PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
ENGAGEMENT CLOSING MEMORANDUM & COMPLIANCE FRAMEWORK SUMMARY
3 May 2024
From: Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
To: Sanjay Redworth, Group General Counsel & Company Secretary, Aurelius Global Media Group PLC Margaux Fontaine-Li, Group Data Protection Officer, Aurelius Global Media Group PLC
CC: Kevin Ostrowski, Partner (Billing Partner), Calderwood & Harkness LLP Priscilla Wynn, Senior Associate, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP
Re: Engagement Closing — GDPR Cookie-Consent & Adtech Remediation, C&H Matter No. 1017-00008
Calderwood & Harkness LLP One Finsbury Square London EC2A 1AE United Kingdom
Aurelius Global Media Group PLC 140 Threadneedle Row London EC2R 8AH United Kingdom
Right-click to update Table of Contents
1. Purpose and Executive Summary
The purpose of this memorandum is to formally confirm the closing of the GDPR cookie-consent and adtech remediation engagement conducted by Calderwood & Harkness LLP ("C&H") on behalf of Aurelius Global Media Group PLC ("AGMG" or the "Client"), under C&H Matter No. 1017-00008 (the "Engagement"), effective 3 May 2024.
The Engagement was opened on 12 January 2024, following the convergence of three related regulatory events that collectively presented a significant compliance risk to AGMG's European digital operations:
(a) a complaint filed with the Commission nationale de l'informatique et des libertés ("CNIL") under reference PLT-2023-FR-04821, lodged on 8 November 2023 by Digitale Rechte Europa eingetragener Verein ("DRE"), a Berlin-based pan-European digital rights advocacy organisation;
(b) a formal notice issued by CNIL under reference MED-2023-097, dated 14 December 2023, requiring AGMG to bring its cookie-consent mechanisms on aurelius-stream.fr into compliance with applicable French data protection law within three months; and
(c) an informal inquiry issued by the Information Commissioner's Office ("ICO") under reference ICO/ENF/2023/LTR-11084, dated 22 December 2023, regarding the adequacy of consent mechanisms for analytics cookies and server-side tracking pixels deployed on aureliusnews.co.uk and shopaurelia.co.uk.
The scope of the Engagement encompassed a comprehensive audit of cookie-consent mechanisms and adtech data flows across AGMG's fourteen European-facing websites and three mobile applications, which collectively serve audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, representing approximately 87 million monthly active users in the EU/EEA. Beyond the initial audit, the Engagement extended to the remediation of all identified non-compliant practices; the renegotiation and execution of vendor data processing agreements ("DPAs"); the preparation and submission of regulatory response filings to both CNIL and the ICO; and the development and delivery of an ongoing compliance governance framework designed to sustain AGMG's compliance posture on a going-forward basis.
We are pleased to confirm that the Engagement has been fully completed. All seven discrete remediation workstreams identified at the outset of the Engagement have been delivered to conclusion. Both regulatory matters have been resolved favourably: CNIL acknowledged AGMG's compliance on 29 April 2024 with no administrative fine imposed, and the ICO issued a closure letter on 1 May 2024 confirming no further action in relation to its inquiry. No financial penalty has been imposed by either regulator, and no adverse public enforcement action or publication has resulted from either proceeding.
The total cost to the Client for this Engagement was £570,000 (exclusive of VAT), comprising the C&H capped professional fee of £425,000 and a pass-through disbursement of £145,000 for technical consulting services provided by Thistlewood Consulting Ltd.
This memorandum serves to: (i) recap each remediation workstream and confirm its completion status; (ii) detail the regulatory outcomes achieved; (iii) provide a comprehensive financial summary of the Engagement; and (iv) set forth C&H's recommended ongoing compliance governance framework for AGMG's continued adherence to GDPR, the ePrivacy Directive, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") in connection with its cookie-consent and adtech operations.
2. Background
2.1 Trigger Events
The Engagement was initiated in response to three distinct but interrelated regulatory events that arose in rapid succession during the fourth quarter of 2023. Each event is described in detail below.
CNIL Complaint (PLT-2023-FR-04821). On 8 November 2023, Digitale Rechte Europa eingetragener Verein ("DRE"), a Berlin-based pan-European digital rights advocacy organisation (Executive Director: Friederike Nolte), filed a formal complaint with CNIL against AGMG. The complaint was submitted by DRE's external legal counsel, Dr. Tobias Kreisel of Kreisel & Hausmann Rechtsanwälte PartG mbB, Friedrichstraße 95, 10117 Berlin, Germany. The complaint alleged that AGMG's French-language streaming site, aurelius-stream.fr, deployed forty-seven (47) third-party tracking cookies on page load prior to any user consent interaction, in direct contravention of Article 82 of the French Loi Informatique et Libertés and Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, as amended). The complaint further alleged that the cookie banner employed on the site utilised so-called "dark patterns" designed to manipulate users into providing consent. Specifically, the complaint identified the use of pre-ticked consent boxes for non-essential cookie categories and an asymmetric button design in which the "Accept All" option was prominently displayed in a large, brightly coloured button while the "Manage Preferences" option was rendered as a small, understated text link. DRE's complaint was supported by technical evidence including browser network traffic captures and screenshots of the consent interface, which were appended to the filing.
