PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / LITIGATION PRIVILEGE
CALDERWOOD & HARKNESS LLP One Finsbury Square, London EC2A 1AE, United Kingdom
MEMORANDUM
4 March 2024
To:
Sanjay Redworth, Group General Counsel & Company Secretary, Aurelius Global Media Group PLC
Margaux Fontaine-Li, Group Data Protection Officer, Aurelius Global Media Group PLC
Leander Voss, Chief Technology Officer, Aurelius Global Media Group PLC
From:
Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
Priscilla Wynn, Senior Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP
Re: Comprehensive GDPR Gap Analysis — European Digital Properties of Aurelius Global Media Group PLC
Matter No.: C&H 1017-00008
Privileged & Confidential — Prepared at the Direction of Counsel in Anticipation of Regulatory Proceedings. This memorandum is protected by attorney-client privilege and litigation privilege. It is intended solely for the named recipients and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
1. Executive Summary
This memorandum sets forth the findings of Calderwood & Harkness LLP's ("C&H") comprehensive gap analysis of the fourteen (14) European-facing websites and three (3) mobile applications (collectively, the "European Digital Properties") operated by Aurelius Global Media Group PLC ("AGMG" or the "Company") against the requirements of applicable data protection and e-privacy legislation across the European Economic Area and the United Kingdom. This analysis synthesises the findings of the technical cookie audit conducted by Thistlewood Consulting Ltd ("Thistlewood") (completed 16 February 2024) and the data flow mapping exercise (completed 28 February 2024), and overlays the legal analysis previously delivered by C&H in our Cookie Audit & Data Flow Mapping Legal Analysis Memorandum dated 20 February 2024.
This memorandum is prepared against a backdrop of urgent regulatory activity. On 8 November 2023, the German-based digital rights advocacy organisation Digitale Rechte Europa e.V. ("DRE") filed a complaint with the Commission nationale de l'informatique et des libertés ("CNIL") under reference PLT-2023-FR-04821, alleging systematic violations of cookie consent requirements on AGMG's French-language streaming platform, aurelius-stream.fr. On 14 December 2023, the CNIL issued a formal notice ("mise en demeure") under reference MED-2023-097, requiring AGMG to bring its practices into compliance within three months. The compliance deadline imposed by the CNIL falls on 14 March 2024 — ten (10) calendar days from the date of this memorandum. Additionally, the United Kingdom Information Commissioner's Office ("ICO") issued an informal inquiry letter on 22 December 2023 under reference ICO/ENF/2023/LTR-11084, directed at server-side tracking pixels deployed on AGMG's UK-facing properties aureliusnews.co.uk and shopaurelia.co.uk.
Given the complexity of the remediation required across fourteen websites, three mobile applications, twenty-three third-party adtech vendor relationships, and six jurisdictions, C&H strongly recommends that AGMG seek a 30-day extension of the CNIL compliance deadline to 14 April 2024. We advise that this extension request be filed no later than 11 March 2024 and C&H stands ready to prepare and submit the request on AGMG's behalf.
Regulatory Exposure. The maximum potential fine under GDPR Article 83(5) is the higher of €20 million or 4% of AGMG's total worldwide annual turnover of the preceding financial year. Based on AGMG's reported global annual turnover of £1.42 billion (approximately €1.617 billion at a GBP/EUR exchange rate of approximately 1.139), the 4% threshold yields a theoretical maximum fine of approximately €64.7 million. Based on our analysis of CNIL enforcement precedent, the nature and scope of the infringements identified, and the available mitigating factors, C&H estimates a realistic fine range of €3 million to €8 million absent meaningful remediation. The ICO's maximum fine exposure under the UK GDPR and the Data Protection Act 2018 is £17.5 million or 4% of annual global turnover, whichever is higher.
Commercial Exposure. Approximately €26.3 million in annual revenue is at risk if non-compliant adtech vendor relationships must be terminated rather than remediated. This figure comprises €18.4 million in revenue-share from Pendleton AdTech Solutions Ltd ("Pendleton"), €4.0 million in attributable uplift from VoltGraph Analytics GmbH ("VoltGraph") audience segmentation capabilities, and approximately €3.9 million from seven other non-compliant vendors. While C&H does not recommend termination as the preferred course of action, the Company should understand the scale of commercial impact should remediation negotiations fail.
Scale of Operations. AGMG's European Digital Properties serve approximately 87 million monthly active users ("MAUs") across six jurisdictions (United Kingdom, France, Germany, Netherlands, Spain, and Italy). The Company reported £612 million in EU/EEA digital revenue for the financial year ending 31 December 2023. The scale and cross-border nature of these operations significantly elevate both regulatory scrutiny and enforcement risk.
