PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL
REMEDIATED COOKIE BANNER & CONSENT FLOW SPECIFICATION
AGMG European Digital Properties — Cookie Consent Mechanism and Mobile Application Consent Flow Requirements
PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT PREPARED AT THE DIRECTION OF COUNSEL
15 March 2024
Client:
Aurelius Global Media Group PLC 140 Threadneedle Row London EC2R 8AH United Kingdom
Prepared by:
Priscilla Wynn, Senior Associate Privacy & Data Security Practice Calderwood & Harkness LLP
Alan Burke, Associate Privacy & Data Security Practice Calderwood & Harkness LLP
Reviewed by:
Rachel Bernstein, Partner Privacy & Data Security Practice Calderwood & Harkness LLP
C&H Matter No.: 1017-00008
Addressees:
Sanjay Redworth, Group General Counsel & Company Secretary, AGMG Margaux Fontaine-Li, Group Data Protection Officer, AGMG Leander Voss, Chief Technology Officer, AGMG
Distribution Control:
This document is not to be distributed beyond the named addressees and their direct reports without the prior written consent of Calderwood & Harkness LLP. This document constitutes attorney work product prepared at the direction of counsel in anticipation of regulatory proceedings and is subject to the protections of legal professional privilege, litigation privilege, and the attorney work product doctrine. Unauthorised disclosure may result in a waiver of applicable privileges.
Right-click to update Table of Contents
1. Executive Summary
This Remediated Cookie Banner & Consent Flow Specification (this "Specification") sets forth binding legal, design, and technical requirements for the redesign and deployment of compliant cookie consent banners across all fourteen (14) Aurelius Global Media Group PLC ("AGMG") European-facing websites and compliant consent flows for all three (3) AGMG mobile applications. This Specification is intended to serve as the authoritative implementation guide for AGMG's engineering, product, and data protection teams, and for the configuration of the Brightleaf ConsentShield Consent Management Platform ("CMP"), in order to achieve full compliance with applicable European data protection and electronic privacy legislation.
Regulatory Context. This Specification has been prepared on an expedited basis in response to the following regulatory actions:
(a) CNIL Formal Notice MED-2023-097, dated 14 December 2023, issued by the Commission Nationale de l'Informatique et des Libertés ("CNIL") following Complaint PLT-2023-FR-04821, filed on 8 November 2023 by Digitale Rechte Europa e.V., a German-registered digital rights advocacy organisation. The CNIL formal notice identified multiple violations of Article 82 of the French Loi Informatique et Libertés and Article 5(3) of the ePrivacy Directive in connection with the operation of aurelius-stream.fr, the AGMG streaming platform serving the French market. The CNIL granted an extended compliance deadline of 14 April 2024, subject to the submission of evidence of remediation.
(b) ICO Informal Inquiry ICO/ENF/2023/LTR-11084, dated 22 December 2023, issued by the UK Information Commissioner's Office ("ICO") in relation to aureliusnews.co.uk (AGMG's UK-facing digital news property) and shopaurelia.co.uk (AGMG's UK-facing e-commerce platform). The ICO letter raised concerns regarding compliance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), Regulation 6, and requested a response setting forth AGMG's remediation plan within 90 days.
Cookie Audit Findings. This Specification is informed by the comprehensive technical cookie audit conducted by Thistlewood Consulting Ltd ("Thistlewood") between 22 January 2024 and 16 February 2024, under the direction and legal privilege of Calderwood & Harkness LLP (the "Thistlewood Audit"). The Thistlewood Audit identified a total of three hundred and twelve (312) unique cookies deployed across the fourteen (14) European websites. Of these, thirty-six (36) non-essential cookies were found to be firing before the user provided any form of consent, in direct contravention of Article 5(3) of the ePrivacy Directive and its national implementing legislation. In addition, twelve (12) of nineteen (19) server-side tracking pixels were found to be transmitting personal data — including IP addresses, device fingerprints, and browsing history — to third-party advertising technology ("adtech") vendors without valid consent, representing a significant and systemic compliance failure.
Dark-Pattern Deficiencies. The Thistlewood Audit and Calderwood & Harkness's independent UX review further identified the following dark-pattern deficiencies across the AGMG European website portfolio:
(i) Pre-ticked consent boxes were present on six (6) of the fourteen (14) websites, in direct contravention of the Court of Justice of the European Union's ruling in Planet49 (Case C-673/17) and EDPB Guidelines 05/2020 on consent.
(ii) Asymmetric button design — whereby the "Accept" button was rendered in a larger size, bolder font weight, and more visually prominent colour than the alternative options — was present on all fourteen (14) websites.