CNIL Formal Notice (MED-2023-097). Following its preliminary assessment of the DRE complaint, CNIL issued a formal notice (mise en demeure) to AGMG on 14 December 2023, under reference MED-2023-097. The formal notice identified several specific non-compliances on aurelius-stream.fr and set an original compliance deadline of 14 March 2024 — three months from the date of issuance. The notice required AGMG to, inter alia: (i) cease the deployment of non-essential cookies prior to the collection of valid user consent; (ii) eliminate dark patterns from its consent interface; (iii) ensure that users were provided with a clear and equally prominent option to refuse all non-essential cookies; and (iv) ensure that consent withdrawal was as easy as consent provision. CNIL indicated that failure to comply within the stipulated timeframe could result in the initiation of formal sanction proceedings, including the imposition of an administrative fine.
ICO Informal Inquiry (ICO/ENF/2023/LTR-11084). On 22 December 2023, the ICO dispatched an informal inquiry letter to AGMG under reference ICO/ENF/2023/LTR-11084. The inquiry related to AGMG's two principal UK-facing websites, aureliusnews.co.uk and shopaurelia.co.uk, and focused on two areas of concern: (i) the deployment of server-side tracking pixels on both sites that transmitted personal data to third-party adtech vendors, and (ii) the adequacy of PECR-compliant consent for analytics cookies deployed across both properties. While the ICO inquiry was classified as "informal" and did not carry a statutory deadline, it was accompanied by a request for a detailed response within a reasonable period and indicated that formal enforcement action could follow depending on the substance of AGMG's response.
The temporal proximity and thematic overlap of these three regulatory events suggested a degree of coordinated scrutiny of AGMG's digital advertising practices across European jurisdictions, and underscored the urgency with which a comprehensive remediation programme needed to be undertaken.
2.2 Client Profile
Aurelius Global Media Group PLC ("AGMG") is a United Kingdom public limited company registered at Companies House under registration number 08741562. AGMG's ordinary shares are admitted to trading on the London Stock Exchange (LSE ticker: AGMG), and as of January 2024 the company had an approximate market capitalisation of £3.8 billion. AGMG's Chief Executive Officer is Helena Durneval, its Chief Financial Officer is Dominic Ashford, and its Chief Technology Officer is Leander Voss.
AGMG reported annual revenue for financial year 2023 of £1.42 billion, of which approximately £612 million (approximately 43.1%) was generated from EU/EEA digital advertising and e-commerce operations. AGMG's European digital footprint comprises fourteen (14) websites and three (3) mobile applications that collectively serve audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, with approximately 87 million monthly active users located in the EU/EEA. These properties span AGMG's news, entertainment, streaming, and e-commerce verticals and represent a material portion of the Group's revenue-generating digital infrastructure.
Given AGMG's status as a listed company with substantial European digital operations, the regulatory proceedings described in Section 2.1 above carried not only direct financial risk in the form of potential fines but also reputational risk and the potential for adverse effects on investor confidence, advertising partner relationships, and the broader commercial viability of AGMG's programmatic advertising model.
2.3 Engagement Team and Structure
The Engagement was staffed and structured as follows:
C&H Team. The C&H team comprised Rachel Bernstein (Responsible Partner), Kevin Ostrowski (Billing Partner), Priscilla Wynn (Lead Senior Associate), and Alan Burke (Working Associate), all of C&H's Privacy & Data Security Practice in London. Rachel Bernstein maintained overall responsibility for the strategic direction of the Engagement, all substantive legal advice, and regulatory advocacy. Kevin Ostrowski served as billing partner and provided periodic senior oversight. Priscilla Wynn led the day-to-day execution of all workstreams, including the DPA renegotiations and the preparation of regulatory submissions. Alan Burke provided working-level support across all workstreams, with particular focus on the cookie audit legal analysis, ROPA updates, and DPIA refreshes.
Technical Consultant. Thistlewood Consulting Ltd ("Thistlewood"), a specialist privacy technology consultancy located at 9 Worship Street, London EC2A 2BF, was retained by AGMG under C&H's direction to provide technical cookie audit, data flow mapping, and remediation implementation support. The Thistlewood engagement was led by Marcus Drayford, Principal Consultant. To preserve the privileged character of Thistlewood's work product and communications in the context of the regulatory proceedings, AGMG, C&H, and Thistlewood executed a Common Interest and Privilege Protocol Memorandum on 18 January 2024, establishing a common-interest privilege arrangement that governs the sharing of confidential and privileged materials among the parties.
CMP Provider. AGMG's consent management platform ("CMP") is provided by Brightleaf Consent Technologies EU B.V. ("Brightleaf"), a Dutch besloten vennootschap registered with the Kamer van Koophandel under number 81294503, with its registered office at Herengracht 520, 1017 CC Amsterdam, the Netherlands. Brightleaf provides the ConsentShield platform, which holds IAB Transparency & Consent Framework version 2.2 ("TCF 2.2") certification. The annual license fee for ConsentShield is €385,000. Brightleaf's Chief Executive Officer is Martin Jessup, and AGMG's primary point of contact for the Engagement was Katarina van Hoorn, Vice President EMEA. Brightleaf was not formally a party to the Engagement but provided essential technical cooperation in the implementation of the remediated consent mechanisms.
3. Summary of Remediation Workstreams — Completion Status
The Engagement was organised into seven discrete remediation workstreams, each designed to address a specific category of non-compliance identified during the initial audit phase or required by the CNIL formal notice and ICO inquiry. This Section provides a detailed summary of each workstream, the work performed, and its completion status.
3.1 Workstream 1: Cookie Audit and Data Flow Mapping
Objective. To conduct a comprehensive technical and legal audit of all cookies, tracking technologies, and associated data flows deployed across AGMG's fourteen European-facing websites and three mobile applications, in order to establish a complete factual baseline for the remediation programme.