Remediation Roadmap. This memorandum proposes seven (7) discrete remediation workstreams, phased over approximately eight weeks from the date hereof:
1. Consent Mechanism Redesign — elimination of dark patterns, implementation of compliant cookie banners and mobile app consent flows;
2. Server-Side Pixel Remediation — consent-gating of all server-side tracking pixels;
3. DPA Renegotiation — negotiation and execution of GDPR-compliant Data Processing Agreements with nine non-compliant vendors;
4. Vendor Audit Rights — securing Article 28(3)(h) audit and inspection rights across all twenty-three vendor relationships;
5. DPIA Updates — updating and preparing Data Protection Impact Assessments for high-risk processing activities;
6. ROPA Update — comprehensive update of AGMG's Article 30 Records of Processing Activities;
7. Regulatory Responses — drafting and submitting compliance responses to both the CNIL and the ICO.
Each finding in this memorandum is risk-rated on a four-tier scale: Critical (likely regulatory enforcement, high fine risk, systemic non-compliance), High (probable enforcement interest, significant remediation needed), Medium (gap identified requiring correction but lower enforcement risk), and Low (best-practice recommendation, minor gap).
This memorandum identifies eight (8) Critical-rated findings, ten (10) High-rated findings, and three (3) Medium-rated findings. The concentration of Critical findings across cookie consent mechanisms, server-side pixels, vendor legal basis assertions, consent validity, data processing agreements, and international data transfers indicates a systemic compliance failure that demands urgent, coordinated remediation.
2. Scope and Methodology
2.1 Scope of Review
The scope of this gap analysis encompasses the entirety of AGMG's European-facing digital operations, as follows:
Websites. All fourteen (14) AGMG websites serving European audiences, including but not limited to:
• aurelius-stream.fr (French-language streaming platform — subject of CNIL complaint PLT-2023-FR-04821);
• aureliusnews.co.uk (UK English-language news portal — subject of ICO inquiry ICO/ENF/2023/LTR-11084);
• shopaurelia.co.uk (UK English-language e-commerce platform — subject of ICO inquiry ICO/ENF/2023/LTR-11084);
• and eleven additional websites serving audiences in France, Germany, the Netherlands, Spain, and Italy across news, entertainment, streaming, and e-commerce verticals.
A complete enumeration of all fourteen websites, including URLs, operating jurisdictions, and languages, is set forth in Appendix A to this memorandum.
Mobile Applications. All three (3) AGMG mobile applications distributed to EU/EEA users, comprising two (2) iOS applications and one (1) Android application. These applications serve audiences across all six of AGMG's European operating jurisdictions. A complete listing is set forth in Appendix A.
Third-Party Adtech Vendors. All twenty-three (23) third-party advertising technology vendors that process personal data of AGMG users in connection with the European Digital Properties. A comprehensive vendor compliance status matrix is set forth in Appendix C.
Consent Management Platform. The Brightleaf ConsentShield consent management platform ("CMP"), which is deployed across all of AGMG's European Digital Properties. Brightleaf ConsentShield is certified under the IAB Transparency and Consent Framework version 2.2 ("IAB TCF 2.2"). AGMG's annual license for ConsentShield is €385,000. The EU operating entity is Brightleaf Consent Technologies EU B.V., registered with the Dutch Chamber of Commerce under KvK No. 81294503, with registered offices at Herengracht 520, 1017 CC Amsterdam, the Netherlands.
2.2 Legal Framework Assessed
The gap analysis assesses AGMG's compliance against the following legal instruments and regulatory guidance:
EU Legislation:
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), with particular focus on Articles 4(11), 5, 6, 7, 13, 14, 25, 28, 30, 35, and 44–49;
• Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the "ePrivacy Directive"), Article 5(3), as transposed into the national laws of France, Germany, the Netherlands, Spain, and Italy.
United Kingdom Legislation:
• The UK General Data Protection Regulation (as retained and incorporated into domestic law under the European Union (Withdrawal) Act 2018, as amended) (the "UK GDPR");
• The Data Protection Act 2018 ("DPA 2018");
• The Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426 ("PECR"), Regulation 6.
French Law:
• Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (the "Loi Informatique et Libertés"), as amended, with particular reference to Article 82 (transposition of ePrivacy Directive Article 5(3));
• CNIL Délibération n° 2020-091 du 17 septembre 2020 portant adoption de lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture et écriture dans le terminal d'un utilisateur (the "CNIL Cookie Guidelines");
• CNIL guidance on dark patterns in cookie banners, as elaborated in enforcement decisions and supplementary published guidance.
European Data Protection Board Guidance:
• EDPB Guidelines 05/2020 on consent under Regulation 2016/679 (Version 1.1, adopted 4 May 2020).
2.3 Methodology
The gap analysis was conducted using a multi-layered methodology combining technical audit, legal analysis, and stakeholder engagement, as detailed below.