(iii) No "Reject All" option was available on eleven (11) of the fourteen (14) websites, requiring users who wished to decline non-essential cookies to navigate through multiple layers of granular preference settings.
(iv) Consent withdrawal required a minimum of four (4) clicks on eight (8) of the fourteen (14) websites, in violation of GDPR Article 7(3) and CNIL guidance requiring withdrawal to be as easy as giving consent.
Compliance Targets. This Specification is designed to achieve full compliance with GDPR Articles 5(1)(a), 6(1)(a), and 7; ePrivacy Directive Article 5(3); UK PECR Regulation 6; the French Loi Informatique et Libertés; the German TTDSG § 25; the Dutch Telecommunicatiewet Article 11.7a; the Spanish LSSI-CE Article 22; the Italian Codice Privacy Article 122; and all applicable regulatory guidance issued by the CNIL, ICO, and the European Data Protection Board ("EDPB").
Deployment Timeline. The remediated cookie banners across all fourteen (14) websites are targeted for deployment by 22 March 2024. Mobile application consent flows across all three (3) applications are targeted for update by 29 March 2024. Both milestones fall within the CNIL's extended compliance deadline of 14 April 2024, allowing adequate time for post-remediation verification scanning and the preparation of the regulatory evidence package.
CMP Integration. Implementation will be achieved through integration with the Brightleaf ConsentShield CMP (IAB TCF 2.2 certified), provided by Brightleaf Consent Technologies EU B.V. (KvK No. 81294503, Herengracht 520, 1017 CC Amsterdam, the Netherlands), at an annual licence fee of €385,000. EMEA coordination will be managed through Katarina van Hoorn, VP EMEA at Brightleaf Consent Technologies EU B.V.
Scope and Audience. This Specification covers audiences across six (6) jurisdictions: the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, representing approximately eighty-seven (87) million monthly active users across AGMG's EU/EEA digital properties.
This Specification should be read in conjunction with the companion documents referenced in Section 2 below.
2. Definitions and Interpretation
In this Specification, the following terms shall have the meanings set forth below, unless the context otherwise requires:
"AGMG" means Aurelius Global Media Group PLC, a public limited company incorporated in England and Wales under Companies House registration number 08741562, with its registered office at 140 Threadneedle Row, London EC2R 8AH, United Kingdom, together with its subsidiaries and affiliates operating the European digital properties described in this Specification.
"Consent" means freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her, as defined in Article 4(11) of the GDPR.
"CMP" means the Consent Management Platform, specifically the Brightleaf ConsentShield product provided by Brightleaf Consent Technologies EU B.V., as described in Section 12 of this Specification.
"CNIL" means the Commission Nationale de l'Informatique et des Libertés, the French national data protection supervisory authority.
"Cookie" means HTTP cookies, local storage objects (including HTML5 localStorage and sessionStorage), IndexedDB entries, and any analogous technology capable of placing information on, or reading information from, an end-user's terminal equipment, as that concept is understood under Article 5(3) of the ePrivacy Directive and the corresponding national implementing legislation.
"Dark Pattern" means any design choice, interface element, or user experience flow that subverts, undermines, or impairs the ability of the data subject to freely give, refuse, or withdraw consent, including without limitation: pre-ticked boxes, default-on toggles, asymmetric button prominence (in terms of size, colour, font weight, or visual hierarchy), hidden or deprioritised refusal options, excessive friction for refusal or withdrawal, misleading language, and content degradation conditioned on consent acceptance.
"EDPB" means the European Data Protection Board.
"ePrivacy Directive" means Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC.
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
"GVL" means the Global Vendor List maintained by IAB Europe under the IAB TCF 2.2 framework.
"IAB TCF 2.2" means the Interactive Advertising Bureau Transparency & Consent Framework, version 2.2, including all associated policies and technical specifications as published by IAB Europe.
"ICO" means the Information Commissioner's Office, the UK data protection supervisory authority.
"Non-Essential Cookie" means any Cookie that is not a Strictly Necessary Cookie, and therefore requires the prior informed consent of the end-user before it may be placed on, or read from, the end-user's terminal equipment.
"PECR" means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), as amended.
"Server-Side Tracking Pixel" means any pixel, beacon, web bug, clear GIF, or server-to-server call that transmits personal data (including but not limited to IP addresses, device fingerprints, cookie identifiers, advertising identifiers, and browsing history) from AGMG's servers or end-user devices to a third-party server, whether executed on the client side or the server side.
"Strictly Necessary Cookie" means a Cookie that is essential for the provision of an information society service explicitly requested by the user, and that is therefore exempt from the consent requirement under ePrivacy Directive Article 5(3) and UK PECR Regulation 6(4), as further defined and classified in Section 10 of this Specification.