Work Performed. The technical cookie audit was conducted by Thistlewood Consulting under C&H's direction during the period from 22 January 2024 to 16 February 2024. The audit methodology involved automated crawling of all fourteen websites using industry-standard cookie scanning tools, supplemented by manual inspection of page source code, network traffic analysis, and server-side configuration review. Each mobile application was subjected to equivalent analysis through traffic interception and application binary analysis. The formal Cookie Audit Report was delivered to the Client on 20 February 2024. Data flow mapping — tracing the onward transmission of personal data from AGMG's digital properties to third-party adtech and analytics vendors — was completed on 28 February 2024 and was appended to the audit report as a supplementary analysis.
Key Findings. The audit identified a total of 312 unique cookies deployed across the fourteen EU-facing websites. Of these, seventy-four (74) cookies were found to be firing before any user consent interaction occurred. Further analysis determined that thirty-eight (38) of these pre-consent cookies were legitimately classified as "strictly necessary" within the meaning of Article 5(3) of the ePrivacy Directive and Recital 66 thereof, as they were essential for the provision of the requested service (e.g., session management cookies, load balancing cookies, and security tokens). However, the remaining thirty-six (36) pre-consent cookies — representing 23.7% of the total cookie population — were non-compliant, as they served non-essential purposes (analytics, advertising, audience profiling) and were deployed without valid prior consent.
In addition to browser-based cookies, the audit identified nineteen (19) unique server-side tracking pixels across the fourteen websites. Of these, twelve (12) were found to transmit personal data — including IP addresses, device fingerprints, and browsing history — to third-party adtech vendors without any consent mechanism governing their activation.
The vendor landscape analysis revealed that nine (9) of the twenty-three (23) adtech vendors receiving personal data from AGMG's digital properties (39.1%) either had no data processing agreement in place with AGMG or had DPAs that were materially deficient in light of the requirements of Article 28 of the GDPR.
Concerning consent interface design, the audit confirmed the dark-pattern deficiencies alleged in the DRE complaint and identified additional issues across the broader website portfolio:
• Pre-ticked consent boxes for non-essential cookie categories were present on six (6) of the fourteen (14) European websites;
• Asymmetric button design — in which the "Accept All" option was visually prominent while the "Manage Preferences" option was styled as an understated text link — was present on all fourteen (14) sites;
• No "Reject All" option was provided on eleven (11) of the fourteen (14) sites;
• Consent withdrawal required four (4) or more clicks on eight (8) of the fourteen (14) sites, significantly more cumbersome than the consent provision process.
With respect to the three mobile applications, the audit found that all three lacked granular consent controls for in-app tracking and analytics. Furthermore, the two iOS applications displayed Tidewater Industries's App Tracking Transparency ("ATT") prompts in a manner that was not aligned with GDPR consent requirements — specifically, the ATT prompt language did not correspond to the granular purpose descriptions required under the GDPR, and affirmative ATT consent was being conflated with blanket consent for all adtech processing purposes.
Status: Completed. The findings of this workstream informed the design and execution of all subsequent remediation workstreams.
3.2 Workstream 2: Consent Mechanism Redesign
Objective. To redesign and deploy compliant cookie-consent mechanisms across all fourteen European websites and three mobile applications, eliminating all identified dark patterns and ensuring that no non-essential cookies or tracking technologies are activated prior to the collection of valid, affirmative user consent.
Work Performed. Drawing upon the findings of Workstream 1, C&H developed a comprehensive legal and UX specification for the redesigned cookie-consent mechanisms. The specification was prepared in close collaboration with Thistlewood Consulting (for technical feasibility) and Brightleaf Consent Technologies (for CMP integration). The specification addressed the following elements:
(a) Elimination of dark patterns. The redesigned consent banners remove all pre-ticked boxes, employ equal visual prominence for "Accept All" and "Reject All" buttons (identical size, colour, and positioning), and provide a clearly accessible "Manage Preferences" link that opens a granular consent management interface.
(b) "Reject All" functionality with button parity. A "Reject All" button was introduced on all fourteen websites and three mobile applications. The "Reject All" button is afforded visual parity with the "Accept All" button in accordance with CNIL's recommendations on cookie-consent design published in its January 2022 guidance and the EDPB's Guidelines 05/2020 on consent under Regulation 2016/679.
(c) Granular purpose-level consent toggles. The consent management interface provides users with individual toggle controls for each processing purpose (strictly necessary, functional, analytics, advertising, and social media), enabling purpose-by-purpose consent or refusal.
(d) Consent withdrawal in no more than two clicks. The consent withdrawal process has been simplified so that users can access the consent management interface and modify or withdraw their consent in no more than two clicks from any page on the website or screen within the mobile application.
(e) Pre-consent blocking. All non-essential cookies and server-side tracking pixels are now blocked from firing until affirmative consent is recorded via the Brightleaf ConsentShield CMP. This is achieved through the ConsentShield tag manager integration, which intercepts and holds all non-essential tags until a valid consent signal is received.
(f) IAB TCF 2.2 integration. The redesigned consent mechanisms are fully integrated with the Brightleaf ConsentShield CMP and comply with the IAB Transparency & Consent Framework version 2.2 specification, including proper generation and propagation of TC Strings to downstream vendors.
(g) Multi-language support. Banner copy and consent management interface text were prepared in six languages — English, French, German, Dutch, Spanish, and Italian — with each language version reviewed by native-speaking legal professionals to ensure legal accuracy and clarity.
(h) ATT prompt alignment. For the two iOS mobile applications, the Tidewater Industries ATT prompt implementation was revised to ensure that the ATT consent flow is decoupled from the GDPR consent flow, with separate granular GDPR consent collected through the in-app ConsentShield interface prior to the presentation of the ATT prompt.
The complete legal and UX specification document was delivered to the Client on 15 March 2024. Following AGMG's internal review and approval, the remediated cookie banners were deployed across all fourteen European-facing websites on 22 March 2024. The updated mobile application consent flows were deployed across all three applications (via app store updates) on 29 March 2024.
Status: Completed.
3.3 Workstream 3: Server-Side Pixel Remediation
Objective. To remediate the twelve non-compliant server-side tracking pixels identified in the Workstream 1 audit, ensuring that no personal data is transmitted to third-party adtech vendors via server-side mechanisms without valid prior consent.
Work Performed. Working with Thistlewood Consulting and the relevant adtech vendors, C&H oversaw the reconfiguration of all twelve non-compliant server-side tracking pixels. Ten of the twelve pixels were successfully reconfigured to consent-gated firing through integration with the Brightleaf ConsentShield tag manager. Under this configuration, the server-side pixel fires only after the ConsentShield CMP has confirmed the existence of a valid consent signal for the applicable processing purpose. The remaining two pixels — which could not be technically adapted to consent-gated firing due to their architectural dependency on server-to-server data transmission that occurred outside the browser environment — were permanently removed from AGMG's digital properties.
The key vendors affected by the server-side pixel remediation were:
• Pendleton AdTech Solutions Ltd, a company incorporated in Ireland (CRO No. 614823) with its registered office at 22 Grand Canal Dock, Block 4, Dublin D02 HW94, Ireland, which operated seven of the twelve non-compliant pixels;
• VoltGraph Analytics GmbH, a company incorporated in Germany (HRB 159742, Amtsgericht Hamburg) with its registered office at Große Elbstraße 44, 22767 Hamburg, Germany, which operated three of the twelve non-compliant pixels; and
• Seven additional vendors, each of which operated one or more of the remaining pixels.
Server-side pixel remediation was completed across all fourteen websites and verified through post-implementation scanning on 2 April 2024.
Status: Completed.
3.4 Workstream 4: DPA Renegotiation
Objective. To negotiate and execute GDPR Article 28-compliant data processing agreements with all nine adtech vendors previously identified as lacking adequate DPAs, and to ensure that all cross-border data transfer mechanisms are compliant.
Work Performed. C&H conducted DPA negotiations with all nine vendors simultaneously, prioritising Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH given the materiality of their processing activities and commercial relationships with AGMG. The details of the principal DPA negotiations are set out below, followed by a summary of the remaining seven vendor DPAs.
Pendleton AdTech Solutions Ltd DPA. The Pendleton DPA was executed on 5 April 2024. It was signed by Sanjay Redworth on behalf of AGMG and by Conor Rafferty, Chief Executive Officer, on behalf of Pendleton (Pendleton's Data Protection Officer: Siobhán McAuliffe). The DPA was negotiated opposite Aoife Brennan of Dalrymple Kearney & Co., solicitors, 15 Fitzwilliam Place, Dublin D02 YX28, Ireland, who acted as external counsel to Pendleton. The DPA covers Pendleton's processing activities in connection with AGMG's programmatic advertising operations, which generate approximately 4.2 billion ad bid requests per month. The annual fees paid by AGMG to Pendleton amount to approximately €2.8 million, while the revenue-share arrangement generates approximately €18.4 million per year in advertising revenue for AGMG — making this AGMG's most commercially significant adtech vendor relationship. The DPA includes comprehensive provisions addressing:
(i) the subject matter, duration, nature, and purpose of processing, and the categories of personal data and data subjects;
(ii) processing instructions and the obligation to process personal data only on documented instructions from AGMG as controller;
(iii) confidentiality obligations extending to all persons authorised to process the personal data;
(iv) appropriate technical and organisational security measures;
(v) sub-processor approval and flow-down obligations, requiring Pendleton to obtain AGMG's prior written consent before engaging any new sub-processor and to impose equivalent data protection obligations on all sub-processors;
(vi) assistance with data subject rights requests under Articles 15–22 of the GDPR;
(vii) audit and inspection rights per Article 28(3)(h), discussed further under Workstream 5 below;
(viii) deletion or return of personal data upon termination of the processing relationship;
(ix) cooperation obligations in connection with DPIAs under Article 35 and prior consultation under Article 36; and
(x) European Commission Standard Contractual Clauses (Module 2: Controller to Processor), adopted pursuant to Commission Implementing Decision (EU) 2021/914, together with a completed Transfer Impact Assessment for Pendleton's three US-based sub-processors.
VoltGraph Analytics GmbH DPA. The VoltGraph DPA was executed on 8 April 2024. It was signed by Margaux Fontaine-Li on behalf of AGMG and by Dr. Kai-Henrik Möller, Managing Director, on behalf of VoltGraph (VoltGraph's Data Protection Officer: Jana Siebert). The DPA was negotiated opposite Dr. Luisa Feldstein of Feldstein Weber LLP, Bockenheimer Landstraße 24, 60323 Frankfurt am Main, Germany, who acted as external counsel to VoltGraph. The annual contract value of the VoltGraph relationship is approximately €1.15 million, and VoltGraph processes approximately 320 million unique user profiles per year in connection with AGMG's audience analytics and segmentation activities. In addition to the standard Article 28 provisions described above, the VoltGraph DPA includes two bespoke provisions of particular importance:
(i) Historical data deletion obligations. VoltGraph has undertaken to delete all personal data collected through its server-side tracking pixels during the period in which those pixels were firing without valid user consent. The deletion was required to be completed within sixty (60) days of DPA execution, with written certification of deletion provided to AGMG's DPO. This provision addresses the remediation of the historical non-compliance identified in Workstream 1 and mitigates the risk of ongoing processing of unlawfully obtained personal data.
(ii) Consent-gated pixel firing requirements. The DPA expressly requires VoltGraph to ensure that its tracking pixels deployed on AGMG's digital properties fire only upon receipt of a valid consent signal from the Brightleaf ConsentShield CMP, with specific reference to the technical integration specification agreed between VoltGraph, Thistlewood, and Brightleaf.
Remaining Seven Vendor DPAs. All seven remaining vendor DPAs were executed by 10 April 2024. While each DPA was tailored to the specific processing activities of the relevant vendor, all seven include the full complement of Article 28-compliant provisions: documented processing instructions; confidentiality obligations; technical and organisational security measures; sub-processor approval and flow-down controls; data subject rights assistance; audit and inspection rights; deletion or return obligations upon termination; and DPIA cooperation obligations.
Cross-Border Transfer Safeguards. The Workstream 1 audit identified that six of AGMG's adtech vendors transfer personal data to recipients located outside the EU/EEA — specifically, four vendors transferring data to the United States, one to India, and one to Singapore. Prior to the Engagement, only two of these six vendors had European Commission Standard Contractual Clauses in place, and none had completed Transfer Impact Assessments. As part of the DPA renegotiation process, C&H ensured that all six vendors now have fully executed SCCs (Module 2: Controller to Processor) in place, together with completed Transfer Impact Assessments that assess the legal framework in each destination country and identify any supplementary measures required in accordance with the CJEU's Schrems II judgment (Case C-311/18) and the EDPB's Recommendations 01/2020 on supplementary measures.
Transition from Legitimate Interest to Consent. The audit further identified that seven vendors — including Pendleton and VoltGraph — had been inappropriately relying on "legitimate interest" as a legal basis under the IAB TCF framework for processing purposes that, under applicable GDPR and ePrivacy Directive requirements, require prior consent (including advertising measurement, audience profiling, and personalised content delivery). As part of the DPA renegotiation process, all seven vendors have been transitioned to consent-based processing, and their TCF declarations have been updated accordingly.
Status: Completed.
3.5 Workstream 5: Vendor Audit Rights
Objective. To ensure that AGMG retains robust audit and inspection rights over all adtech vendors processing personal data on its behalf, in compliance with GDPR Article 28(3)(h).
Work Performed. Audit and inspection rights conforming to the requirements of GDPR Article 28(3)(h) were incorporated into all nine renegotiated vendor DPAs. The audit rights provisions are consistent across all nine agreements and include the following entitlements:
(a) AGMG's right to conduct on-site audits of vendor facilities, including data centres and offices where personal data is processed, upon reasonable notice (generally not less than fifteen (15) business days);
(b) AGMG's right to conduct remote audits, including the right to request and receive documentation, certifications, and summaries of audit reports from the vendor's internal or external auditors;
(c) Sub-processor audit flow-down, requiring each vendor to ensure that equivalent audit rights are extended to AGMG in respect of all sub-processors engaged by the vendor;
(d) AGMG's right to commission third-party audits conducted by an independent auditor selected by AGMG, at the vendor's cost, in the event of a material breach of the DPA or a reasonable suspicion of non-compliance with data protection obligations; and
(e) Obligations on the vendor to cooperate fully with any audit or inspection and to provide all reasonably requested access, information, and assistance.
These provisions provide AGMG with a comprehensive audit framework that supports ongoing vendor oversight and enables the Client to verify compliance with the terms of each DPA on an ongoing basis.
Status: Completed.
3.6 Workstream 6: DPIA and ROPA Updates
Objective. To update AGMG's Data Protection Impact Assessments and Records of Processing Activities to reflect the remediated data flows, updated vendor landscape, and revised consent mechanisms.
Work Performed. C&H prepared updated Data Protection Impact Assessments for AGMG's two principal high-risk processing activities affected by the remediation programme: (i) programmatic advertising (including real-time bidding and ad targeting), and (ii) audience analytics (including audience segmentation and behavioural profiling). The updated DPIAs were conducted pursuant to Article 35 of the GDPR and were delivered to the Client on 18 April 2024. Each DPIA reflects the remediated data flows, the updated vendor landscape and DPA terms, the mitigating measures implemented through the Engagement (consent-gated processing, compliant consent interfaces, updated DPAs, SCCs, and Transfer Impact Assessments), and a residual risk assessment. The DPIAs include a recommendation for DPO sign-off by Margaux Fontaine-Li, Group Data Protection Officer, confirming that the residual risk to data subjects is acceptable in light of the implemented safeguards.
Separately, C&H prepared updated Records of Processing Activities pursuant to Article 30 of the GDPR. The updated ROPA was delivered on 22 April 2024 and reflects all remediated processing activities across the fourteen websites and three mobile applications, including updated entries for each vendor relationship, the legal bases relied upon, the categories of data subjects and personal data processed, the retention periods, and the international transfer mechanisms in place.
Status: Completed.
3.7 Workstream 7: Regulatory Responses
Objective. To prepare and submit comprehensive regulatory responses to CNIL and the ICO, demonstrating AGMG's full remediation of the identified non-compliances.
Work Performed.
CNIL Response. The original CNIL compliance deadline under formal notice MED-2023-097 was 14 March 2024. Given that certain remediation workstreams — particularly the DPA renegotiations and the mobile app consent flow updates — required additional time to complete, C&H filed an extension request with CNIL on 11 March 2024, three days prior to the original deadline. The extension request detailed the scope of the remediation programme underway, the workstreams already completed, and the anticipated timeline for completion of the remaining workstreams. On 18 March 2024, CNIL granted a thirty-day extension, establishing a new compliance deadline of 14 April 2024.
The full CNIL compliance response was submitted on 12 April 2024, two days prior to the extended deadline. The response comprised a detailed narrative submission demonstrating AGMG's remediation of all deficiencies identified in the formal notice, supported by extensive technical evidence exhibits. These exhibits included: (i) before-and-after screenshots of the cookie-consent interfaces on aurelius-stream.fr and all other French-facing websites; (ii) automated cookie scan results demonstrating that no non-essential cookies fire prior to consent; (iii) CMP configuration logs from ConsentShield confirming the consent-gated firing of all non-essential tags and pixels; (iv) copies of executed DPAs for all relevant vendors; and (v) extracts from the updated DPIAs and ROPA.
ICO Response. The ICO response was submitted on 15 April 2024. The response addressed the specific concerns raised in the ICO's informal inquiry regarding PECR Regulation 6 compliance for analytics cookies and UK GDPR consent requirements on aureliusnews.co.uk and shopaurelia.co.uk. The response provided a detailed account of the remediation steps undertaken, including the consent-gating of all server-side tracking pixels, the deployment of compliant consent mechanisms with "Reject All" functionality and consent withdrawal in two clicks, and the execution of GDPR Article 28-compliant DPAs with all relevant vendors. The response was accompanied by technical evidence similar to that provided to CNIL, adapted for the UK regulatory context.
Status: Completed.
4. Regulatory Outcomes
4.1 CNIL Outcome
On 29 April 2024, CNIL issued a formal acknowledgment of compliance in response to AGMG's submission of 12 April 2024. CNIL confirmed that AGMG had satisfactorily addressed all deficiencies identified in formal notice MED-2023-097 and that the measures implemented were adequate to bring AGMG's practices into compliance with the applicable provisions of the Loi Informatique et Libertés and the ePrivacy Directive.
Critically, no administrative fine was imposed. The formal notice MED-2023-097 has been resolved in its entirety, and the underlying complaint PLT-2023-FR-04821 filed by DRE has been formally closed.
The significance of this outcome is substantial. Based on AGMG's global annual turnover of £1.42 billion for FY 2023, the maximum administrative fine that CNIL could have imposed under Article 83(5) of the GDPR was 4% of global annual turnover, equating to approximately £56.8 million (approximately €64.7 million at current exchange rates). While maximum fines are reserved for the most egregious cases, C&H's assessment at the outset of the Engagement was that the realistic fine exposure for the deficiencies identified ranged from approximately €3 million to €8 million, taking into account CNIL's published enforcement precedents for cookie-consent violations (including the €150 million fine imposed on a major social media company in January 2022 and the €60 million fine imposed on a leading technology company in the same period, as well as lower-range fines in the €1–3 million bracket for less prominent companies). The avoidance of any fine whatsoever represents a highly favourable outcome.
4.2 ICO Outcome
On 1 May 2024, the ICO issued a formal closure letter confirming that no further action would be taken in connection with inquiry ICO/ENF/2023/LTR-11084. The closure letter acknowledged the detailed remediation steps described in AGMG's response and stated that the ICO was satisfied that the measures implemented were adequate to address the concerns identified.
The inquiry has been formally closed, and no enforcement notice, assessment notice, or monetary penalty notice has been issued. The maximum fine that the ICO could have imposed under Section 157 of the Data Protection Act 2018, read in conjunction with Article 83 of the UK GDPR, was £17.5 million (being the higher maximum applicable to infringements of the data protection principles and data subjects' rights). The avoidance of any penalty is again a favourable result.
4.3 Significance of Outcomes
The outcomes achieved in both the CNIL and ICO proceedings are significant for AGMG in several respects:
No financial penalty. No administrative fine has been imposed by either regulator, thereby avoiding potential combined exposure of up to approximately €64.7 million (CNIL) and £17.5 million (ICO).
No adverse public enforcement action. Neither regulator has published an adverse enforcement decision or press release in connection with the matters. This preserves AGMG's public reputation and avoids the reputational damage that frequently accompanies published enforcement actions in the privacy and data protection sphere.
Implications for financial reporting. C&H previously provided a letter to AGMG's Audit Committee and external auditors, Hollander Warwick LLP (85 Gresham Street, London EC2V 7NQ), confirming our assessment that the remediation did not give rise to material contingent liabilities requiring disclosure in AGMG's FY 2023 annual report and financial statements. The favourable regulatory outcomes achieved validate that assessment and confirm that no post-balance sheet event disclosure adjustment is required.
Revenue preservation. The timely and effective remediation of AGMG's cookie-consent and adtech practices has preserved the commercial relationships underlying AGMG's digital advertising operations. The vendor-related revenue at risk — estimated at approximately €26.3 million annually, comprising €18.4 million in Pendleton revenue-share, approximately €3.9 million from the seven other remediated vendor relationships, and approximately €4.0 million in VoltGraph-driven audience segmentation uplift — has been retained without disruption. Had the regulatory proceedings escalated to formal enforcement action, there was a meaningful risk that AGMG would have been required to suspend non-compliant processing activities pending remediation, with significant revenue consequences.
5. Financial Summary
5.1 Calderwood & Harkness LLP Professional Fees
The Engagement was conducted under a capped fee arrangement, as set out in the engagement letter dated 12 January 2024. The capped fee was £425,000, exclusive of VAT and disbursements. Under the terms of the engagement letter, C&H agreed to invoice fees at standard hourly rates up to the cap, with any excess absorbed by C&H.
Actual hours worked and fees incurred by the C&H team are set out in the table below:
The total pre-cap fees of £420,825 fall within the agreed cap of £425,000, resulting in an under-cap margin of £4,175. Accordingly, no cap adjustment is required, and the full amount of actual fees has been invoiced to the Client. The total amount invoiced to AGMG for C&H professional fees is £420,825 (exclusive of VAT).
5.2 Thistlewood Consulting Ltd Disbursement
Thistlewood Consulting Ltd was retained for a fixed fee of £145,000 to provide technical cookie audit and remediation implementation support services. This fee was agreed between AGMG and Thistlewood, with C&H overseeing the scope of work under the common-interest arrangement. The Thistlewood fee has been invoiced to AGMG as a pass-through disbursement, separate from C&H's professional fees.
5.3 Total Client Cost
The total cost to the Client for the Engagement is summarised as follows:
For the avoidance of doubt, the Brightleaf ConsentShield CMP annual license fee of €385,000 is a pre-existing AGMG operating cost under a separate commercial agreement between AGMG and Brightleaf, and does not form part of the C&H Engagement fees or the total client cost stated above.
6. Engagement Timeline — Key Milestones Recap
The following table provides a complete chronological summary of all key milestones from the opening to the closing of the Engagement:
7. Recommended Ongoing Compliance Governance Framework
While the Engagement has been completed and both regulatory matters resolved, the compliance posture achieved through the remediation programme must be maintained on an ongoing basis to ensure that AGMG remains in continuous compliance with the GDPR, the ePrivacy Directive, PECR, and the applicable national implementing laws of each jurisdiction in which AGMG operates its digital properties. This Section sets forth C&H's recommended ongoing compliance governance framework. The recommendations below are advisory in nature, and responsibility for implementation rests with AGMG's internal teams.
7.1 Governance Structure
C&H recommends that Margaux Fontaine-Li, in her capacity as Group Data Protection Officer, be designated as the ongoing compliance programme owner with primary responsibility for the continued effectiveness of AGMG's cookie-consent and adtech compliance programme. The DPO should maintain a direct reporting line to Sanjay Redworth, Group General Counsel & Company Secretary, on all matters arising from the programme, with periodic reporting — at minimum on a quarterly basis — to the AGMG Board of Directors and/or the Audit Committee.
In addition, AGMG should establish a cross-functional Privacy Steering Committee with a formal charter and regular meeting cadence (recommended: monthly). The Privacy Steering Committee should comprise senior representatives from the following functions:
• Legal (Group General Counsel's office);
• DPO Office (Group DPO and direct reports);
• CTO / Engineering (under Leander Voss, CTO);
• Digital Media (editorial, content, and streaming product teams);
• Commercial / Advertising (programmatic advertising and commercial partnerships teams).
A clear RACI (Responsible, Accountable, Consulted, Informed) matrix should be established and maintained for all cookie-consent and adtech compliance activities across AGMG's business units. The RACI matrix should delineate responsibilities for decisions such as the deployment of new cookies or tracking technologies, the onboarding of new adtech vendors, CMP configuration changes, and the handling of cookie-consent related complaints or regulatory inquiries. The Privacy Steering Committee should review and update the RACI matrix at least annually.
7.2 Quarterly Cookie Scans
AGMG should conduct automated cookie scans of all fourteen European-facing websites and three mobile applications on a quarterly basis, using Thistlewood Consulting or an equivalent specialist technical provider. The purpose of these quarterly scans is to verify on an ongoing basis that:
(a) no non-essential cookies or tracking technologies fire before valid user consent is recorded via the ConsentShield CMP;
(b) all cookies are correctly classified within the CMP across the four standard categories: strictly necessary, functional, analytics, and advertising;
(c) the ConsentShield CMP configuration remains intact and is functioning as intended, including proper consent-gated tag firing, accurate TCF 2.2 consent string generation and propagation, and correct purpose mapping;
(d) no new or undeclared cookies have been introduced as a result of vendor tag updates, site deployments, or other changes to AGMG's digital properties.
Quarterly scan results should be reviewed by the Group DPO and reported to the Privacy Steering Committee. Any non-compliances identified should be triaged and remediated in accordance with the incident response procedure described in Section 7.9 below.
7.3 Annual DPA Reviews
AGMG should conduct an annual review of all twenty-three (23) vendor DPAs currently in effect (and any additional DPAs executed in connection with new vendors onboarded during the year) to ensure continued compliance with GDPR Article 28 and alignment with regulatory developments. The annual review should assess:
(a) the adequacy of processing instructions and whether they continue to reflect the actual processing activities being conducted;
(b) the status and adequacy of sub-processor controls, including whether any new sub-processors have been engaged and whether the required notification and approval mechanisms have been followed;
(c) the validity and adequacy of cross-border transfer mechanisms, including SCCs, Transfer Impact Assessments, and reliance on any new adequacy decisions issued by the European Commission or the UK Secretary of State;
(d) the ongoing appropriateness of the technical and organisational security measures specified in each DPA; and
(e) any changes to the vendor's data protection practices, certifications, or regulatory standing that may affect the adequacy of the DPA.
In addition to the scheduled annual review, DPA reviews should also be triggered on an ad hoc basis in response to material changes to a vendor's processing activities, the issuance of new or updated regulatory guidance from relevant data protection authorities, or significant CJEU or national court jurisprudence bearing on data processing agreements, cross-border transfers, or related matters.
7.4 Biannual DPIA Refreshes
The Data Protection Impact Assessments prepared under Workstream 6 for AGMG's programmatic advertising and audience analytics processing activities should be refreshed on a biannual basis — that is, every six months — or more frequently in the event of material changes to processing operations, data volumes, the vendor landscape, or the applicable regulatory environment. Each DPIA refresh should reassess the necessity and proportionality of the processing, the risks to data subjects, and the adequacy of the mitigating measures in place. DPO sign-off is required for each DPIA refresh, confirming that the residual risk to data subjects remains acceptable.
7.5 CMP Configuration Audits
In addition to the quarterly cookie scans (which verify output compliance), AGMG should conduct dedicated quarterly audits of the Brightleaf ConsentShield CMP configuration itself. These configuration audits should verify:
(a) continued IAB TCF 2.2 compliance, including accurate vendor list and purpose mappings;
(b) correct configuration of consent-gated tag and pixel firing rules for all non-essential technologies;
(c) consent string generation and propagation integrity;
(d) accurate multi-language banner copy across all six supported languages; and
(e) proper functioning of the "Reject All" button, granular consent toggles, and consent withdrawal mechanism.
AGMG should coordinate with Brightleaf's EMEA team, and specifically with Katarina van Hoorn (VP EMEA), to ensure that CMP platform updates and vendor list changes are reviewed and implemented promptly. An immediate remediation protocol should be in place in the event that any CMP misconfiguration is detected, with remediation prioritised in accordance with the severity classifications described in Section 7.9 below.
7.6 Vendor Onboarding Privacy Assessments
AGMG should implement a mandatory pre-onboarding privacy assessment for any new adtech or analytics vendor before that vendor's technologies are deployed on any AGMG European digital property. The purpose of this assessment is to ensure that privacy and data protection requirements are satisfied before any personal data is shared with the new vendor. The assessment should encompass:
(a) a legal basis analysis, determining the appropriate legal basis for the proposed processing and confirming that consent (where required) can be obtained through the ConsentShield CMP;
(b) DPA negotiation and execution, ensuring that a fully GDPR Article 28-compliant DPA is in place before any data sharing commences;
(c) a cross-border transfer mechanism review, assessing whether the vendor or any of its sub-processors transfers personal data outside the EU/EEA or the UK, and ensuring that adequate transfer mechanisms (SCCs, TIAs, or adequacy decisions) are in place;
(d) sub-processor due diligence, identifying all sub-processors that the vendor intends to engage and assessing the adequacy of the flow-down obligations; and
(e) CMP integration planning, confirming that the vendor's tags, pixels, or other tracking technologies can be integrated with ConsentShield for consent-gated firing.
The vendor onboarding privacy assessment should operate as a formal approval gate: DPO sign-off from Margaux Fontaine-Li must be obtained before any new vendor is activated on AGMG's European properties. No vendor technology should be deployed without completed DPO approval.
7.7 Training Programme
AGMG should maintain a programme of annual mandatory training for all personnel involved in the management, configuration, and deployment of cookies, tracking technologies, and adtech on AGMG's European digital properties. This training should be delivered to AGMG's digital media, engineering, and product teams and should cover the following topics:
(a) GDPR and ePrivacy Directive / PECR cookie-consent requirements, including the legal bases for cookies and similar technologies, the requirements for valid consent, and the prohibition on pre-consent deployment of non-essential technologies;
(b) dark-pattern identification and avoidance, drawing upon regulatory guidance from CNIL, the EDPB, and the ICO, and reinforcing the design principles implemented through the Engagement;
(c) vendor data-flow awareness and escalation procedures, ensuring that personnel understand how personal data flows from AGMG's digital properties to third-party vendors and how to identify and escalate potential non-compliances;
(d) CMP usage and configuration protocols, providing practical guidance on the correct use of the ConsentShield platform, including cookie classification, tag manager configuration, and consent string management; and
(e) incident reporting for non-compliant cookie or pixel deployments, including the obligation to report suspected non-compliances immediately to the DPO office and the escalation path described in Section 7.9 below.
In addition to the annual mandatory training cycle, supplemental ad hoc training sessions should be delivered when there are material changes to regulatory guidance, internal policies, CMP configuration, or the vendor landscape that affect the day-to-day obligations of relevant personnel.
7.8 Regulatory Monitoring and Horizon Scanning
AGMG should maintain an ongoing programme of regulatory monitoring and horizon scanning to ensure that its cookie-consent and adtech compliance practices remain aligned with the evolving regulatory landscape. This monitoring should encompass:
(a) enforcement actions, guidance documents, and opinions issued by CNIL, the ICO, and other EU/EEA data protection authorities with jurisdiction over AGMG's operations (including the German Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the relevant Landesdatenschutzbehörden, the Dutch Autoriteit Persoonsgegevens, the Spanish Agencia Española de Protección de Datos, and the Italian Garante per la protezione dei dati personali);
(b) developments in the legislative process for the proposed ePrivacy Regulation, which, once adopted, will replace the current ePrivacy Directive and may introduce new or modified rules governing cookies and electronic communications;
(c) changes to the IAB Transparency & Consent Framework, including new TCF versions, policy updates, or amendments to the vendor list management process that may require CMP reconfiguration; and
(d) relevant judgments of the Court of Justice of the European Union and national courts bearing on consent, cookies, legitimate interest, and adtech data processing.