Technical Cookie Audit. The technical cookie audit was performed by Thistlewood Consulting Ltd under the direction of Marcus Drayford, Principal Consultant, during the period of 22 January to 16 February 2024. The engagement was conducted under C&H's direction and is subject to the common-interest privilege protocol executed between C&H, AGMG, and Thistlewood on 18 January 2024. The fixed fee for the Thistlewood engagement was £145,000. The technical audit employed Thistlewood's proprietary automated cookie scanning technology, which systematically catalogued all cookies set by each of the fourteen European websites upon page load, following page interaction, and at various consent states (no consent given, consent given, consent refused). Automated findings were supplemented by manual verification on a sample basis across all fourteen websites and all three mobile applications. The technical audit identified 312 unique cookies, 19 server-side tracking pixels, and documented the firing sequence and consent dependency (or lack thereof) for each.
Data Flow Mapping. A comprehensive data flow mapping exercise was completed on 28 February 2024. This exercise traced the flow of personal data from each of AGMG's European Digital Properties to all twenty-three third-party adtech vendors, including the categories of personal data transmitted, the technical mechanism of transmission (client-side cookies, server-side pixels, API calls, batch file transfers), the geographic destination of each data flow, and the purported legal basis for each transfer. The data flow mapping was informed by review of vendor technical documentation, tag manager configurations, and network traffic analysis.
CMP Configuration Review. C&H and Thistlewood jointly reviewed the configuration files for the Brightleaf ConsentShield CMP as deployed across all fourteen websites and three mobile applications. This included examination of tag manager integration settings, IAB TCF 2.2 configuration, consent string generation and propagation logic, and the presentation layer (banner design, button hierarchy, and consent withdrawal flows).
Documentary Review. C&H conducted a comprehensive review of the following categories of documents:
• All existing Data Processing Agreements between AGMG and its twenty-three adtech vendors;
• All privacy notices deployed on AGMG's European Digital Properties;
• All cookie policies deployed on AGMG's European Digital Properties;
• AGMG's existing Data Protection Impact Assessments;
• AGMG's Article 30 Records of Processing Activities;
• Master Service Agreements, order forms, and associated commercial terms with key vendors including Pendleton and VoltGraph;
• Standard Contractual Clauses executed (where any exist) in connection with international data transfers.
Stakeholder Interviews. C&H conducted structured interviews with the following AGMG personnel:
• Margaux Fontaine-Li, Group Data Protection Officer;
• Leander Voss, Chief Technology Officer;
• Members of AGMG's digital product and engineering teams responsible for the European Digital Properties.
Risk-Rating Methodology. Each finding is assigned a risk rating on the following four-tier scale:
• Critical — Likely regulatory enforcement action, high fine risk, and/or systemic non-compliance affecting a large number of data subjects. Immediate remediation required.
• High — Probable enforcement interest if identified in a regulatory investigation, significant remediation effort needed. Remediation to be completed within the primary remediation window.
• Medium — Gap identified that requires correction to achieve full compliance, but presents lower enforcement risk in isolation. Remediation to be completed within the secondary remediation window.
• Low — Best-practice recommendation; minor gap that, while not fully compliant, is unlikely to attract enforcement attention in its own right. Remediation to be scheduled as part of ongoing compliance programme.
3. Regulatory Background
3.1 CNIL Complaint and Formal Notice
On 8 November 2023, a formal complaint was filed with the CNIL by Digitale Rechte Europa e.V. ("DRE"), a German-registered digital rights advocacy organisation (Executive Director: Friederike Nolte; legal counsel: Dr. Tobias Kreisel, Kreisel & Hausmann Rechtsanwälte PartG mbB, Friedrichstraße 95, 10117 Berlin, Germany). The complaint was registered under CNIL reference PLT-2023-FR-04821 and was directed at AGMG's French-language streaming platform, aurelius-stream.fr.
The complaint set forth the following specific allegations:
(a) That 47 third-party tracking cookies were deployed on page load before any consent interaction by the user, in violation of Article 82 of the Loi Informatique et Libertés and Article 5(3) of the ePrivacy Directive;
(b) That the cookie consent banner displayed on aurelius-stream.fr employed pre-ticked consent boxes, which do not constitute valid consent under GDPR Article 7 and Recital 32, as confirmed by the Court of Justice of the European Union in Planet49 (Case C-673/17);
(c) That the cookie consent banner used an asymmetric button design constituting a "dark pattern" — specifically, a large, brightly coloured "Accept All" button presented alongside a smaller, greyed-out, and less visually prominent "Manage Preferences" link — in violation of the CNIL's Délibération n° 2020-091 requirement that acceptance and refusal be presented with equal prominence; and
(d) That no mechanism existed for users to withdraw their consent to cookies without navigating away from the content page, thereby rendering consent withdrawal materially more difficult than consent provision, in violation of GDPR Article 7(3).
On 14 December 2023, the CNIL issued a formal notice (mise en demeure) to AGMG under reference MED-2023-097. The formal notice directed AGMG to bring its cookie and tracking practices on aurelius-stream.fr into compliance with Article 82 of the Loi Informatique et Libertés and the CNIL's Délibération n° 2020-091 within a period of three months from the date of the notice. The compliance deadline therefore falls on 14 March 2024.
It is important to note the CNIL's current enforcement posture. Since the publication of Délibération n° 2020-091 and the associated recommendation (Délibération n° 2020-092), the CNIL has pursued an increasingly aggressive enforcement strategy regarding cookie compliance. Notable precedents include the €150 million fine imposed on Severin Industries Ireland Ltd and the €60 million fine imposed on Kestrel Services Inc. Ireland Ltd in January 2022 for cookie consent violations, and the series of smaller fines imposed on French publishers and e-commerce operators throughout 2022 and 2023 for similar infringements. The CNIL has demonstrated particular willingness to impose significant fines where organisations fail to remediate within the compliance period set by a formal notice, treating the failure to respond to a mise en demeure as an aggravating factor under GDPR Article 83(2).
3.2 ICO Informal Inquiry
On 22 December 2023, the ICO issued an informal inquiry letter to AGMG under reference ICO/ENF/2023/LTR-11084. The inquiry relates to AGMG's UK-facing properties aureliusnews.co.uk and shopaurelia.co.uk and is focused on two areas:
(a) The use of server-side tracking pixels on these properties that transmit personal data (including IP addresses and device identifiers) to third-party adtech vendors without obtaining prior PECR-compliant consent under Regulation 6; and
(b) The adequacy of the consent mechanism deployed for analytics cookies on these properties, including whether the current CMP configuration provides users with a genuine, freely-given choice.
The ICO has not set a formal compliance deadline in its inquiry letter. However, the letter requests a substantive response from AGMG explaining its current practices and any remediation steps undertaken or planned. In C&H's experience, failure to provide a timely and comprehensive response to an ICO informal inquiry materially increases the risk of escalation to a formal investigation, the issuance of an assessment notice, or the initiation of enforcement proceedings.
The ICO's approach to PECR Regulation 6 enforcement has sharpened in recent years. The ICO's updated guidance on cookies and similar technologies (last updated November 2023) reaffirms that the consent standard under PECR Regulation 6 is materially aligned with the GDPR consent standard following the CJEU's ruling in Planet49. The ICO has also signalled increased attention to server-side tracking technologies that circumvent client-side consent controls, reflecting a broader regulatory trend across European supervisory authorities.
3.3 Regulatory Fine Exposure Summary
The table below summarises the maximum and realistic fine exposure arising from the CNIL formal notice and ICO inquiry:
In assessing the realistic fine range for the CNIL, C&H has considered the aggravating and mitigating factors set forth in GDPR Article 83(2):
Aggravating factors:
(a) Nature, gravity and duration of the infringement — The findings in this memorandum reveal systemic, multi-jurisdictional non-compliance affecting approximately 87 million MAUs, which has been ongoing since at least the deployment of server-side tracking pixels in late 2022;
(b) Intentional or negligent character — While there is no evidence of intentional non-compliance, the failure to implement consent-gating for server-side pixels and the persistence of dark patterns in cookie banners across all fourteen properties suggests a degree of organisational negligence;
(c) Categories and number of data subjects affected — Approximately 87 million monthly active users across the EU/EEA and UK;
(d) Previous relevant infringements — AGMG has no prior enforcement history with the CNIL, the ICO, or other European supervisory authorities, which is a neutral-to-positive factor.
Mitigating factors:
(a) Actions taken to mitigate damage — AGMG's prompt engagement of external counsel (C&H) and a specialist technical consultant (Thistlewood) demonstrates good faith;
(b) Degree of cooperation with the supervisory authority — AGMG has cooperated with the CNIL's inquiry to date; C&H recommends continued proactive cooperation;
(c) Manner in which the infringement became known to the supervisory authority — The infringement was brought to the CNIL's attention via a third-party complaint rather than through AGMG's own notification, which is a neutral factor;
(d) Adherence to approved codes of conduct or certification mechanisms — Not applicable.
Based on these factors and precedent CNIL enforcement decisions in the cookie compliance domain, C&H estimates that a realistic fine range falls between €3 million and €8 million if AGMG fails to achieve meaningful remediation by the extended deadline. Prompt and comprehensive remediation, combined with proactive cooperation, would significantly reduce the likelihood and magnitude of any fine.