"TC String" means the Transparency and Consent string generated by the CMP in accordance with the IAB TCF 2.2 technical specifications, encoding the end-user's consent preferences and the applicable legal and configuration context.
"Thistlewood Audit" means the technical cookie audit and data flow mapping exercise conducted by Thistlewood Consulting Ltd between 22 January 2024 and 16 February 2024 under the direction and legal privilege of Calderwood & Harkness LLP.
"Vendor" means any third party that processes personal data received via Cookies or Server-Side Tracking Pixels from AGMG's European digital properties, including but not limited to Pendleton AdTech Solutions Ltd, VoltGraph Analytics GmbH, and the seven (7) additional adtech vendors identified in the Thistlewood Audit.
"Wireframe" means a schematic visual representation of the consent interface layout, depicting the arrangement, relative sizing, and hierarchy of interface elements without specifying final visual design details such as colours, typography, or imagery.
Companion Documents. This Specification should be read in conjunction with the following companion documents, each prepared under the direction of Calderwood & Harkness LLP and subject to legal professional privilege:
(a) Cookie Audit & Data Flow Mapping Legal Analysis Memorandum, dated 20 February 2024, prepared by Calderwood & Harkness LLP based on the findings of the Thistlewood Audit.
(b) GDPR Gap Analysis Memorandum, dated 4 March 2024, prepared by Calderwood & Harkness LLP, identifying gaps in AGMG's data protection compliance posture across its European digital properties.
Interpretation. In this Specification, unless the context otherwise requires: (i) references to "Sections" are to sections of this Specification; (ii) references to legislation include that legislation as amended, re-enacted, or replaced from time to time; (iii) references to "including" or "includes" are to be construed without limitation; (iv) headings are for convenience only and shall not affect interpretation; and (v) words in the singular include the plural and vice versa.
3. Legal Framework and Regulatory Requirements
3.1 Applicable Legislation
The cookie consent mechanisms and consent flows specified in this document must comply with the following legislative instruments, each of which imposes obligations on the placement of Cookies and analogous technologies on end-user terminal equipment, and/or on the processing of personal data obtained through such technologies:
European Union — General Data Protection Regulation (GDPR). The GDPR applies to all processing of personal data by AGMG in connection with the offering of goods or services to data subjects in the European Union, regardless of whether AGMG is established in the EU. The following GDPR provisions are directly relevant to this Specification:
• Article 5(1)(a) — The principle of lawfulness, fairness, and transparency, requiring that personal data be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Article 6(1)(a) — Consent as a legal basis for processing, requiring that the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Article 7 — Conditions for consent, including the requirement that the controller be able to demonstrate that the data subject has consented (Article 7(1)); that consent requests be presented in a manner clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language (Article 7(2)); that the data subject have the right to withdraw consent at any time, and that withdrawal be as easy as giving consent (Article 7(3)); and that consent is not freely given where it is bundled with non-related matters or where performance of a contract is conditional on consent to processing not necessary for that contract (Article 7(4)).
• Articles 12, 13, and 14 — Transparency obligations, requiring that information about data processing be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language.
European Union — ePrivacy Directive. Directive 2002/58/EC, as amended by Directive 2009/136/EC, imposes specific requirements on the placement of, and access to, information on end-user terminal equipment:
• Article 5(3) — Requires that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information in accordance with the GDPR, about the purposes of the processing. This requirement is subject to a limited exemption for storage or access that is strictly necessary for the provision of an information society service explicitly requested by the subscriber or user.
United Kingdom — Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). PECR, as the UK transposition of the ePrivacy Directive, applies to the AGMG UK-facing properties, including aureliusnews.co.uk and shopaurelia.co.uk:
• Regulation 6 — Mirrors the requirements of ePrivacy Directive Article 5(3), requiring consent before the setting of or access to Cookies on end-user terminal equipment, subject to the exemption in Regulation 6(4) for Strictly Necessary Cookies.
France — Loi Informatique et Libertés. Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as amended, applies to the AGMG French-language properties, including aurelius-stream.fr:
• Article 82 — Implements ePrivacy Directive Article 5(3) in French law, requiring consent before the placement of or access to cookies and trackers on a user's terminal equipment, subject to limited exemptions. This is the primary statutory basis cited in CNIL formal notice MED-2023-097.
Germany — TTDSG. The Telekommunikation-Telemedien-Datenschutz-Gesetz (Telecommunications-Telemedia Data Protection Act), which entered into force on 1 December 2021, applies to AGMG's German-language properties:
• § 25 — Requires consent for the storing of information in, or access to information stored in, the terminal equipment of an end-user, unless such storage or access is strictly necessary for the provision of a telemedia service explicitly requested by the user. Consent must meet the requirements of the GDPR.
Netherlands — Telecommunicatiewet. The Dutch Telecommunications Act applies to AGMG's Netherlands-facing properties:
• Article 11.7a — Implements the ePrivacy Directive in Dutch law, requiring informed consent before the placing of or reading of cookies on end-user terminal equipment, subject to limited exemptions for technically necessary cookies.
Spain — LSSI-CE. The Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico applies to AGMG's Spanish-facing properties:
• Article 22 — Requires informed consent for the use of data storage and retrieval devices on end-user terminal equipment, implementing ePrivacy Directive Article 5(3) in Spanish law.
Italy — Codice Privacy. Decreto Legislativo 30 giugno 2003, n. 196 (Codice in materia di protezione dei dati personali), as amended by Decreto Legislativo 10 agosto 2018, n. 101, applies to AGMG's Italian-facing properties:
• Article 122 — Implements ePrivacy Directive Article 5(3) in Italian law, requiring consent for the use of cookies and similar technologies on end-user terminal equipment, subject to the exemption for technically necessary cookies.
3.2 Regulatory Guidance
In addition to the legislative instruments set forth above, this Specification has been developed with reference to the following regulatory guidance documents, which represent the interpretive positions of relevant supervisory authorities and should be treated as authoritative for the purposes of implementation:
CNIL Guidance:
• "Cookies: solutions for compliant consent" (originally published 2020, updated 2023) — practical implementation guide setting forth CNIL's expectations for cookie consent mechanisms, including the requirement for an equally prominent "Reject All" option, the prohibition of scrolling or continued browsing as consent, and the requirement that consent withdrawal be as easy as giving consent.
• Délibération n° 2020-091 du 17 septembre 2020 — CNIL guidelines on cookies and other trackers, specifying the legal framework, the scope of the consent requirement, the conditions for valid consent, and the limited exemptions for strictly necessary cookies.
ICO Guidance:
• Guidance on the use of cookies and similar technologies (originally published 2019, updated 2023) — ICO's detailed guidance on compliance with PECR Regulation 6, including practical examples of compliant and non-compliant consent mechanisms, and the ICO's position on the use of analytics cookies and legitimate interest.
EDPB Guidance:
• Guidelines 05/2020 on consent under Regulation 2016/679 (version 1.1, adopted 4 May 2020) — comprehensive guidance on the conditions for valid consent under the GDPR, including the requirements of freely given, specific, informed, and unambiguous consent; the prohibition of bundled consent; the requirements for withdrawal of consent; and the treatment of cookie walls.
• Guidelines 2/2023 on dark patterns in social media platform interfaces — while addressed primarily to social media platforms, these guidelines articulate general principles regarding deceptive design practices that undermine user autonomy and consent, and are applicable by analogy to cookie consent interfaces. The EDPB identifies categories of dark patterns including "overloading," "skipping," "stirring," "hindering," and "left in the dark," several of which were identified in the Thistlewood Audit of AGMG properties.
IAB Europe:
• TCF 2.2 Policies and Technical Specifications — the framework governing the generation and propagation of consent signals through the TC String mechanism, vendor registration on the Global Vendor List, and the obligations of CMPs and vendors operating within the TCF ecosystem.
3.3 Key Legal Principles Informing This Specification
The following legal principles, derived from the legislative framework and regulatory guidance described above, underpin every element of this Specification and must be adhered to in all implementation decisions:
Consent Must Be Prior to Processing. No Non-Essential Cookies may be placed on, and no information may be read from, the end-user's terminal equipment before the end-user has provided affirmative consent. No Server-Side Tracking Pixels may fire before consent is obtained. This is a fundamental requirement of ePrivacy Directive Article 5(3) and its national implementing legislation, and any technical implementation that permits non-essential data processing to commence before a valid consent signal is recorded constitutes a violation.
Consent Must Be Granular. Consent must be purpose-specific and must not be bundled across unrelated processing activities. The end-user must have the ability to accept or reject consent for each defined purpose independently. A single "take it or leave it" consent mechanism that bundles all purposes together does not satisfy the requirement of specificity under GDPR Article 4(11).
Consent Must Be Freely Given. The refusal of consent must be as easy as the acceptance of consent, both in terms of the number of actions required and the visual prominence of the options available. No cookie walls may be deployed that condition access to content or services on the acceptance of Non-Essential Cookies. No content degradation, performance penalties, or punitive messaging may be applied to users who decline consent.
Pre-Ticked boxes and Default-On Toggles Do Not Constitute Valid Consent. The Court of Justice of the European Union's ruling in Planet49 (Case C-673/17, ECLI:EU:C:2019:801, judgment of 1 October 2019) confirmed that pre-ticked checkboxes do not constitute valid consent under either the ePrivacy Directive or the GDPR. Consent requires a clear affirmative action by the data subject. All consent toggles must default to the "off" position, and all checkboxes must default to the unchecked state.
Consent Withdrawal Must Be as Easy as Giving Consent. GDPR Article 7(3) requires that withdrawal of consent be as easy as the giving of consent. This Specification mandates that consent withdrawal be achievable in no more than two (2) clicks or taps, through a persistent and always-visible access point on every page of every website and within the settings menu of every mobile application.
The Controller Must Be Able to Demonstrate Consent. GDPR Article 7(1) requires that where processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing. This Specification mandates comprehensive consent record logging, storage, and export capabilities within the CMP.
4. Scope of Application
4.1 European Websites (14 Properties)
This Specification applies to all fourteen (14) AGMG European-facing websites, encompassing the following categories of digital properties:
Streaming Platforms:
(a) aurelius-stream.fr — AGMG's French-language streaming platform, the subject of CNIL Complaint PLT-2023-FR-04821 and formal notice MED-2023-097. Primary jurisdiction: France. Approximately 12.3 million monthly active users.
(b) aurelius-stream.de — AGMG's German-language streaming platform. Primary jurisdiction: Germany. Approximately 9.8 million monthly active users.
(c) aurelius-stream.es — AGMG's Spanish-language streaming platform. Primary jurisdiction: Spain. Approximately 7.2 million monthly active users.
(d) aurelius-stream.it — AGMG's Italian-language streaming platform. Primary jurisdiction: Italy. Approximately 5.6 million monthly active users.
News Sites:
(e) aureliusnews.co.uk — AGMG's UK-facing digital news property, the subject of ICO informal inquiry ICO/ENF/2023/LTR-11084. Primary jurisdiction: United Kingdom. Approximately 18.4 million monthly active users.
(f) aureliusnews.nl — AGMG's Dutch-language news property. Primary jurisdiction: Netherlands. Approximately 4.1 million monthly active users.
(g) aureliusnews.de — AGMG's German-language news property. Primary jurisdiction: Germany. Approximately 6.7 million monthly active users.
E-Commerce:
(h) shopaurelia.co.uk — AGMG's UK-facing e-commerce platform, the subject of ICO informal inquiry ICO/ENF/2023/LTR-11084. Primary jurisdiction: United Kingdom. Approximately 5.3 million monthly active users.
(i) shopaurelia.fr — AGMG's French-language e-commerce platform. Primary jurisdiction: France. Approximately 3.9 million monthly active users.
(j) shopaurelia.de — AGMG's German-language e-commerce platform. Primary jurisdiction: Germany. Approximately 4.2 million monthly active users.
Entertainment Portals:
(k) aureliusentertainment.co.uk — AGMG's UK-facing entertainment and events portal. Primary jurisdiction: United Kingdom. Approximately 3.1 million monthly active users.
(l) aureliusentertainment.es — AGMG's Spanish-language entertainment portal. Primary jurisdiction: Spain. Approximately 2.4 million monthly active users.
Lifestyle and Editorial Sites:
(m) aureliuslife.fr — AGMG's French-language lifestyle and editorial platform. Primary jurisdiction: France. Approximately 2.1 million monthly active users.
(n) aureliuslife.it — AGMG's Italian-language lifestyle and editorial platform. Primary jurisdiction: Italy. Approximately 1.9 million monthly active users.
The combined monthly active users across all fourteen (14) European-facing websites is approximately eighty-seven (87) million. All websites serve audiences across six (6) jurisdictions: the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. Where a website serves users in multiple jurisdictions, the CMP must be configured to serve jurisdiction-specific consent interfaces based on geo-detection, as described in Section 12.
4.2 Mobile Applications (3 Apps)
This Specification applies to the following three (3) AGMG mobile applications:
(a) Aurelius Stream (iOS) — the AGMG streaming application available on the Tidewater Industries App Store, serving French, German, Spanish, and Italian markets. Approximately 14.8 million active installs.
(b) Aurelius News (iOS) — the AGMG digital news application available on the Tidewater Industries App Store, serving UK and Netherlands markets. Approximately 8.2 million active installs.
(c) Aurelius Stream (Android) — the AGMG streaming application available on the Severin Industries Play Store, serving French, German, Spanish, and Italian markets. Approximately 11.6 million active installs.
Both iOS applications must coordinate the GDPR consent flow with Tidewater Industries's App Tracking Transparency ("ATT") framework, as described in Section 9.2. The Android application does not have an equivalent system-level tracking transparency prompt, and the GDPR consent flow is the sole consent mechanism, as described in Section 9.3.
All three (3) mobile applications currently lack granular consent controls and are limited to a single undifferentiated "accept" prompt with no "reject" option and no purpose-level granularity. This Specification mandates that all three applications be remediated to achieve full parity with the website consent mechanism in terms of granularity, symmetry, and user control.
4.3 Out of Scope
The following are excluded from the scope of this Specification:
(a) AGMG digital properties that do not face the European Union, the European Economic Area, or the United Kingdom, including North American, Asia-Pacific, and other international properties.
(b) Internal employee-facing systems, intranets, and corporate tools, which are subject to separate data protection governance frameworks.
(c) Business-to-business ("B2B") platforms that do not process personal data of consumer end-users, including enterprise licensing portals and partner management dashboards.
The exclusion of the foregoing from this Specification does not imply that these systems are exempt from data protection obligations; their compliance is addressed through separate workstreams that are outside the scope of this document.
5. Fundamental Design Principles
This Section establishes the foundational legal and design principles that govern every element of the cookie consent banners and mobile application consent flows specified in this document. These principles are derived from the legal framework set forth in Section 3 and must not be deviated from in any implementation decision, regardless of commercial or operational considerations.
5.1 Pre-Consent Cookie blocking
Mandatory Requirement: No Non-Essential Cookies, tracking pixels, Server-Side Tracking Pixels, or server-side tracking calls of any kind may fire, load, initialise, or execute before the end-user has provided affirmative consent through the CMP for the specific purpose category to which the technology relates. This requirement is absolute and admits of no exceptions.
The Thistlewood Audit identified three hundred and twelve (312) unique cookies deployed across the fourteen (14) European websites. Of these, seventy-four (74) were found to be firing before any form of consent was obtained. Upon review, thirty-eight (38) of these seventy-four were determined to be legitimately classified as Strictly Necessary Cookies (subject to the classification review process described in Section 10). The remaining thirty-six (36) cookies were Non-Essential Cookies that were firing without consent, in direct violation of applicable law. These thirty-six cookies must be blocked until the end-user provides valid, affirmative consent for the relevant purpose category.
In addition, all twelve (12) Server-Side Tracking Pixels identified in the Thistlewood Audit as non-compliant — specifically, those transmitting IP addresses, device fingerprints, and browsing history to Pendleton AdTech Solutions Ltd, VoltGraph Analytics GmbH, and seven (7) other adtech vendors — must be consent-gated. No personal data may be transmitted to these or any other third-party vendors through any tracking mechanism until a valid TC String confirming consent for the relevant purpose has been generated by the CMP.
Implementation: The Brightleaf ConsentShield tag manager integration must enforce server-side blocking. No tags categorised as non-essential may fire until a valid TC String is generated confirming consent for the purpose category to which the tag is assigned. The CMP must function as an absolute gatekeeper: the absence of a valid consent signal must result in the complete suppression of all non-essential tags, without exception and without fallback to any form of implied or presumed consent.
5.2 Elimination of Dark Patterns
The following Dark Pattern deficiencies identified in the Thistlewood Audit and Calderwood & Harkness UX review must be eliminated in their entirety:
Pre-Ticked Consent boxes. All pre-ticked consent boxes must be removed. This deficiency was identified on six (6) of the fourteen (14) websites. All consent checkboxes and toggles must default to the "off" or unchecked state. No form of pre-selection, default activation, or implied acceptance is permissible.
Symmetric Button Design. The "Accept All" and "Reject All" buttons on all consent interfaces must be of equal size, equal colour prominence, equal font weight, and equal visual hierarchy. No design differentiation between the accept and reject options is permissible. This addresses the asymmetric button design identified on all fourteen (14) websites, where the "Accept" button was rendered in a more prominent style than the "Reject" or "Manage Preferences" options.
No Misleading Colour Coding. Colour coding must not be used to steer users toward acceptance. For example, rendering the "Accept" button in green (suggesting positive action) and the "Reject" button in grey or muted tones (suggesting negative or inactive action) is prohibited. A neutral colour palette must be applied uniformly to both accept and reject buttons.
No Hidden or Deprioritised Refusal Options. All refusal options must be displayed on the same visual plane and with the same prominence as acceptance options. Refusal must not require additional clicks, navigation to sub-menus, or scrolling to locate.
No Cookie Walls. Access to content or services must not be conditioned on the acceptance of Non-Essential Cookies. Users who reject all Non-Essential Cookies must be able to access the same content and functionality as users who accept, subject only to the inherent limitations of features that require specific cookie categories (e.g., personalised content recommendations may not function without functional cookies, but core content must remain accessible).
Efficient Consent Withdrawal. Consent withdrawal must be achievable in no more than two (2) clicks or taps. This addresses the audit finding that eight (8) of fourteen (14) websites required four (4) or more clicks to withdraw consent, in violation of GDPR Article 7(3).
No Repeated Prompts After Rejection. The consent banner must not be re-displayed to a user who has already made a choice (whether accepting or rejecting) during the same session. The consent state must be stored (via the CMP's consent-state cookie, which is itself classified as Strictly Necessary) and the banner must not reappear until the stored consent expires or the user affirmatively accesses the consent settings via the persistent access point described in Section 8.
5.3 Granularity. Consent must be provided on a purpose-by-purpose basis. Purpose-level consent toggles must be aligned with the IAB TCF 2.2 purposes and mapped to AGMG's specific processing activities. Users must be able to accept or reject each purpose independently, without being required to accept or reject all purposes as a single bundle. Vendor-level transparency must be available in a second layer, allowing users to understand which specific third-party vendors will receive their data for each purpose.
5.4 Transparency and intelligibility
All consent interfaces must employ plain-language descriptions in all six (6) operating languages (English, French, German, Dutch, Spanish, and Italian). Legal jargon, technical terminology, and ambiguous language must be avoided in user-facing consent interfaces. The consent interface must clearly identify AGMG as the data controller responsible for the website or application. The consent interface must clearly identify the categories of personal data processed and the categories of recipients, at a level of specificity sufficient to enable an informed decision by the end-user.
5.5 Demonstrability. The CMP must log and store comprehensive consent records sufficient to enable AGMG to demonstrate, in response to any regulatory inquiry or data subject request, that valid consent was obtained before any Non-Essential Cookie was placed or any personal data was transmitted to a Vendor. Each consent record must include, at a minimum: the timestamp of the consent event, the version of the consent interface presented to the user, the user's action (accept or reject for each purpose), the user's IP address (or an anonymised session identifier, if IP address storage raises proportionality concerns), and the TC String generated by the CMP. Consent records must be retained for a minimum period of three (3) years, consistent with the limitation periods applicable to regulatory enforcement proceedings. Records must be exportable in machine-readable formats (JSON and/or CSV) for regulatory response purposes.
6. Cookie Banner Specification — Websites (Layer 1)
6.1 Initial Banner Appearance and Placement
The Layer 1 cookie consent banner must appear as either a modal overlay (centred on the viewport, with the underlying page content dimmed or blurred) or a bottom-pinned bar (anchored to the bottom of the viewport, overlaying the underlying page content) upon the first visit by an end-user to any of the fourteen (14) AGMG European-facing websites, or when the end-user's prior consent state has expired in accordance with the CMP's configured consent retention period.
The banner must be non-dismissable without an affirmative choice by the end-user. The end-user must take one of the following actions to dismiss the banner: (a) click "Accept All"; (b) click "Reject All"; or (c) click "Manage Preferences" and navigate through the Layer 2 Preference Centre to save their selections. No other action may dismiss the banner.
Specifically, the following user actions must NOT constitute consent and must NOT dismiss the banner:
(a) Clicking outside the banner area (on the underlying page content).
(b) Scrolling the underlying page content.
(c) Navigating to another page on the website (the banner must persist across page navigations until an affirmative choice is made).
(d) Pressing the "Escape" key or performing any gesture equivalent to closing a dialog.
The banner must not obstruct critical navigational elements in a manner that prevents the user from identifying the nature and content of the website, but must be prominently visible and centrally positioned in the user's field of view. The banner must not be rendered in a manner that encourages the user to dismiss it without reading its content (e.g., by placing it in a corner of the screen or rendering it at a size that makes it inconspicuous).
The banner must incorporate responsive design, adapting its layout and dimensions to desktop, tablet, and mobile viewports. The Wireframe requirements for each viewport are set forth in Section 20 (Appendix C).
6.2 Button Layout and Hierarchy
Three (3) buttons must be displayed on the Layer 1 banner:
1. "Accept All" (or localised equivalent per Section 6.4) — When clicked, this button accepts all Non-Essential Cookie categories. The CMP generates a TC String reflecting consent for all declared purposes and vendors, and all non-essential tags are permitted to fire.
2. "Reject All" (or localised equivalent per Section 6.4) — When clicked, this button rejects all Non-Essential Cookies. Only Strictly Necessary Cookies remain active. The CMP generates a TC String reflecting the refusal of consent for all non-essential purposes and vendors. No non-essential tags may fire.
3. "Manage Preferences" (or localised equivalent per Section 6.4) — When clicked, this button opens the Layer 2 Preference Centre (described in Section 7) for granular purpose-level and vendor-level consent management.
The "Accept All" and "Reject All" buttons must be visually identical in the following respects:
(a) Size: Both buttons must occupy the same dimensions (width and height). Neither button may be rendered larger or smaller than the other.
(b) Colour: Both buttons must use the same background colour, border colour, and text colour. Neither button may be rendered in a more prominent or attractive colour than the other. A neutral colour palette is required (e.g., both buttons in the same shade of blue, grey, or white with dark text).
(c) Font: Both buttons must use the same font family, font size, and font weight.
(d) Placement: Both buttons must be positioned side by side on the same horizontal plane (on desktop viewports) or stacked vertically with equal width and equal vertical spacing (on mobile viewports). Neither button may be positioned above, before, or in a more prominent location than the other.
(e) Visual hierarchy: Neither button may be rendered as a "primary" button (e.g., filled/solid) while the other is rendered as a "secondary" button (e.g., outlined/ghost). Both buttons must use the same visual style.
The "Manage Preferences" button may be styled differently from the "Accept All" and "Reject All" buttons — for example, as a text link or as a secondary-styled button — but must be clearly visible, legible, and positioned on the same visual plane as the other two buttons. It must not be hidden, minimised, or rendered in a manner that discourages its use.
No button may be pre-selected as a default. No button may be highlighted, pulsed, animated, or otherwise rendered in a manner that draws disproportionate attention to it relative to the other buttons.
6.3 Mandatory Banner Copy (English Template)
The following English-language template must be used for the Layer 1 banner on all UK-facing properties, and shall serve as the master template from which all localised versions are translated:
"We use cookies and similar technologies on this website. Some are strictly necessary for the site to function. Others help us improve your experience, personalise content, and deliver relevant advertising. You can accept all, reject all non-essential cookies, or manage your preferences below."
In addition to the introductory text above, the banner must include the following elements:
(a) Controller identification: "This website is operated by Aurelius Global Media Group PLC."
(b) Privacy policy link: A hyperlink labelled "Read our Cookie Policy" (or localised equivalent) that links to the full cookie policy for the relevant property, as described in Section 13.
(c) Withdrawal notice: "Consent is voluntary and can be withdrawn at any time via the Cookie Settings link at the bottom of any page."
The total word count for the Layer 1 banner text (excluding button labels and the link to the cookie policy) must not exceed eighty (80) words. This conciseness requirement ensures that the banner remains readable and that users are not deterred from engaging with the consent mechanism by excessive text. More detailed information is available in the Layer 2 Preference Centre and the full cookie policy.
6.4 Localised Banner Copy
The full banner text, all button labels, and all purpose descriptions must be provided in all six (6) languages served by AGMG's European digital properties. The language of the consent interface must match the primary language of the domain or property on which it is displayed. The following localised button labels must be used:
The English template set forth in Section 6.3 must be translated into each of the other five languages by a qualified human translator with expertise in data protection terminology in the relevant language. Machine translation is not acceptable for the primary consent copy. All translations must be reviewed by a native speaker and approved by the AGMG DPO (Margaux Fontaine-Li) before deployment. The full localised banner copy is set forth in Appendix A (Section 18).
6.5 Wireframe Requirements — Layer 1 Banner
The Layer 1 banner must conform to the following schematic layout requirements. Detailed wireframe mockups are provided in Appendix C (Section 20).
Desktop Layout:
The banner is presented as a centred bottom-anchored bar spanning the full width of the viewport. The banner contains, from top to bottom: (a) an optional AGMG logo or icon (small, non-dominant); (b) the introductory text block, centred or left-aligned; (c) three buttons arranged in a horizontal row, centred within the banner, with equal spacing — "Accept All" on the left, "Reject All" on the right, or vice versa, provided both are given equal visual weight; and (d) the "Manage Preferences" link or button, centred below the primary buttons, with the cookie policy link immediately below.
Mobile Layout:
The banner is presented as a full-width bottom sheet. Due to the limited horizontal space, the three buttons are stacked vertically with equal width. The button order from top to bottom must be: "Accept All," "Reject All," "Manage Preferences." The introductory text block appears above the buttons and is scrollable if necessary to accommodate the text within the available viewport height.
Colour and Accessibility: