Hausmann Rechtsanwälte PartG mbB, filed complaint PLT-2023-FR-04821 with the Commission Nationale de l'Informatique et des Libertés ("CNIL") concerning alleged cookie compliance violations on aurelius-stream.fr, AGMG's French-facing streaming platform. Second, on 14 December 2023, the CNIL issued formal notice MED-2023-097 in respect of the DRE complaint, requiring AGMG to bring aurelius-stream.fr into compliance within a three-month period expiring on 14 March 2024. Third, on 22 December 2023, the UK Information Commissioner's Office ("ICO") issued an informal inquiry under reference ICO/ENF/2023/LTR-11084, requesting information regarding the deployment of server-side tracking pixels on aureliusnews.co.uk and shopaurelia.co.uk.
Scope. The audit and this legal analysis cover all 14 AGMG European-facing websites and 3 mobile applications serving audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. These properties collectively serve approximately 87 million monthly active users ("MAUs") across the EU/EEA and the United Kingdom, making AGMG one of the largest digital media operators in Europe by audience reach.
Headline Findings. The combined technical and legal analysis reveals significant and systemic compliance deficiencies across AGMG's European digital estate. The principal findings are as follows:
• 312 unique cookies were identified across the 14 European websites during the audit period.
• 74 cookies were observed to fire before any user consent interaction with the consent management platform. Of these, 38 were classified as strictly necessary and are legitimate under the ePrivacy Directive Article 5(3) exemption. However, 36 cookies were non-compliant, firing without any valid legal basis. These 36 non-compliant cookies represent 23.7% of all cookies observed to fire pre-consent and constitute direct violations of ePrivacy Directive Article 5(3), the applicable national implementing legislation, and GDPR Articles 5(1)(a) and 6(1)(a).
• 19 server-side tracking pixels were identified across all AGMG European properties. Of these, 12 pixels transmit personal data — including IP addresses, device fingerprints, and browsing history — to third-party adtech vendors without obtaining valid user consent. These pixels operate outside the browser environment and bypass the client-side consent management platform entirely, representing a critical architectural gap in AGMG's consent framework.
• 9 of 23 adtech vendors (39.1%) with which AGMG shares user data either have no Data Processing Agreement ("DPA") in place or have DPAs that are materially deficient under GDPR Article 28(3). The two most significant vendor relationships affected — Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH — together account for a substantial majority of AGMG's programmatic advertising revenue in Europe.
• Dark-pattern issues were identified on all 14 websites and all 3 mobile applications, including pre-ticked consent boxes, asymmetric button design, absence of a first-layer "Reject All" option, and multi-click consent withdrawal processes. These issues were a central allegation in the DRE complaint to the CNIL.
• Revenue at risk: approximately €26.3 million annually is at risk if non-compliant vendor relationships must be suspended or terminated pending remediation. This figure comprises revenue-share income from Pendleton (€18.4 million), audience segmentation uplift attributable to VoltGraph (€4.0 million), and additional vendor-related revenue of approximately €3.9 million.
Key Legal Risks. The findings give rise to violations of GDPR Articles 5(1)(a), 6(1)(a), 7, 28, and 44–49; ePrivacy Directive Article 5(3); UK PECR Regulation 6; and Article 82 of the French Loi Informatique et Libertés, among other provisions. AGMG's maximum fine exposure from the CNIL is up to approximately €64.7 million (calculated as 4% of AGMG's global annual turnover of £1.42 billion at an approximate exchange rate of 1.139). C&H's realistic fine estimate, based on precedent CNIL cookie enforcement actions and accounting for the scale of processing, the nature of the violations, and applicable aggravating and mitigating factors, is a range of €3 million to €8 million absent remediation. ICO fine exposure is up to £17.5 million under the UK GDPR and Data Protection Act 2018.
Recommendation. C&H strongly recommends that AGMG immediately prioritise the five remediation workstreams described in Section 8 of this memorandum ahead of the 14 March 2024 CNIL compliance deadline. Given the scope and complexity of the required remediation, C&H further recommends that AGMG authorise C&H to seek a 30-day extension of the CNIL deadline to 14 April 2024, filing the extension request no later than 11 March 2024. A meeting with Sanjay Redworth, Margaux Fontaine-Li, CTO Leander Voss, and Head of Digital Revenue Helena Durneval should be convened at the earliest opportunity to discuss findings, approve the remediation roadmap, and authorise the necessary budget.
2. Scope and Methodology
2.1 Engagement Background
Calderwood & Harkness LLP was retained by Aurelius Global Media Group PLC on 12 January 2024 pursuant to an engagement letter of the same date, executed by Rachel Bernstein, Partner, Privacy & Data Security Practice, on behalf of C&H and by Sanjay Redworth, Group General Counsel & Company Secretary, on behalf of AGMG. The engagement encompasses the provision of legal advice and representation in connection with the CNIL formal notice MED-2023-097, the ICO informal inquiry ICO/ENF/2023/LTR-11084, and the broader assessment of AGMG's cookie and adtech compliance posture across its European digital properties.
To support the legal analysis, C&H engaged Thistlewood Consulting Ltd, a London-based privacy technology consultancy with offices at 9 Worship Street, London EC2A 2BF, to conduct a comprehensive technical cookie audit and data flow mapping exercise. Thistlewood was retained under C&H's direction and subject to a common-interest privilege protocol established by memorandum dated 18 January 2024 to ensure that the technical audit findings, working papers, and related communications remain within the scope of legal professional privilege and attorney work product protection. Thistlewood's engagement is governed by a subcontract agreement between C&H and Thistlewood dated 19 January 2024, with a fixed fee of £145,000 covering the full scope of technical audit services.
The technical audit was led by Marcus Drayford, Principal Consultant at Thistlewood Consulting, who has over fifteen years of experience in privacy technology, consent management systems, and adtech data flow analysis. Mr. Drayford was supported by a team of three senior consultants with expertise in cookie scanning, network traffic analysis, and mobile application SDK auditing.
The audit scope encompassed all 14 AGMG European-facing websites serving audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, as well as 3 mobile applications (2 iOS applications and 1 Android application) that serve European audiences. These properties were selected because they collectively represent the entirety of AGMG's digital presence that is directly subject to EU/EEA and UK data protection regulation and are the properties implicated in the current regulatory proceedings.
2.2 Technical Audit Scope
The technical audit was conducted over a 26-day period from 22 January 2024 to 16 February 2024. The methodology employed by Thistlewood comprised four principal components:
Automated Cookie Scanning. Thistlewood deployed its proprietary cookie-scanning tools across all 14 European websites. The scanning tools crawl each website's primary landing pages, key internal pages (up to 250 pages per site), and user account/login areas, cataloguing every cookie set by the website, including first-party and third-party cookies. For each cookie identified, the scan captured the cookie name, domain, category, duration, size, and the point in the user journey at which the cookie is set (i.e., before consent interaction, after consent acceptance, or after consent rejection). Three separate scans were conducted for each website to ensure consistency of results.
Manual Verification of Consent Mechanism Behaviour. Thistlewood's consultants manually tested the consent mechanisms on each of the 14 websites and 3 mobile applications, simulating the user experience from initial page load through consent acceptance, rejection, and withdrawal. This included documenting the visual presentation of consent banners, the availability and accessibility of consent options, the behaviour of cookies upon acceptance and rejection of consent, and the process required to withdraw previously given consent. Testing was conducted from multiple geographic locations (London, Paris, Frankfurt, Amsterdam, Madrid, and Milan) using local IP addresses to capture any geo-targeted variations in the consent experience.
Network Traffic Analysis of Server-Side Pixel Communications. Using packet capture tools and proxy inspection, Thistlewood analysed all outbound network traffic from AGMG's servers to identify server-side tracking pixels and their communications with third-party adtech vendors. This analysis was conducted with the cooperation of AGMG's infrastructure team and CTO Leander Voss, who provided Thistlewood with access to relevant server-side logging and configuration data under the terms of the common-interest privilege protocol.
Mobile Application SDK Analysis. For each of the 3 mobile applications, Thistlewood decompiled the application binaries and analysed the advertising and analytics SDKs embedded within them. This included identifying each SDK's data collection practices, the timing of data collection relative to any consent interaction, and the destinations to which collected data is transmitted.
The 14 websites audited were:
1. aurelius-stream.fr (French streaming platform — subject of CNIL complaint)
2. aureliusnews.co.uk (UK news platform — subject of ICO inquiry)
3. shopaurelia.co.uk (UK e-commerce platform — subject of ICO inquiry)
4. aurelius-stream.de (German streaming platform)
5. aurelius-nachrichten.de (German news platform)
6. aurelius-stream.nl (Dutch streaming platform)
7. aurelius-nieuws.nl (Dutch news platform)
8. aurelius-stream.es (Spanish streaming platform)
9. aurelius-noticias.es (Spanish news platform)
10. aurelius-stream.it (Italian streaming platform)
11. aurelius-notizie.it (Italian news platform)
12. aurelius-sport.fr (French sports content platform)
13. aureliusstyle.co.uk (UK lifestyle and fashion platform)
14. aurelius-magazin.de (German digital magazine)
The 3 mobile applications audited were:
1. Aurelius Stream (iOS) — Version 4.7.2, available on Tidewater Industries App Store
2. Aurelius News (iOS) — Version 3.12.1, available on Tidewater Industries App Store
3. Aurelius Stream (Android) — Version 4.7.1, available on Severin Industries Play Store
The consent management platform deployed across all AGMG European properties is Brightleaf ConsentShield, provided by Brightleaf Consent Technologies EU B.V., registered at Herengracht 520, 1017 CC Amsterdam, the Netherlands (KvK Registration No. 81294503). Brightleaf ConsentShield is certified under the IAB Transparency and Consent Framework ("TCF") version 2.2 and is used by AGMG under an annual licence agreement with a fee of €385,000. The CMP was configured by AGMG's internal digital team under the direction of CTO Leander Voss, with the EMEA regional relationship managed by Katarina van Hoorn, VP EMEA at Brightleaf.
2.3 Data Flow Mapping Scope
In parallel with the cookie audit, C&H and Thistlewood conducted a comprehensive data flow mapping exercise covering all data flows from AGMG's European digital properties to third-party adtech vendors. This exercise comprised:
• Identification and cataloguing of all 23 third-party adtech vendors that receive personal data from AGMG's European properties, whether through client-side cookies, server-side pixels, API integrations, or mobile application SDKs;
• Review and assessment of all existing contractual arrangements between AGMG and each vendor, including Master Services Agreements ("MSAs"), Data Processing Agreements ("DPAs"), data sharing agreements, and order forms;
• Assessment of the legal basis relied upon by each vendor under the IAB TCF 2.2 framework, including whether vendors claim consent or legitimate interest as their processing basis;
• Mapping of all cross-border data transfers, including identification of the destination country, the transfer mechanism relied upon (e.g., Standard Contractual Clauses, adequacy decision), and any Transfer Impact Assessments conducted; and
• Assessment of each vendor's controller, processor, or joint controller status under GDPR Articles 4(7), 4(8), and 26.
The data flow mapping was completed on 28 February 2024, and the findings are incorporated into Sections 4 and 6 of this memorandum. While the data flow mapping completion date falls after the date of this memorandum, the material findings were available in draft form by the date of issuance, and C&H has confirmed the accuracy of all figures cited herein with reference to the final data flow mapping deliverables.
2.4 Legal Analysis Framework
The legal analysis in this memorandum applies the following legislative instruments, regulatory guidance, and judicial authorities:
Primary Legislation:
• EU General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR"), with particular reference to Articles 4 (definitions), 5(1)(a) (lawfulness, fairness, and transparency), 6(1)(a) (consent as a legal basis), 7 (conditions for consent), 13 and 14 (transparency obligations), 28 (processor obligations), 30 (records of processing activities), 35 (data protection impact assessments), and 44–49 (international transfers);
• ePrivacy Directive, Directive 2002/58/EC, as amended by Directive 2009/136/EC, with particular reference to Article 5(3) (confidentiality of communications and terminal equipment);
• UK General Data Protection Regulation (as retained and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and subsequent instruments) ("UK GDPR");
• Data Protection Act 2018 ("DPA 2018"), particularly Part 2 (general processing) and Schedule 1;
• Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426 ("PECR"), with particular reference to Regulation 6 (confidentiality of communications);
• French Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés ("Loi Informatique et Libertés"), as amended, with particular reference to Article 82 (implementing ePrivacy Directive Article 5(3));
Regulatory Guidance:
• CNIL guidelines on cookies and other trackers, Délibération n° 2020-091 du 17 septembre 2020;
• CNIL recommendation on the practical modalities for collecting consent, adopted 17 September 2020;
• European Data Protection Board ("EDPB") Guidelines 05/2020 on consent under Regulation 2016/679 (Version 1.1, adopted 4 May 2020);
• EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Version 2.0, adopted 18 June 2021);
• IAB Europe Transparency and Consent Framework v2.2 Policies and Technical Specifications;
Key Judicial Authorities:
• Case C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH [2019] ECLI:EU:C:2019:801 ("Planet49");
• Case C-311/18, Data Protection Commissioner v Kestrel Services Inc. Ireland Limited and Maximillian Schrems [2020] ECLI:EU:C:2020:559 ("Schrems II");
• Belgian Data Protection Authority Decision 21/2022 of 2 February 2022 in the matter of IAB Europe (as subsequently addressed by the CJEU referral in Case C-604/22);
• CNIL Enforcement Decision SAN-2022-009 (Ashbury Holdings Ireland Operations Limited), 19 December 2022;
• CNIL Enforcement Decision SAN-2022-008 (Dunmore & Co. Technology Limited), 29 December 2022.
3. Cookie Audit Findings — Technical Summary with Legal Overlay
3.1 Overview of Cookies Identified
The Thistlewood technical audit identified a total of 312 unique cookies deployed across AGMG's 14 European websites during the audit period. These cookies were categorised by Thistlewood in accordance with the classification taxonomy adopted by the IAB TCF 2.2 framework and the CNIL's recommended cookie categorisation, as follows:
The predominance of targeting and advertising cookies (42.0% of all cookies) reflects AGMG's heavy reliance on programmatic advertising and audience-based monetisation across its European digital properties. This distribution is broadly consistent with media industry norms but is notable in the context of the current regulatory proceedings, as the CNIL has historically applied heightened scrutiny to advertising cookies relative to other categories.
Of the 312 cookies identified, 74 cookies (23.7%) were observed to fire before any user consent interaction — that is, before the user was presented with the Brightleaf ConsentShield consent banner or before the user had taken any action in response to it. This finding was consistent across all three scanning passes conducted by Thistlewood.
Of these 74 pre-consent cookies:
• 38 cookies (51.4% of pre-consent cookies) were classified as strictly necessary under the ePrivacy Directive Article 5(3) exemption and are discussed in Section 3.3 below; and
• 36 cookies (48.6% of pre-consent cookies) were classified as non-compliant, firing without any valid legal basis. These 36 non-compliant cookies are the subject of detailed analysis in Section 3.2 below.
The finding that 36 non-compliant cookies fire before consent is obtained represents a clear and systematic violation of the consent requirements under the ePrivacy Directive and its national implementing legislation, as well as the GDPR. The scale of this non-compliance — affecting multiple cookie categories and multiple properties — is likely to be regarded by the CNIL and ICO as evidence of a systemic failure in AGMG's consent architecture rather than an isolated configuration error.
3.2 Non-Compliant Pre-Consent Cookies: Detailed Analysis
The 36 non-compliant cookies identified by Thistlewood as firing without valid consent are distributed across the following categories:
Distribution Across Websites. The 36 non-compliant cookies were not uniformly distributed across AGMG's 14 European websites. The following table summarises the distribution by property, with the highest-impact sites highlighted:
Note: Individual site totals exceed 36 because certain cookies are deployed across multiple properties and are counted once in the total unique cookie count but appear on multiple sites.
The finding that aurelius-stream.fr has the highest individual count of non-compliant pre-consent cookies (14) is particularly significant given that this is the website that is the subject of the CNIL complaint PLT-2023-FR-04821 filed by DRE. The DRE complaint alleged 47 third-party tracking cookies deploying before consent on aurelius-stream.fr. Thistlewood's methodology, which distinguishes between unique cookies and cookie instances across page loads, confirmed a subset of 36 unique non-compliant cookies on a cross-property basis, with aurelius-stream.fr exhibiting 14 of these. The discrepancy between DRE's figure of 47 and Thistlewood's finding of 14 for aurelius-stream.fr specifically may be attributable to differences in counting methodology (DRE may have counted cookie instances across multiple page loads or may have included cookies that Thistlewood classified as strictly necessary upon deeper analysis). However, the existence of 14 non-compliant cookies on aurelius-stream.fr alone is more than sufficient to substantiate the core of DRE's complaint.
Legal Analysis. Each of the 36 non-compliant cookies constitutes a violation of the following legal requirements:
ePrivacy Directive Article 5(3). Article 5(3) of the ePrivacy Directive, as implemented in the relevant national laws, provides that the storage of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with the GDPR, among other things, about the purposes of the processing. The only exemption applies to cookies that are "strictly necessary" to provide an information society service explicitly requested by the user. The 36 non-compliant cookies — which consist of advertising, analytics, and cross-device tracking cookies — do not fall within the strictly necessary exemption, as they serve purposes (advertising targeting, user profiling, cross-device identification) that are not necessary to provide the service requested by the user. Their deployment without prior informed consent violates Article 5(3).
In France specifically, Article 5(3) of the ePrivacy Directive is implemented by Article 82 of the Loi Informatique et Libertés, which mirrors the consent requirement for storing or accessing information on user terminal equipment. The CNIL's Délibération n° 2020-091 provides detailed guidance on the application of Article 82, including the requirement that consent be obtained before any non-essential cookies are set. The 14 non-compliant cookies on aurelius-stream.fr constitute a clear violation of Article 82.
In the United Kingdom, Article 5(3) is implemented by Regulation 6 of PECR, which requires that a person shall not store or gain access to information stored in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met — namely, that the user is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information, and the user has given his or her consent. The 8 and 7 non-compliant cookies on aureliusnews.co.uk and shopaurelia.co.uk respectively constitute violations of PECR Regulation 6.
GDPR Article 5(1)(a) — Lawfulness, Fairness, and Transparency. Article 5(1)(a) requires that personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject. The processing of personal data through the 36 non-compliant cookies — which collect identifiers such as user IDs, device fingerprints, and browsing behaviour — without obtaining the user's prior consent violates the lawfulness principle. The failure to transparently inform users that such cookies are being deployed before consent is obtained also violates the transparency principle.
GDPR Article 6(1)(a) — Consent. Where consent is the applicable legal basis for processing (as it is for advertising, analytics, and cross-device tracking cookies deployed in the adtech context), Article 6(1)(a) requires that the data subject has given consent to the processing of his or her personal data for one or more specific purposes. No valid consent has been obtained for the 36 non-compliant cookies, as they fire before the user has had any opportunity to interact with the consent mechanism.
It is important to note that consent cannot be retrospectively relied upon. Even if a user subsequently clicks "Accept All" on the Brightleaf ConsentShield consent banner, this acceptance cannot retrospectively validate the processing that occurred during the period between page load and the user's consent interaction. The Court of Justice of the European Union confirmed in Planet49 (Case C-673/17) that consent must be obtained prior to the commencement of processing, must be specific and informed, must be freely given, and must constitute an unambiguous indication of the data subject's wishes by way of a clear affirmative act. Pre-ticked boxes, silence, or inactivity do not constitute valid consent. By extension, cookies that fire before any user action cannot benefit from consent as a legal basis.
3.3 Cookies Correctly Classified as Strictly Necessary
Of the 74 cookies observed to fire before any consent interaction, 38 cookies were classified by Thistlewood as strictly necessary and are, in C&H's legal assessment, legitimately exempt from the consent requirement under ePrivacy Directive Article 5(3).
These 38 cookies serve the following functions:
• Session management cookies (12 cookies): session identifiers maintaining user state during a browsing session, enabling navigation between pages without loss of context;
• Load-balancing cookies (6 cookies): distributing user requests across AGMG's server infrastructure to maintain website performance and availability;
• User authentication cookies (8 cookies): maintaining login state for authenticated users on properties that offer user accounts (e.g., aurelius-stream.fr, aureliusnews.co.uk, shopaurelia.co.uk);
• Security cookies (7 cookies): CSRF (Cross-Site Request Forgery) protection tokens, bot detection cookies, and fraud prevention identifiers; and
• Content delivery network cookies (5 cookies): cookies set by AGMG's CDN provider to facilitate content delivery and caching.
The legal basis for these cookies under ePrivacy Directive Article 5(3) is the exemption for cookies that are "strictly necessary for the provision of an information society service explicitly requested by the subscriber or user." C&H is satisfied that each of the 38 cookies identified as strictly necessary meets this test: each serves a function that is essential to the delivery of the service that the user has requested by visiting the website, and none is used for secondary purposes such as advertising, profiling, or analytics.
No remediation is required for these 38 cookies. However, C&H recommends that AGMG document the strictly necessary classification of each cookie in its cookie inventory, including a brief justification for the classification, and ensure that this information is reflected in the transparency notices (cookie policies) published on each website. This documentation will be important in the context of the CNIL compliance response and any future regulatory scrutiny, as it demonstrates that AGMG has conducted a considered assessment of which cookies qualify for the strictly necessary exemption rather than claiming the exemption without analysis.
3.4 Per-Site Cookie Compliance Matrix
The following table provides a summary of the cookie compliance posture for each of AGMG's 14 European websites. The "Non-Compliant" column identifies cookies that fire before consent and are not classified as strictly necessary. A complete cookie-level inventory is provided in Appendix A.
Note: Individual site totals in the "Non-Compliant" column reflect the number of non-compliant cookies observed on that specific site. Because many cookies are deployed across multiple sites, the sum of individual site counts exceeds the 36 unique non-compliant cookies identified on a cross-property basis.
The matrix confirms that the properties subject to active regulatory proceedings — aurelius-stream.fr (CNIL), aureliusnews.co.uk (ICO), and shopaurelia.co.uk (ICO) — are among the most significantly affected sites. The streaming platforms (aurelius-stream.fr, .de, .nl, .es, .it) exhibit a particularly high concentration of advertising and cross-device tracking cookies, which reflects the greater monetisation intensity applied to streaming content relative to news and editorial content.
4. Server-Side Tracking Pixel Analysis
4.1 Overview. The Thistlewood network traffic analysis identified 19 unique server-side tracking pixels deployed across AGMG's European digital properties. Server-side tracking pixels differ from traditional client-side tracking pixels in that they are executed on AGMG's servers rather than in the user's browser. When a user loads a page, the AGMG server makes a server-to-server call to the third-party vendor's servers, transmitting data about the user and the page view. Because these calls originate from the server side, they are not visible to the user's browser and cannot be blocked by browser-based ad blockers or privacy extensions.
Of the 19 server-side pixels identified:
• 12 pixels were found to transmit personal data to third-party adtech vendors without valid user consent. These 12 pixels are deployed on 9 of the 14 European websites and represent a serious compliance deficiency.
• 7 pixels were found to be operating within compliant parameters. Of these, 4 are consent-gated (they only fire after the user has provided consent via the Brightleaf ConsentShield CMP, with the server-side logic checking the consent status before executing the pixel call), and 3 process only anonymised or aggregated data that does not constitute personal data under GDPR Article 4(1).
The distinction between compliant and non-compliant server-side pixels is critical. The 7 compliant pixels demonstrate that consent-gated server-side tracking is technically feasible within AGMG's existing infrastructure. The non-compliance of the remaining 12 pixels is therefore attributable to configuration and integration failures rather than fundamental technical limitations.
4.2 Non-Compliant Server-Side Pixels: Technical Characterisation
The 12 non-compliant server-side tracking pixels transmit the following categories of personal data to third-party adtech vendors:
• IP addresses (transmitted by all 12 pixels): the full, untruncated IPv4 or IPv6 address of the user's device, as captured by AGMG's web servers;
• Device fingerprints (transmitted by 10 of 12 pixels): composite identifiers derived from the user's browser user agent string, screen resolution, installed fonts, language settings, time zone, and other browser-reported characteristics. These fingerprints are generated by JavaScript code embedded in the page that executes client-side, collects the relevant device attributes, and passes them to the AGMG server, which then forwards them to the third-party vendor via the server-side pixel call;
• Browsing history (transmitted by 8 of 12 pixels): information about the user's browsing activity on AGMG properties, including pages visited, dwell time on each page, click paths, and scroll depth.
Each of these data categories constitutes personal data under GDPR Article 4(1). IP addresses have been recognised as personal data by the CJEU (Case C-582/14, Breyer v Bundesrepublik Deutschland). Device fingerprints are identifiers that relate to identified or identifiable natural persons: the combination of browser attributes, screen resolution, installed fonts, and other characteristics creates a unique or near-unique identifier that can be used to single out an individual user across browsing sessions. Browsing history, when combined with an IP address or device fingerprint, is personal data because it relates to the behaviour of an identified or identifiable individual.
The 12 non-compliant pixels are deployed across 9 of AGMG's 14 European websites. Notably, VoltGraph Analytics GmbH's server-side tracking pixels are deployed on all 9 of these sites, making VoltGraph the most pervasive non-compliant pixel vendor in AGMG's ecosystem.
Critical Architectural Gap. The most significant technical finding regarding the server-side pixels is that the Brightleaf ConsentShield CMP's tag manager does not currently control server-side pixel execution. The ConsentShield CMP operates as a client-side tag management system: it manages the firing of JavaScript tags in the user's browser based on the user's consent preferences. However, the server-side pixels operate outside the browser environment. When a page load event occurs, the AGMG server executes the server-side pixel calls independently of the CMP's tag management logic. There is no integration between the ConsentShield CMP and the server-side pixel execution layer that would allow the CMP to prevent server-side pixels from firing in the absence of consent.
This architectural gap means that even if the ConsentShield CMP were perfectly configured to block all non-essential client-side cookies and tags until consent is obtained, the server-side pixels would continue to transmit personal data to third-party vendors without regard to the user's consent status. This is a fundamental flaw in AGMG's consent architecture that must be addressed as a matter of urgency.
4.3 Legal Analysis of Server-Side Pixels
The legal analysis of the 12 non-compliant server-side tracking pixels mirrors the analysis applicable to non-compliant cookies but raises additional complexities arising from the server-side execution model.
ePrivacy Directive Article 5(3). The application of Article 5(3) to server-side tracking pixels depends on whether the pixel involves the "storing of information" or "gaining of access to information already stored" in the user's terminal equipment. The 10 pixels that transmit device fingerprints involve a two-step process: first, JavaScript code embedded in the web page accesses information stored on the user's terminal equipment (browser attributes, installed fonts, screen resolution, etc.); second, this information is transmitted to the AGMG server, which forwards it to the third-party vendor. The first step — the client-side JavaScript accessing information on the user's device — falls squarely within the scope of Article 5(3) and requires prior informed consent. The fact that the subsequent transmission occurs server-to-server rather than browser-to-server does not alter the analysis: the initial access to the user's terminal equipment triggers the consent requirement.
For the 2 pixels that transmit only IP addresses (without device fingerprinting), the Article 5(3) analysis is less straightforward, as the IP address is captured by the web server in the ordinary course of serving the HTTP request rather than through a deliberate act of accessing information on the user's terminal equipment. However, even for these pixels, the GDPR provides an independent legal basis requirement.
GDPR Article 6(1)(a). Irrespective of the ePrivacy Directive analysis, the processing of personal data (IP addresses, device fingerprints, browsing history) through the server-side pixels requires a legal basis under GDPR Article 6(1). For adtech profiling purposes — which is the purpose for which the data is transmitted to the third-party vendors — consent under Article 6(1)(a) is the only appropriate legal basis. Legitimate interest under Article 6(1)(f) is not available for adtech profiling purposes, as discussed in Section 6.3 below. Contractual necessity under Article 6(1)(b) does not apply because the processing is not necessary for the performance of the contract between AGMG and the user. No other legal basis is applicable.
Since no valid consent is obtained for the server-side pixel data transmissions (the CMP does not control server-side pixel execution), the processing lacks a legal basis and violates Article 6(1)(a).
Relevance to the ICO Inquiry. The ICO inquiry ICO/ENF/2023/LTR-11084 specifically targets server-side tracking on aureliusnews.co.uk and shopaurelia.co.uk. The findings of the Thistlewood audit directly implicate the subject matter of the ICO investigation: Thistlewood identified 8 non-compliant server-side pixels on aureliusnews.co.uk and 7 on shopaurelia.co.uk, all transmitting personal data to third-party adtech vendors without consent. AGMG's response to the ICO inquiry will need to address these findings and demonstrate a credible remediation plan. Failure to do so risks escalation from an informal inquiry to a formal investigation, with significantly increased enforcement exposure.
PECR Regulation 6. For the UK properties, Regulation 6(1) of PECR provides that a person shall not store or gain access to information stored in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met. The JavaScript-based device fingerprinting executed by the server-side pixel system accesses information stored on the user's terminal equipment and therefore requires the user's informed consent under PECR Regulation 6(2).
Risk Assessment. C&H considers the server-side pixel issue to be of particular concern from a regulatory risk perspective. Unlike misconfigurated client-side cookies — which could be characterised as a CMP configuration error — the server-side pixel non-compliance demonstrates a systemic architectural flaw in AGMG's consent framework. The complete absence of any integration between the CMP and the server-side pixel execution layer indicates that AGMG's engineering team either did not consider the consent implications of server-side tracking or deliberately designed the system to operate outside the consent framework. Neither explanation is favourable from a regulatory perspective. The CNIL and ICO may treat the architectural nature of this non-compliance as an aggravating factor, as it suggests a more deeply embedded disregard for consent requirements than a simple configuration error would imply.
4.4 Recipient Vendors of Non-Compliant Pixel Data
The 12 non-compliant server-side tracking pixels transmit personal data to 9 third-party adtech vendors. Two of these vendors are of particular significance given the volume of data processed and the financial materiality of the commercial relationships:
Pendleton AdTech Solutions Ltd ("Pendleton")
• Registered Address: 22 Grand Canal Dock, Block 4, Dublin D02 HW94, Ireland
• Company Registration Number: CRO No. 614823
• Nature of Services: Demand-side platform ("DSP") and real-time bidding ("RTB") services for programmatic display and video advertising across AGMG's European properties
• Data Processing Volume: Approximately 4.2 billion ad bid requests per month involving AGMG user data
• Server-Side Pixel Deployment: Pendleton's server-side pixels are deployed on 7 of AGMG's 14 European websites, transmitting IP addresses, device fingerprints, and browsing history to Pendleton's DSP infrastructure for use in programmatic ad auctions
• Financial Relationship: AGMG pays Pendleton annual technology fees of approximately €2.8 million. Pendleton operates a revenue-share model under which AGMG receives a share of programmatic advertising revenue generated through Pendleton's DSP, with AGMG's annual revenue-share income amounting to approximately €18.4 million. Pendleton is AGMG's largest programmatic advertising partner in Europe by revenue.
• Contractual Status: Existing Master Services Agreement dated 15 June 2021. DPA deficiencies are discussed in detail in Section 6.2.
VoltGraph Analytics GmbH ("VoltGraph")
• Registered Address: Große Elbstraße 44, 22767 Hamburg, Germany
• Company Registration Number: HRB 159742 (Handelsregister Hamburg)
• Nature of Services: Cross-device tracking and audience segmentation analytics, providing AGMG with insights into user behaviour across devices and enabling AGMG to create targeted audience segments for advertising purposes
• Data Processing Volume: Approximately 320 million unique user profiles processed per year from AGMG properties
• Server-Side Pixel Deployment: VoltGraph's server-side tracking pixels are deployed on 9 of AGMG's 14 European websites — the most pervasive deployment of any single vendor — transmitting IP addresses, device fingerprints, and detailed browsing history data
• Financial Relationship: Annual contract value of €1.15 million paid by AGMG to VoltGraph. VoltGraph's audience segmentation capabilities generate an estimated uplift of approximately €4.0 million per year in AGMG's advertising revenue through improved targeting and yield optimisation.
• Contractual Status: No formal DPA in place. Deficiencies are discussed in Section 6.2.
Additional Vendors. The remaining 7 adtech vendors receiving data from non-compliant server-side pixels are as follows:
Controller/Processor Status Analysis. For each of the 9 recipient vendors, C&H has conducted a preliminary assessment of whether the vendor acts as a controller, joint controller, or processor under GDPR Articles 4(7), 4(8), and 26. The initial assessment is as follows:
• Processor status (GDPR Article 4(8)): Most of the 9 vendors act primarily as processors, processing AGMG user data on AGMG's behalf and in accordance with AGMG's instructions for the purpose of providing services to AGMG. This includes VoltGraph (audience segmentation services), NovaBid (header bidding), PixelForge (dynamic creative optimisation), AudienceIQ (data enrichment), TrackPoint (conversion tracking), and DataBridge (analytics processing).
• Potential joint controllership (GDPR Article 26): Pendleton presents a more complex case. While Pendleton is contractually characterised as a processor in the existing MSA, Pendleton's business model involves the use of AGMG user data not only to serve advertisements on AGMG's properties but also to enrich Pendleton's own demand-side platform — incorporating AGMG user data into audience profiles that Pendleton makes available across its broader network of publisher clients. This use of AGMG data for Pendleton's own purposes suggests that Pendleton may jointly determine the purposes and means of processing with AGMG, which would require a joint controller arrangement under GDPR Article 26. Similarly, Cascade Media Technologies and Meridian DataSync may engage in data processing for their own purposes that warrants a joint controllership analysis.
This controller/processor status analysis has material implications for the DPA negotiations discussed in Section 6 and the allocation of data protection responsibilities between AGMG and each vendor. C&H will provide a more detailed analysis of each vendor's status in the forthcoming Gap Analysis Memorandum.
5. Dark Pattern Analysis
5.1 Overview of Consent Mechanism Deficiencies
The Thistlewood audit identified dark-pattern issues in the consent mechanisms deployed on all 14 AGMG European websites and all 3 mobile applications. The consent mechanisms are implemented through the Brightleaf ConsentShield CMP, which is configured and managed by AGMG's internal digital team under the direction of CTO Leander Voss. The EMEA regional relationship with Brightleaf is managed by Katarina van Hoorn, VP EMEA at Brightleaf Consent Technologies EU B.V.
"Dark patterns" in the consent context refers to user interface design choices that manipulate, deceive, or coerce users into making privacy-intrusive choices that they might not otherwise make. The EDPB, CNIL, and other European data protection authorities have increasingly focused on dark patterns as a key area of enforcement, recognising that the validity of consent under the GDPR depends not only on whether a consent mechanism exists but on whether it is designed in a manner that enables freely given, specific, informed, and unambiguous consent.
The dark-pattern issues identified by Thistlewood were a central allegation in the DRE complaint to the CNIL (PLT-2023-FR-04821). DRE's complaint specifically referenced asymmetric button design and pre-ticked boxes on aurelius-stream.fr as evidence that AGMG's consent mechanisms fail to comply with the GDPR and the CNIL's guidelines on cookies and trackers. The Thistlewood findings confirm the substance of DRE's allegations and reveal that the issues are not limited to aurelius-stream.fr but extend across AGMG's entire European digital estate.
The following subsections address each category of dark-pattern deficiency identified by Thistlewood.
5.2 Pre-Ticked Consent boxes
Finding. Pre-ticked consent boxes were found on 6 of 14 European websites. On these 6 sites, when a user navigates to the second-layer "Manage Preferences" interface of the ConsentShield CMP, the checkboxes for advertising/targeting cookie categories and analytics cookie categories are pre-selected (ticked) by default. The user must actively un-tick these boxes to refuse consent for these categories. If the user saves their preferences without un-ticking the boxes, the CMP records consent for advertising and analytics cookies.
The 6 affected websites are: aurelius-stream.fr, aurelius-stream.de, aurelius-stream.nl, aurelius-stream.es, aurelius-stream.it, and aurelius-sport.fr. The pre-ticked boxes are present in the ConsentShield configuration template used for the streaming and sports platforms, which appears to differ from the template used for the news and e-commerce platforms.
Legal Analysis. The use of pre-ticked boxes to obtain consent is a textbook non-compliance finding under EU data protection law. GDPR Article 7, read in conjunction with Recital 32, provides that consent must involve a "clear affirmative act" establishing a "freely given, specific, informed and unambiguous indication of the data subject's agreement." Recital 32 further specifies that "silence, pre-ticked boxes or inactivity should not therefore constitute consent."
The Court of Justice of the European Union confirmed this position definitively in the Planet49 judgment (Case C-673/17, 1 October 2019). In Planet49, the CJEU held that consent within the meaning of the ePrivacy Directive (and the predecessor Data Protection Directive) is not validly given where the storage of information, or access to information already stored, in the user's terminal equipment is permitted by way of a pre-ticked checkbox that the user must deselect to refuse consent. The Court reasoned that it is impossible to determine objectively whether a user who does not deselect a pre-ticked box has in fact given consent.
The CNIL's own guidance (Délibération n° 2020-091 du 17 septembre 2020) explicitly prohibits pre-ticked boxes as a means of collecting consent for cookies and trackers, consistent with the Planet49 judgment and the EDPB Guidelines 05/2020 on consent.
Severity: CRITICAL. The deployment of pre-ticked boxes on 6 websites is a violation that is well-established in law and regulatory guidance, admits of no reasonable defence, and is likely to attract regulatory sanction if not immediately remediated.
5.3 Asymmetric Button Design ("Accept All" vs. "Manage Preferences")
Finding. On all 14 European websites, the first-layer consent banner presents the "Accept All" button with significantly greater visual prominence than the alternative option to manage or reject cookies. Specifically:
• The "Accept All" button is displayed in a contrasting colour (bright green on a white background on most properties; bright blue on certain German-language properties), in a larger font size (16px, bold), and as a clearly defined button element with rounded corners and drop shadow;
• The alternative option — labelled "Manage Preferences" — is displayed in a muted grey colour, in a smaller font size (12px, regular weight), and as a text hyperlink rather than a button element, positioned below or to the side of the prominent "Accept All" button.
The visual disparity between the two options creates a clear hierarchy that steers users toward clicking "Accept All." Thistlewood's manual testing confirmed that the design has a measurable impact on user behaviour: AGMG's own internal analytics (shared with Thistlewood under the common-interest privilege protocol) show that 94.3% of users who interact with the consent banner click "Accept All," while only 5.7% click "Manage Preferences."
Legal Analysis. The EDPB Guidelines 05/2020 on consent provide at paragraph 42 that for consent to be "freely given," "access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining access to information already stored, in the terminal equipment of a user (so-called cookie walls)." More broadly, the EDPB has emphasised that the manner in which consent options are presented can undermine the freely given nature of consent if the design makes it significantly easier to accept than to refuse.
The CNIL's guidance is particularly explicit on this point. The CNIL's Délibération n° 2020-091 and accompanying recommendation require that refusing consent must be as easy as giving consent. Where a website presents an "Accept All" button, it must also present a "Refuse All" (or "Reject All") button at the same level, with equal visual prominence. The asymmetric design identified on AGMG's properties — where acceptance is achieved through a single prominent button click while refusal requires navigating to a secondary interface — fails this test.
The CNIL has imposed significant fines on major platforms for precisely this type of asymmetric design. For example, in its enforcement actions against Severin Industries (SAN-2022-009) and Kestrel Services Inc. (SAN-2022-008), the CNIL cited the asymmetric presentation of accept and refuse options as a basis for finding that consent was not freely given.
Severity: HIGH. While the asymmetric button design is a serious compliance deficiency, it is marginally less severe than the pre-ticked box issue because the CNIL and EDPB guidance on button design is framed in terms of recommendations and enforcement practice rather than absolute prohibitions in the legislative text. However, the CNIL's consistent enforcement practice leaves no doubt that this design will be found non-compliant if scrutinised.
5.4 Absence of "Reject All" Option
Finding. 11 of 14 European websites lack a first-layer "Reject All" button. On these 11 sites, the first-layer consent banner presents only two options: "Accept All" and "Manage Preferences." Users who wish to refuse all non-essential cookies must click "Manage Preferences," navigate to the second-layer interface, deselect individual cookie categories (or, on some sites, click a "Reject All" button available only on the second layer), and then save their preferences. This multi-step process effectively defaults users toward acceptance by creating friction in the refusal pathway.
The 3 websites that do offer a first-layer "Reject All" button are aureliusnews.co.uk, shopaurelia.co.uk, and aureliusstyle.co.uk — all UK properties. This suggests that a prior compliance exercise was conducted for the UK properties (possibly in response to earlier ICO guidance), but the changes were not extended to the EU-facing properties. However, even on these 3 UK sites, the "Reject All" button suffers from the asymmetric design issues described in Section 5.3 (muted colour, smaller font, text hyperlink rather than button element).
Legal Analysis. The CNIL has made the presence of a first-layer "Reject All" option a centrepiece of its cookie enforcement strategy. In multiple enforcement actions — including the high-profile sanctions against Calderon Corporation and Severin Industries Ireland Limited (combined fine of €150 million, 31 December 2021), Kestrel Services Inc. Ireland Limited (€60 million, 31 December 2021), and Ashbury Holdings Ireland Operations Limited (€60 million, 19 December 2022) — the CNIL found that the absence of a mechanism to refuse cookies as simply as to accept them constituted a violation of the freedom of consent. The CNIL's position, consistent with the EDPB's interpretation, is that where an "Accept All" button is presented at the first layer, a "Reject All" button must be presented with equal prominence at the same level.
The absence of a first-layer "Reject All" button on 11 of 14 AGMG European websites — including aurelius-stream.fr, the subject of the CNIL formal notice — is a clear and readily demonstrable violation that will be immediately apparent to the CNIL upon any review of AGMG's properties. Given the CNIL's well-established enforcement precedent on this specific issue, C&H considers this finding to carry a high probability of contributing to a fine if not remediated before the CNIL deadline.
The EDPB consistency view aligns with the CNIL's position. Although the ePrivacy Directive does not prescribe the specific design of consent mechanisms, the GDPR's requirements for freely given consent (Article 4(11)) and the conditions for valid consent (Article 7) are interpreted by the EDPB as requiring equivalence between the ease of accepting and refusing consent.
Severity: CRITICAL. The absence of a first-layer "Reject All" option is directly implicated in the CNIL enforcement precedents most relevant to AGMG's situation and is virtually certain to be cited as a non-compliance finding in any CNIL enforcement decision.
5.5 Consent Withdrawal Difficulty
Finding. On 8 of 14 European websites, withdrawing previously given consent requires 4 or more clicks. The withdrawal process typically requires the user to:
1. Locate and click a "Privacy Settings" or "Cookie Settings" link in the website footer (1 click);
2. Navigate within the privacy centre to a "Cookie Preferences" section (1 click);