4. Gap Analysis Findings — Cookie Consent Mechanisms
4.1 Pre-Consent Cookie Firing
Risk Rating: CRITICAL
Finding. The Thistlewood technical audit identified a total of 312 unique cookies across AGMG's fourteen European websites. Of these, 74 cookies fire before any user consent interaction (i.e., they are set or activated upon initial page load, prior to any engagement with the CMP banner). Thistlewood classified 38 of these 74 pre-consent cookies as "strictly necessary" cookies — that is, cookies that are essential for the functioning of the website and therefore exempt from the consent requirement under Article 5(3) of the ePrivacy Directive and Regulation 6 of PECR. The remaining 36 cookies (36 of 312 total = 11.5%; 36 of 74 pre-consent = 48.6%) were classified by Thistlewood as non-essential cookies that fire before valid consent has been obtained.
These 36 non-compliant pre-consent cookies include advertising cookies, analytics cookies, and cross-site tracking cookies associated with third-party adtech vendors. They are set by or on behalf of nine (9) of AGMG's twenty-three third-party adtech vendors, including Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH.
Legal Basis. The setting or accessing of information on a user's terminal equipment (including through cookies) requires the prior consent of the user unless the cookie is strictly necessary for the provision of the service explicitly requested by the user. This requirement is established under:
• ePrivacy Directive, Article 5(3);
• PECR, Regulation 6 (UK transposition);
• Loi Informatique et Libertés, Article 82 (French transposition);
• GDPR, Article 6(1)(a), to the extent that the processing of personal data collected via such cookies requires consent as its legal basis.
Analysis. The deployment of 36 non-essential cookies before any consent interaction constitutes a clear and systemic breach of the consent requirement. This was the specific allegation at the core of the DRE complaint regarding aurelius-stream.fr, and the Thistlewood audit confirms that the issue is not confined to the French-language streaming platform but is present across all fourteen of AGMG's European websites, albeit to varying degrees of severity. The aurelius-stream.fr property has the highest concentration of pre-consent non-essential cookies (23 of the 36), consistent with DRE's allegation that 47 tracking cookies fired on page load (the discrepancy with Thistlewood's finding of 23 on aurelius-stream.fr is attributable to DRE's apparent inclusion of strictly necessary cookies in their count and potential variation in the cookie landscape between the date of DRE's testing and Thistlewood's audit).
The root cause of the pre-consent cookie firing is twofold. First, the Brightleaf ConsentShield CMP is configured in a "soft-block" mode rather than a "hard-block" mode on several properties, meaning that certain third-party tags are permitted to fire for a brief interval before the CMP consent state is resolved. Second, several vendor JavaScript tags are implemented outside the CMP tag management framework entirely, resulting in uncontrolled cookie setting regardless of consent status. Both configuration issues require remediation as part of Workstream 1 (Section 16.2 below).
Affected Properties. All fourteen (14) European websites, to varying degrees. The most acute non-compliance is observed on aurelius-stream.fr, followed by the German-language and Dutch-language entertainment properties.
Vendor Involvement. The 36 non-compliant pre-consent cookies are attributable to nine (9) of AGMG's twenty-three adtech vendors. These vendors are identified in the Vendor Compliance Status Matrix at Appendix C.
4.2 Dark Patterns in Cookie Banners
Risk Rating: CRITICAL
The Thistlewood audit and C&H's legal review identified four distinct categories of dark patterns in AGMG's cookie consent banners, each of which is addressed below.
4.2.1 Pre-Ticked Consent boxes
Finding. Pre-ticked consent boxes are present on six (6) of fourteen (14) European websites. On these properties, when a user opens the "Manage Preferences" or "Cookie Settings" layer of the CMP, the consent toggles for non-essential cookie categories (including "Advertising," "Analytics," and "Social Media") are pre-selected in the "on" position. Users must affirmatively deselect these toggles to refuse consent.
Legal Analysis. The CJEU held in Planet49 (Case C-673/17, judgment of 1 October 2019) that pre-ticked checkboxes do not constitute valid consent within the meaning of the ePrivacy Directive or the GDPR. The Court stated unambiguously at paragraph 62 that consent within the meaning of Directive 2002/58, read in conjunction with the GDPR, is not validly constituted if the storage of information, or access to information already stored in the user's terminal equipment, is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent. GDPR Recital 32 further provides that "silence, pre-ticked boxes or inactivity should not therefore constitute consent." EDPB Guidelines 05/2020 on consent reiterate this position at paragraphs 77–79.
The pre-ticked boxes identified on six of AGMG's properties render all consent obtained through those interfaces invalid as a matter of law. Any processing of personal data that relies on consent obtained via these interfaces lacks a lawful basis under GDPR Article 6(1)(a).
4.2.2 Asymmetric Button Design
Finding. On all fourteen (14) European websites, the first-layer cookie consent banner presents an "Accept All" button that is visually prominent — large in size, rendered in AGMG's brand colour (a vivid teal), and positioned as the primary call-to-action — while the alternative option ("Manage Preferences" or "Cookie Settings") is rendered as a smaller, greyed-out text link or secondary button, positioned below or to the side of the "Accept All" button in a less visually prominent manner.
Legal Analysis. The CNIL's Délibération n° 2020-091 expressly requires that the mechanisms for accepting and refusing cookies be presented with equivalent ease and prominence ("aussi simple que celui consistant à accepter les cookies"). The EDPB's Guidelines 05/2020 on consent address the issue of manipulative consent interfaces, noting at paragraph 68 that consent is not freely given if "the procedure for giving consent is not user-friendly" or if the interface is designed to nudge users toward consent. The asymmetric button design employed across all fourteen of AGMG's websites creates a visual hierarchy that steers users toward acceptance, undermining the "freely given" requirement of GDPR Article 4(11). While there is some variation in the degree to which Member State supervisory authorities have addressed this issue, the CNIL's position is clear and directly applicable to AGMG's French-language properties, and the EDPB's position applies across the EEA.
4.2.3 Absence of "Reject All" Option
Finding. Eleven (11) of fourteen (14) European websites lack a first-layer "Reject All" (or, in the French-language context, "Tout refuser") button. On these properties, users who wish to decline non-essential cookies must navigate to the second-layer "Manage Preferences" screen and manually deselect individual cookie categories before saving their preferences. Only three properties — all of which were updated as part of a partial remediation effort in September 2023 — offer a first-layer "Reject All" button, though even on these properties the "Reject All" button does not have equivalent visual prominence to the "Accept All" button.
Legal Analysis. The CNIL has specifically required, since the entry into force of its updated cookie guidance, that a "Reject All" option of equal prominence to the "Accept All" option be available to users on the first layer of any cookie consent interface. This requirement was central to several CNIL enforcement actions in 2022 and 2023, including against major technology companies. The absence of a first-layer "Reject All" button on eleven of AGMG's properties constitutes a direct violation of Délibération n° 2020-091 and was one of the core complaints raised by DRE. The EDPB's Guidelines 05/2020, while not prescribing a specific button layout, support the principle that refusal must be as easy as acceptance. C&H notes that regulatory practice across several other EEA jurisdictions is converging toward the CNIL's position on this point.
4.2.4 Consent Withdrawal Difficulty
Finding. On eight (8) of fourteen (14) European websites, withdrawing previously given consent requires the user to navigate through four or more clicks. The typical consent withdrawal path on these properties requires the user to: (1) scroll to the website footer; (2) locate and click a "Cookie Settings" or "Privacy Preferences" text link; (3) navigate to the relevant cookie category in the second-layer preferences panel; (4) deselect the relevant toggle(s); and (5) click "Save Preferences." On certain properties, the footer link is rendered in a small font and low-contrast colour, making it difficult to locate.
Legal Analysis. GDPR Article 7(3) provides that "[t]he data subject shall have the right to withdraw his or her consent at any time" and that "[i]t shall be as easy to withdraw as to give consent." Where a single click on an "Accept All" button suffices to give consent, a four-or-more-click withdrawal process manifestly fails the Article 7(3) standard. The CNIL's Délibération n° 2020-091 reiterates this requirement. The EDPB's Guidelines 05/2020 at paragraph 113 state that withdrawal "should be possible without detriment" and "without lowering service levels or any disadvantage to the data subject," and that "if consent is obtained via electronic means through only one mouse-click, swipe or keystroke, data subjects must, in practice, be able to withdraw that consent equally as easily."
The current implementation on eight of AGMG's properties does not satisfy this standard and constitutes a violation of GDPR Article 7(3), further undermining the validity of consent previously obtained.
4.3 Mobile Application Consent Flows
Risk Rating: HIGH
Finding. All three (3) AGMG EU mobile applications lack granular consent controls for the processing of personal data through in-app tracking and analytics. Users are presented with a binary accept/decline mechanism without purpose-level granularity — that is, users cannot selectively consent to certain categories of processing (e.g., analytics) while declining others (e.g., advertising personalisation).
iOS-Specific Issue. The two iOS applications present Tidewater Industries's App Tracking Transparency ("ATT") prompt, which asks users whether they consent to being "tracked across apps and websites owned by other companies." However, the scope of Tidewater Industries's ATT framework does not align with the scope of GDPR consent requirements. Specifically:
(a) An ATT opt-in does not constitute valid GDPR consent for all processing purposes conducted within the app, because ATT covers only cross-app and cross-website tracking (as defined by Tidewater Industries), whereas GDPR consent may be required for additional processing activities such as in-app analytics, first-party profiling, or sharing data with specific vendors for purposes other than cross-app tracking;
(b) An ATT opt-out is not properly reflected in AGMG's GDPR consent records — the Brightleaf ConsentShield CMP SDK does not synchronise ATT consent status with the CMP's own consent framework, meaning that a user who opts out via ATT may nevertheless have their data processed for purposes that the CMP has recorded as consented; and
(c) The ATT prompt does not provide the specificity required by GDPR Article 4(11) — it does not identify specific data recipients, processing purposes, or the legal basis for processing.
Brightleaf ConsentShield SDK. The ConsentShield CMP SDK is deployed in all three mobile applications but is not configured for purpose-level granular consent. The SDK currently presents a simplified consent interface that does not offer users the ability to consent on a purpose-by-purpose basis. This configuration deficiency requires remediation through reconfiguration of the SDK, which will be addressed under Workstream 1 in coordination with Brightleaf (Katarina van Hoorn, VP EMEA).
5. Gap Analysis Findings — Server-Side Tracking Pixels
5.1 Non-Compliant Server-Side Pixels
Risk Rating: CRITICAL
Finding. The Thistlewood audit identified nineteen (19) unique server-side tracking pixels deployed across AGMG's European Digital Properties. Unlike client-side cookies, which are set in the user's browser and can be managed through the CMP's tag management framework, server-side pixels operate at the server level, executing on AGMG's infrastructure before the page content (and the CMP banner) is delivered to the user's browser. Of these nineteen server-side pixels, twelve (12) transmit personal data — including IP addresses, device fingerprints, and browsing history — to third-party adtech vendors without obtaining valid consent.
Legal Basis. The transmission of personal data via server-side pixels engages:
• GDPR Article 5(1)(a) (lawfulness, fairness and transparency);
• GDPR Article 6(1)(a) (consent as the legal basis for processing);
• ePrivacy Directive Article 5(3) (consent for storing or accessing information on a user's terminal equipment — noting that the server-side pixel, while not itself a cookie, accesses information from the user's device such as IP address, device identifiers, and browser configuration data, and transmits this to third parties);
• PECR Regulation 6 (for UK-facing properties).
Analysis. The critical compliance issue with server-side pixels is that they bypass the client-side CMP controls. Because Brightleaf ConsentShield operates by governing the firing of client-side JavaScript tags in the user's browser, it has no ability to intercept or control server-side pixel firing, which occurs on AGMG's own servers before the CMP banner is presented to the user. There is currently no integration between the ConsentShield CMP and AGMG's server-side tag management infrastructure, meaning that consent signals collected by the CMP are not propagated to the server-side pixel firing logic.
This means that even where a user has expressly refused consent via the CMP banner (on the three properties where a "Reject All" option is available), the twelve non-compliant server-side pixels continue to fire and transmit personal data to third-party vendors. This is a systemic architecture failure that renders the CMP's consent controls ineffective for a material category of data processing.
ICO Relevance. This finding is directly relevant to the ICO's informal inquiry under reference ICO/ENF/2023/LTR-11084, which specifically asks about server-side tracking pixels on aureliusnews.co.uk and shopaurelia.co.uk. The ICO's inquiry letter references "technologies that operate server-side to collect and transmit user data to third parties," indicating that the ICO is specifically aware of and concerned about this category of processing.
Vendors Receiving Data. Nine (9) vendors receive personal data without consent via the twelve non-compliant server-side pixels. The two most significant are:
Pendleton AdTech Solutions Ltd — Registered address: 22 Grand Canal Dock, Block 4, Dublin D02 HW94, Ireland; Companies Registration Office No. 614823. Pendleton processes approximately 4.2 billion ad bid requests per month involving AGMG user data through its real-time bidding ("RTB") platform. Pendleton receives AGMG user data via four (4) server-side pixels that transmit IP addresses, device identifiers, cookie identifiers, and browsing history for use in programmatic advertising auctions.
VoltGraph Analytics GmbH — Registered address: Große Elbstraße 44, 22767 Hamburg, Germany; Handelsregister Hamburg HRB 159742. VoltGraph processes approximately 320 million unique user profiles per year from AGMG properties through its cross-device tracking and audience segmentation platform. VoltGraph receives AGMG user data via three (3) server-side pixels that transmit device fingerprints, browsing history, and content interaction data.
The remaining seven vendors receiving data via non-compliant server-side pixels are identified in Appendix C.
5.2 Consent-Gating Architecture Gap
Risk Rating: HIGH
Finding. There is currently no technical mechanism in place to gate server-side pixel firing based on user consent status. The Brightleaf ConsentShield CMP governs only client-side (browser-based) tag firing through its tag management integration. Server-side processing operates independently, outside the CMP's technical control. This means that the consent preferences expressed by users through the CMP banner have no effect whatsoever on the operation of server-side pixels.
Remediation Requirement. Addressing this gap requires the implementation of a consent-gated server-side pixel firing mechanism. This would involve an API integration between the Brightleaf ConsentShield platform and AGMG's server-side infrastructure, such that:
(a) Server-side pixels are not fired until a valid consent signal has been received from the CMP; (b) Where consent is refused or not yet given, server-side pixels are suppressed; (c) Where consent is withdrawn, server-side pixels are deactivated in real time or near-real time; and (d) Consent status is logged and auditable to demonstrate compliance.
This integration is technically feasible within the Brightleaf ConsentShield architecture, as confirmed in preliminary discussions between Thistlewood and Brightleaf's EMEA technical team. However, it requires development effort on both the AGMG and Brightleaf sides and is expected to take approximately two to three weeks to implement and test. This remediation is addressed under Workstream 2 (Section 16.2 below).
6. Gap Analysis Findings — Transparency and Information Obligations
6.1 Privacy Notices — Article 13 and Article 14 GDPR
Risk Rating: HIGH
Finding. C&H's review of the privacy notices deployed across AGMG's fourteen websites and three mobile applications reveals several material deficiencies:
(a) Incomplete disclosure of third-party recipients. Nine (9) of AGMG's twenty-three adtech vendors are not named or adequately categorised in any privacy notice. GDPR Articles 13(1)(e) and 14(1)(e) require the controller to inform data subjects of "the recipients or categories of recipients of the personal data, if any." While the GDPR permits disclosure by category rather than by name, AGMG's privacy notices fail to identify even the categories of several vendors (e.g., cross-device tracking providers and audience segmentation platforms are not mentioned as a category).
(b) French-language compliance. Privacy notices on AGMG's French-language properties do not comply with the specific disclosure requirements of the Loi Informatique et Libertés. In particular, they do not include the required reference to the data subject's right to define directives regarding the fate of personal data after death (directives relatives au sort des données à caractère personnel après le décès), as required under Article 85 of the Loi Informatique et Libertés.
(c) Missing retention period information. No privacy notice across any of AGMG's European Digital Properties specifies the retention periods for personal data collected via cookies or server-side pixels. GDPR Article 13(2)(a) requires the controller to provide "the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period." This omission is universal across all properties and all languages.
(d) Inadequate description of international transfers. Privacy notices do not identify the specific third countries to which personal data is transferred, or the safeguards applied (e.g., Standard Contractual Clauses, adequacy decisions). GDPR Article 13(1)(f) requires disclosure of transfers to third countries and the existence of appropriate safeguards under Article 46.
These deficiencies affect all fourteen websites and all three mobile applications.
6.2 Cookie Information / Cookie Policy
Risk Rating: MEDIUM
Finding. AGMG maintains separate cookie policies on each of its fourteen European websites. C&H's review identified the following deficiencies:
(a) Incomplete cookie enumeration. No cookie policy lists all 312 cookies identified by the Thistlewood audit. The most comprehensive cookie policy (on aureliusnews.co.uk) lists only 147 cookies. Several properties list fewer than 80 cookies. Server-side tracking pixels are not mentioned in any cookie policy.
(b) Vague purpose descriptions. Many cookies are described with generic language such as "used for advertising purposes" or "helps us improve our services" without specifying the particular processing activity or the vendor involved.
(c) Incomplete third-party identification. Third-party cookie providers are not adequately identified — in many cases, only the cookie domain is listed, without the name of the vendor, its corporate address, or a link to its privacy policy.
(d) Missing language versions. Cookie policies are not available in all six languages corresponding to AGMG's operating jurisdictions (English, French, German, Dutch, Spanish, Italian). The German-language and Dutch-language properties currently display cookie policies only in English.
While these deficiencies represent departures from best practice and the requirements of ePrivacy Directive Article 5(3) (which requires that the user be "provided with clear and comprehensive information" about the use of cookies), C&H rates this finding as Medium on the basis that cookie policy deficiencies are less likely to attract standalone enforcement action than the consent mechanism failures identified above, though they contribute to the overall picture of non-compliance.
7. Gap Analysis Findings — Legal Basis for Processing
7.1 Misuse of "Legitimate Interest" Under IAB TCF
Risk Rating: CRITICAL
Finding. Seven (7) of AGMG's twenty-three adtech vendors — including Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH — have registered "legitimate interest" (GDPR Article 6(1)(f)) as their legal basis under the IAB TCF 2.2 framework for processing purposes that, under applicable EU data protection law, require consent. Specifically, these vendors have asserted legitimate interest as the legal basis for:
• Purpose 3 (Create profiles for personalised advertising);
• Purpose 4 (Use profiles to select personalised ads);
• Purpose 5 (Create profiles for personalised content);
• Purpose 6 (Use profiles to select personalised content); and
• Special Purpose 1 (Ensure security, prevent and detect fraud, and fix errors) (this purpose is less contentious, but certain vendor implementations conflate it with broader profiling activities).
Under the IAB TCF 2.2 framework, vendors may self-declare their preferred legal basis for each processing purpose. When a vendor declares legitimate interest as its legal basis for a particular purpose, the CMP may permit processing under that purpose without obtaining the user's affirmative consent, instead relying on a right-to-object mechanism.
Legal Analysis. The assertion of legitimate interest as a legal basis for tracking-based advertising and profiling is legally unsustainable in the current regulatory environment. This position is supported by the following: