PRIVILEGED AND CONFIDENTIAL PREPARED AT THE DIRECTION OF LEGAL COUNSEL
Updated Data Protection Impact Assessment
Programmatic Advertising Processing Activities
Aurelius Global Media Group PLC Companies House No. 08741562 140 Threadneedle Row, London EC2R 8AH, United Kingdom
18 April 2024
DPIA Reference: AGMG-DPIA-PA-2024-002 (supersedes AGMG-DPIA-PA-2022-001)
Prepared by: Priscilla Wynn, Senior Associate, and Alan Burke, Associate, Calderwood & Harkness LLP, One Finsbury Square, London EC2A 1AE, United Kingdom
C&H Matter No.: 1017-00008
Reviewed by: Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
Client Contacts: Sanjay Redworth, Group General Counsel & Company Secretary, Aurelius Global Media Group PLC; Margaux Fontaine-Li, Group Data Protection Officer, Aurelius Global Media Group PLC
DPO Sign-Off: Pending recommendation by Margaux Fontaine-Li (see Section 12)
Right-click to update Table of Contents
Section 1: Document Control and Version History
1.1 Version Table
This Data Protection Impact Assessment ("DPIA") has been prepared by Calderwood & Harkness LLP ("C&H") on behalf of Aurelius Global Media Group PLC ("AGMG" or the "Company") in connection with the Company's programmatic advertising processing activities across its European digital properties. The version history of this DPIA is set forth below.
Reason for Update. This Version 2.0 DPIA has been prepared as a component of the comprehensive remediation of cookie-consent mechanisms and adtech data flows undertaken by AGMG following three concurrent regulatory and litigation events:
(a) CNIL Formal Notice MED-2023-097 (dated 14 December 2023), issued by the Commission Nationale de l'Informatique et des Libertés ("CNIL") following its investigation into complaint PLT-2023-FR-04821, establishing a three-month compliance deadline (originally 14 March 2024, subsequently extended to 14 April 2024);
(b) Complaint PLT-2023-FR-04821 (dated 8 November 2023), filed with the CNIL by Digitale Rechte Europa e.V. ("DRE"), a Berlin-based digital rights advocacy organisation, alleging that AGMG's French-language streaming site aurelius-stream.fr deployed 47 third-party tracking cookies before any user consent and employed dark-pattern cookie banners designed to manipulate user choices; and
(c) ICO Informal Inquiry ICO/ENF/2023/LTR-11084 (dated 22 December 2023), issued by the Information Commissioner's Office ("ICO") regarding server-side tracking pixels deployed on aureliusnews.co.uk and shopaurelia.co.uk and the adequacy of PECR-compliant consent for analytics cookies deployed on those properties.
The Version 1.0 DPIA, while a good-faith effort by AGMG's internal privacy team, was materially incomplete in several respects: it did not adequately map server-side tracking pixel data flows, did not assess vendor data processing agreements against Article 28 GDPR requirements, and did not evaluate international data transfer mechanisms under Articles 44–49 GDPR. This Version 2.0 DPIA addresses all such deficiencies and reflects the remediated state of AGMG's programmatic advertising processing activities as of 18 April 2024.
1.2 Distribution List
This DPIA is classified as Privileged and Confidential and has been prepared at the direction of legal counsel. Distribution is limited to the following individuals and entities:
No further distribution of this DPIA, in whole or in part, shall be made without the prior written consent of the Group General Counsel or Calderwood & Harkness LLP. Recipients are reminded that this document is protected by legal professional privilege and the common-interest privilege, and any unauthorised disclosure may constitute a waiver of such privilege.
1.3 Related Documents
The following documents form part of or are referenced in this DPIA and should be read in conjunction herewith:
All documents listed above are maintained in AGMG's privileged document repository and the Calderwood & Harkness LLP document management system under Matter No. 1017-00008.
Section 2: Introduction and Regulatory Context
2.1 Purpose of This DPIA
This DPIA is conducted pursuant to Article 35 of Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and the equivalent provision retained in United Kingdom law by the UK GDPR, as supplemented by the Data Protection Act 2018 (the "DPA 2018"). Article 35(1) GDPR mandates that a controller carry out an assessment of the impact of the envisaged processing operations on the protection of personal data where a type of processing, in particular using new technologies, and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons.
AGMG's programmatic advertising processing activities trigger the DPIA obligation under multiple limbs of Article 35(3):
(a) Article 35(3)(a): The processing involves systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person. AGMG's programmatic advertising ecosystem creates audience segments and user profiles based on browsing behaviour, content consumption, purchase history, and device characteristics, which are then used to deliver targeted advertisements and influence the content and commercial offers presented to individual users.
(b) Article 35(3)(b): The processing involves processing on a large scale of personal data referred to in Article 9(1) or Article 10, or, more relevantly to the present case, involves processing on a large scale of personal data that, while not falling within special categories, nonetheless creates high risk by virtue of its volume, scope, and the nature of the profiling activities. With approximately 87 million monthly active users across EU/EEA properties, the scale of AGMG's programmatic advertising processing is substantial by any measure.
(c) In addition, the processing falls within the categories identified by supervisory authorities as requiring a DPIA, including the CNIL's published list of processing operations requiring a DPIA (Délibération n° 2018-326 du 11 octobre 2018) and the ICO's screening criteria, both of which identify large-scale profiling for behavioural advertising as warranting impact assessment.
This DPIA further satisfies the requirements set forth in the CNIL's published DPIA guidance (including Guides PIA published by the CNIL in 2018, updated 2023) and the ICO's DPIA guidance under Part 5 of its Guide to the UK GDPR.
The objectives of this DPIA are to: (i) systematically describe the programmatic advertising processing activities conducted by or on behalf of AGMG; (ii) assess the necessity and proportionality of such processing in relation to its purposes; (iii) identify and assess the risks to the rights and freedoms of data subjects; (iv) identify the measures envisaged to address those risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data and to demonstrate compliance with the GDPR; and (v) document the residual risks remaining after implementation of mitigating measures.
2.2 Background — CNIL Formal Notice and ICO Inquiry
The immediate impetus for this updated DPIA was a series of regulatory and advocacy developments in the final quarter of 2023, which exposed material deficiencies in AGMG's programmatic advertising data flows, cookie-consent mechanisms, and vendor management practices.
The DRE Complaint. On 8 November 2023, Digitale Rechte Europa e.V. ("DRE"), a Berlin-based digital rights advocacy organisation led by Executive Director Friederike Nolte, filed complaint PLT-2023-FR-04821 with the CNIL. DRE is a registered German association (eingetragener Verein) with a mandate to advocate for digital rights and data protection across the European Union. DRE is represented in this matter by Dr. Tobias Kreisel of Kreisel & Hausmann Rechtsanwälte PartG mbB, Friedrichstraße 95, 10117 Berlin, Germany.
The DRE complaint alleged that AGMG's French-language streaming site aurelius-stream.fr:
(a) deployed 47 third-party tracking cookies on users' terminal equipment before any consent was sought or obtained, in violation of Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC) as transposed into French law;
(b) employed dark-pattern cookie banners designed to manipulate users into accepting non-essential cookies, including asymmetric button design (a prominent green "Accept All" button and a small, greyed-out "Manage Preferences" link), pre-ticked consent boxes for advertising and analytics purposes, and a consent withdrawal mechanism requiring no fewer than five clicks through multiple sub-menus;
(c) transmitted personal data — including full IP addresses, device fingerprints, and browsing history — to third-party adtech vendors via server-side tracking pixels without user knowledge or consent; and
(d) lacked adequate contractual controls with its adtech vendor partners, including the absence of GDPR-compliant data processing agreements with several vendors receiving AGMG user data.
DRE's complaint was accompanied by a detailed technical appendix prepared by Dr. Kreisel's technical advisors, documenting the cookie deployment behaviour observed during testing conducted between 15 October and 5 November 2023.
The CNIL Formal Notice. Following its review of DRE's complaint, the CNIL issued formal notice MED-2023-097 on 14 December 2023, addressed to AGMG's French establishment (Aurelius Media France SAS, 28 Rue de Mogador, 75009 Paris). The formal notice identified the following principal violations:
(a) deployment of non-essential cookies before obtaining user consent, in violation of Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (the "Loi Informatique et Libertés") and the CNIL's Lignes directrices sur les cookies et autres traceurs (Délibération n° 2020-091 du 17 septembre 2020, as updated);
(b) use of dark-pattern consent interfaces that did not afford users a genuine and free choice, contrary to the requirements of Article 7 GDPR and the CNIL's guidance requiring "Reject All" options of equal prominence to "Accept All" options; and
(c) failure to demonstrate adequate technical and organisational measures to ensure that consent was validly obtained and recorded before personal data was processed for advertising purposes.
The CNIL established a three-month compliance deadline of 14 March 2024. Upon AGMG's reasoned request (filed 11 March 2024 by C&H on behalf of AGMG), the CNIL granted a one-month extension on 18 March 2024, establishing a revised compliance deadline of 14 April 2024. The formal notice warned that failure to comply within the deadline could result in the CNIL referring the matter to its formation restreinte for the imposition of administrative fines of up to 4% of worldwide annual turnover pursuant to Article 83(5) GDPR. Based on AGMG's FY 2023 consolidated revenue of £1.42 billion (approximately €1.617 billion at average 2023 exchange rates), the maximum theoretical fine exposure was approximately €64.7 million.
The ICO Inquiry. On 22 December 2023, the ICO sent informal inquiry ICO/ENF/2023/LTR-11084 to AGMG's UK registered office. The inquiry was prompted by the ICO's own monitoring activities and related to:
(a) the deployment of server-side tracking pixels on aureliusnews.co.uk and shopaurelia.co.uk that transmitted personal data (including IP addresses and device fingerprints) to third-party adtech vendors; and
(b) the adequacy of consent obtained under Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") for analytics cookies deployed on those properties.
The ICO requested a detailed response within 28 days setting out the legal basis for the relevant processing, the consent mechanisms in place, and the technical measures implemented to ensure compliance with PECR and the UK GDPR. The ICO noted that it reserved the right to open a formal investigation and exercise its enforcement powers under sections 149–155 of the DPA 2018 if the response was unsatisfactory. The maximum fine available to the ICO under section 157 of the DPA 2018 is £17.5 million or 4% of total worldwide annual turnover, whichever is higher.
Engagement of Calderwood & Harkness LLP. In light of these concurrent regulatory developments, AGMG's Group General Counsel, Sanjay Redworth, engaged Calderwood & Harkness LLP on 12 January 2024 to conduct a comprehensive remediation of AGMG's cookie-consent mechanisms, adtech data flows, vendor contracts, and data protection compliance framework across all European digital properties. The engagement was scoped to include a technical cookie audit (conducted by Thistlewood Consulting Ltd under common-interest privilege), legal analysis of data flows and vendor relationships, renegotiation of vendor data processing agreements, redesign of consent mechanisms, preparation of regulatory responses, and delivery of this updated DPIA.
2.3 Scope of This DPIA
This DPIA covers all programmatic advertising processing activities conducted by or on behalf of AGMG across its European digital estate, specifically:
(a) Digital Properties: Fourteen (14) European-facing websites operated by AGMG or its subsidiaries, including aurelius-stream.fr, aureliusnews.co.uk, shopaurelia.co.uk, and eleven additional properties (the full list of which is set out in Annex C), and three (3) mobile applications (two iOS applications and one Android application) offered in the EU/EEA markets.
(b) Jurisdictions: The United Kingdom, France, Germany, the Netherlands, Spain, and Italy. While AGMG's digital properties are accessible globally, the processing activities assessed in this DPIA relate specifically to users located in the foregoing jurisdictions, which together account for the overwhelming majority of AGMG's European user base and revenue.
(c) User Base: Approximately 87 million monthly active users ("MAUs") across EU/EEA properties, comprising both registered users (those who have created an account on one or more AGMG properties) and unregistered users (visitors who browse without authentication).
(d) Temporal Scope: This DPIA reflects the remediated state of data flows and consent mechanisms as of 18 April 2024, following the substantial completion of the remediation programme described in Section 8. Where pre-remediation processing is discussed (for the purpose of baseline risk assessment), this is expressly noted.
This DPIA does not cover: (i) processing activities on AGMG's non-European properties (including its US, Australian, and Asian digital estates); (ii) HR data processing; (iii) B2B marketing activities; or (iv) editorial content management, each of which is subject to separate assessment under AGMG's data protection governance framework.
Section 3: Description of the Processing
3.1 Nature of Processing
AGMG's programmatic advertising activities involve the automated buying, selling, and placement of digital advertisements through real-time bidding ("RTB") auctions. RTB is a process by which digital advertising inventory is bought and sold on a per-impression basis through automated, instantaneous auctions that occur in the milliseconds between a user requesting a webpage or app screen and the content being rendered. This process depends on the collection, aggregation, and transmission of user data to enable advertisers to target advertisements to users based on their inferred interests, demographics, and behaviour.
The processing activities encompassed within AGMG's programmatic advertising ecosystem include, but are not limited to, the following:
(a) Cookie placement: The writing of first-party and third-party cookies to users' terminal equipment upon affirmative consent, enabling identification and tracking of users across sessions and properties within the AGMG ecosystem.
(b) Pixel firing: The activation of client-side and server-side tracking pixels that transmit data (including online identifiers, IP addresses, device characteristics, and page-view information) to AGMG's adtech vendor partners for the purpose of audience measurement, segmentation, and ad targeting.
(c) IP address collection: The collection of users' IP addresses, both in full form and in truncated form (where data minimisation measures have been implemented), for the purposes of geolocation inference and fraud detection.
(d) Device fingerprinting: The collection and analysis of device-level attributes — including browser type and version, operating system version, screen resolution, installed browser plugins, language settings, and time zone — to generate a probabilistic device identifier used for cross-device recognition and fraud detection.
(e) Browsing history aggregation: The collection and aggregation of page-view data, content consumption data, and navigation patterns across AGMG's European properties, used to infer user interests and build audience profiles.
(f) Audience segmentation: The classification of users into audience segments based on their observed behaviour, inferred interests, and demographic characteristics, enabling advertisers to target specific audience groups.
(g) Cross-device tracking: The linking of user activity across multiple devices (e.g., desktop, mobile, tablet) and sessions to create a unified user profile, enabling consistent ad targeting and frequency capping across devices.
(h) Bid request generation and transmission: The generation of bid requests containing user data (including audience segments, contextual signals, and device characteristics) and their transmission to demand-side platforms ("DSPs") and ad exchanges participating in RTB auctions.
(i) Ad impression logging: The recording of ad impressions served to individual users, including the identity of the advertiser, the creative displayed, the placement location, and the timestamp.
(j) Click-through tracking: The recording of user clicks on served advertisements, including the destination URL and any associated conversion identifiers.
(k) Conversion attribution: The tracking of post-click and post-view user actions (such as purchases, sign-ups, or other defined conversion events) and the attribution of those conversions to specific ad impressions or clicks for the purpose of campaign performance measurement and financial reconciliation.
Controller–Processor Relationships. In respect of the foregoing processing activities, AGMG acts as the data controller within the meaning of Article 4(7) GDPR. AGMG determines the purposes and means of the processing — specifically, the decision to deploy programmatic advertising, the selection of adtech vendors, the configuration of data collection mechanisms, and the definition of audience segments. AGMG's adtech vendors act as data processors within the meaning of Article 4(8) GDPR, processing personal data on behalf of and in accordance with AGMG's documented instructions.
In certain limited and clearly delineated instances, specific adtech vendors act as independent data controllers in respect of their own internal analytics and product improvement purposes. Where this is the case, it is identified in the applicable data processing agreement and the vendor's own privacy notice. AGMG has satisfied itself that these independent controller activities are disclosed to data subjects and that they have a lawful basis independent of AGMG's consent mechanisms.
3.2 Scope of Processing
The scale and scope of AGMG's programmatic advertising processing activities are substantial:
Digital Properties. The processing extends across fourteen (14) European-facing websites and three (3) mobile applications. The websites include:
• aurelius-stream.fr (French-language video streaming)
• aureliusnews.co.uk (UK-facing news and media)
• shopaurelia.co.uk (UK-facing e-commerce)
• Eleven (11) additional properties serving German, Dutch, Spanish, and Italian markets (listed in full in Annex C)
The mobile applications comprise two (2) iOS applications (Aurelius Stream and Aurelius News, both available on the Tidewater Industries App Store) and one (1) Android application (Aurelius Stream, available on Severin Industries Play).
Data Subjects. The processing affects approximately 87 million monthly active users across the EU/EEA. This figure encompasses both registered users who have created accounts on one or more AGMG properties and unregistered visitors who browse without authentication. The MAU figure is derived from AGMG's internal analytics platform and was validated by Thistlewood Consulting Ltd during the technical audit.
Volume of Processing. The volume of data processing is considerable:
• Pendleton AdTech Solutions Ltd, AGMG's primary demand-side platform and RTB intermediary, alone processes approximately 4.2 billion ad bid requests per month involving AGMG user data. Each bid request contains a structured data payload including a user identifier, audience segment labels, device characteristics, contextual signals, and geolocation data derived from the user's IP address.
• VoltGraph Analytics GmbH, AGMG's secondary adtech vendor specialising in cross-device tracking and audience segmentation, processes approximately 320 million unique user profiles per year derived from AGMG properties. VoltGraph's processing involves the ingestion and analysis of data collected via server-side tracking pixels deployed on nine (9) of AGMG's fourteen (14) European websites.
Cookies. The Thistlewood Consulting technical audit, conducted between 22 January 2024 and 16 February 2024, identified a total of 312 unique cookies deployed across the 14 EU-facing websites. Of these:
• 38 cookies were classified as "strictly necessary" (i.e., essential for the operation of the website or the provision of a service explicitly requested by the user) and therefore exempt from the consent requirement under Article 5(3) of the ePrivacy Directive and Regulation 6(4) of PECR;
• 67 cookies were classified as "analytics" cookies;
• 41 cookies were classified as "functional" cookies (providing enhanced functionality or personalisation features beyond strict necessity); and
• 166 cookies were classified as "advertising/targeting" cookies (used for the purpose of delivering personalised advertisements, audience segmentation, or cross-site tracking).
Server-Side Tracking Pixels. The audit identified 19 unique server-side tracking pixels deployed across the European estate. Of these, 12 were found to transmit personal data — including full IP addresses, device fingerprints, and browsing history — to third-party adtech vendors. Server-side pixels are particularly significant from a data protection perspective because they operate on AGMG's servers rather than on the user's device, rendering them invisible to browser-based privacy tools and cookie-blocking extensions.
Adtech Vendors. AGMG's programmatic advertising ecosystem involves a total of 23 adtech vendors that process AGMG user data in various capacities, including demand-side platforms, supply-side platforms, data management platforms, ad exchanges, attribution providers, and analytics providers. A complete register of these vendors, their roles, jurisdictions, and DPA status is set forth in Annex C.
3.3 Context of Processing
Understanding the organisational and commercial context of AGMG's programmatic advertising activities is essential to the proper assessment of risks and proportionality.
Organisational Context. AGMG is a United Kingdom-headquartered public media and e-commerce conglomerate listed on the London Stock Exchange (ticker: AGMG), with a market capitalisation of approximately £3.8 billion as of January 2024. The Company operates digital media, streaming, news, and e-commerce properties across Europe, North America, Asia-Pacific, and Australia. AGMG employs approximately 6,200 people globally, of whom approximately 2,100 are based in the EU/EEA and the United Kingdom.
Commercial Context. AGMG reported consolidated revenue of £1.42 billion for the financial year ended 31 December 2023. Of this total, approximately £612 million (approximately 43% of group revenue) was generated from EU/EEA digital advertising and e-commerce operations. Programmatic advertising constitutes a core revenue driver for the Company:
• Revenue-share arrangements with Pendleton AdTech Solutions Ltd alone generate approximately €18.4 million per year for AGMG;
• Total annual revenue attributable to the 23 adtech vendor relationships covered by this DPIA is estimated at approximately €26.3 million; and
• The broader digital advertising ecosystem (including direct sales, programmatic, and affiliate revenue) supports the Company's ability to offer both ad-supported free content and premium subscription tiers across its European properties.
Any material disruption to AGMG's programmatic advertising operations — whether through regulatory enforcement, vendor termination, or loss of user consent at scale — would have a significant impact on the Company's financial performance and would be required to be disclosed to the market under the Company's continuous disclosure obligations as an LSE-listed issuer.
Industry Context. AGMG's programmatic advertising activities take place against a backdrop of increasing regulatory scrutiny of adtech data flows across Europe. The CNIL has made cookie-consent enforcement a stated priority since 2020, imposing significant fines on major operators including Calderon Corporation (€150 million, December 2021), Kestrel Services Inc. Ireland Limited (€60 million, December 2021), and Ashbury Holdings Ireland Operations Limited (€60 million, December 2022) for cookie-consent violations. The ICO has similarly identified online tracking and adtech as an enforcement priority, publishing its Opinion on Data Protection and Privacy Expectations for Online Advertising Proposals in November 2021 and its updated guidance on cookies and similar technologies in 2023. Other European supervisory authorities — including the German Datenschutzkonferenzen, the Dutch Autoriteit Persoonsgegevens, and the Spanish Agencia Española de Protección de Datos — have issued guidance and enforcement actions addressing adtech data flows.
User Expectations. Users of AGMG's media and e-commerce properties have a reasonable expectation of privacy when browsing news content, streaming video, and shopping online. While users may generally understand that free or ad-supported content involves some degree of advertising, there is a well-documented expectation gap between users' awareness of the extent of tracking and profiling conducted in the programmatic advertising ecosystem and the actual scope of data collection and processing. This expectation gap is particularly acute in respect of covert data collection mechanisms such as server-side tracking pixels and device fingerprinting, which operate without any visible indication to the user. The sensitivity of the processing is heightened by the diversity of data collected — spanning news reading habits, video consumption patterns, and purchase behaviour — which, in aggregate, can reveal highly granular insights into users' interests, preferences, political leanings, and financial circumstances.
3.4 Purposes of Processing
AGMG's programmatic advertising processing activities serve the following specific and defined purposes:
Purpose 1 — Delivery of Personalised Advertising Content. The delivery of targeted advertising content to users based on their inferred interests, observed browsing behaviour, and assigned audience segments. This purpose encompasses the selection of specific advertisements for display to individual users, the personalisation of ad creative elements, and the management of ad frequency capping to limit repetitive exposure.
Purpose 2 — Real-Time Bidding. The generation and transmission of bid requests containing user data to demand-side platforms and ad exchanges participating in RTB auctions. Each bid request communicates information about the available ad impression — including contextual signals (page content, placement location) and user-level signals (audience segments, device characteristics, geolocation) — to enable demand-side participants to evaluate the impression and submit bids.
Purpose 3 — Audience Segmentation and Analytics. The creation, maintenance, and refinement of user profiles and audience segments to improve the precision and relevance of ad targeting and content recommendations. This purpose involves the analysis of browsing behaviour, content consumption patterns, and (where available) purchase history to classify users into predefined audience categories (e.g., "technology enthusiasts," "fashion shoppers," "sports fans").
Purpose 4 — Cross-Device Tracking. The linking of user activity across multiple devices and sessions to build comprehensive, device-agnostic user profiles. Cross-device tracking enables consistent ad targeting, frequency management, and attribution measurement across a user's desktop, mobile, and tablet interactions with AGMG properties.
Purpose 5 — Ad Performance Measurement. The tracking and analysis of ad impressions, user clicks, post-click conversions, and post-view conversions to measure the effectiveness of advertising campaigns. Performance measurement data is used for campaign optimisation, reporting to advertisers, and financial reconciliation of programmatic ad revenue.
Purpose 6 — Fraud Detection and Prevention. The detection and prevention of fraudulent activity in ad delivery, including invalid traffic (bot-generated impressions and clicks), ad stacking, domain spoofing, and click fraud. This purpose involves the analysis of traffic patterns, device fingerprints, and behavioural signals to identify anomalous activity indicative of fraud. AGMG considers that this purpose may, in appropriate circumstances, be supported by a legitimate interest legal basis (see Section 4.2).
Purpose 7 — Financial Reconciliation. The reconciliation of programmatic advertising revenue, including verification of impression counts, click counts, and conversion events against invoiced amounts, and the allocation of revenue-share payments to and from adtech vendor partners. This purpose requires the retention of granular ad delivery logs for a defined period to support audit and dispute resolution.
3.5 Categories of Personal Data Processed
The following categories of personal data are processed in connection with AGMG's programmatic advertising activities:
(a) Online identifiers: Cookie IDs (first-party and third-party), device identifiers (Tidewater Industries Identifier for Advertisers ("IDFA") and Severin Industries Advertising ID ("GAID")), session IDs, and user account identifiers (for registered users).
(b) IP addresses: Full IP addresses (IPv4 and IPv6) collected at the point of user interaction. Post-remediation, IP addresses are truncated (last octet zeroed for IPv4; last 80 bits zeroed for IPv6) before transmission to third-party vendors where full IP precision is not required for the stated processing purpose.
(c) Device fingerprints: A composite identifier derived from the combination of device-level attributes, including browser type and version, operating system type and version, screen resolution, installed browser plugins, language settings, time zone, and hardware characteristics (where exposed by the browser).
(d) Browsing history and page-view data: Records of pages visited by the user across AGMG's European properties, including timestamps, referral sources (limited to AGMG properties), and dwell time.
(e) Search queries: Queries entered by users into search functions on AGMG properties (e.g., product searches on shopaurelia.co.uk, content searches on aureliusnews.co.uk).
(f) Content consumption data: Video streaming history (titles viewed, duration of viewing, completion rates), article reads (headlines, categories, dwell time), and product views (product identifiers, categories, price points) on e-commerce properties.
(g) Geolocation data: Approximate geolocation inferred from IP address (typically accurate to city or regional level). On mobile applications, precise GPS-based geolocation is collected only with explicit, separate user consent.
(h) Advertising interaction data: Records of ad impressions served, user clicks on advertisements, and post-click or post-view conversion events.
(i) Audience segment labels: Inferred interest categories and demographic classifications assigned to users based on their observed behaviour and profile characteristics (e.g., "auto enthusiasts," "frequent travellers," "age 25–34," "high household income").
(j) Purchase/transaction data: Product categories, order values, and transaction identifiers from e-commerce interactions on shopaurelia.co.uk and other AGMG e-commerce properties. Full payment card details are not processed within the programmatic advertising ecosystem.
(k) Registered user account identifiers: For users who are authenticated (logged in), the user's account identifier may be used to link their programmatic advertising profile to their registered account, enabling cross-session and cross-device profile unification.
Special Categories of Data. AGMG does not intentionally collect or process special categories of personal data (as defined in Article 9(1) GDPR) within its programmatic advertising ecosystem. However, it is acknowledged that inferences drawn from content consumption data — for example, reading patterns on news articles relating to health conditions, political views, or religious topics — could, in principle, reveal special category information about individual users. The IAB TCF 2.2 framework includes "Special Feature" controls to address processing that may involve special category data inferences, and these controls have been implemented in the ConsentShield CMP configuration.
3.6 Categories of Data Subjects
The data subjects affected by AGMG's programmatic advertising processing activities include:
(a) Registered users of AGMG's 14 European websites and 3 mobile applications — individuals who have created an account on one or more AGMG properties and who may be authenticated (logged in) during their interactions.
(b) Unregistered visitors to AGMG's 14 European websites and 3 mobile applications — individuals who access AGMG's properties without creating an account or authenticating, and who are identified solely through cookies, device fingerprints, and other online identifiers.
The approximate scale of data subjects affected is 87 million monthly active users across the EU/EEA, distributed across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. The precise breakdown by jurisdiction is commercially sensitive and is maintained in AGMG's internal analytics platform.
Children. AGMG's digital properties are not directed at children (defined as individuals under 16 years of age in most EU/EEA Member States, or under 13 in the United Kingdom). AGMG does not knowingly collect personal data from children for programmatic advertising purposes, and its audience segment taxonomy does not include segments targeting children. However, AGMG acknowledges that no age-gating mechanism currently prevents children from accessing its properties or being exposed to programmatic advertising. This is identified as an area for ongoing monitoring and potential future remediation, particularly in light of evolving regulatory guidance on children's data (including the ICO's Age Appropriate Design Code and the CNIL's recommendations on children's data).
3.7 Recipients and Data Sharing
3.7.1 Primary Adtech Vendor — Pendleton AdTech Solutions Ltd
Pendleton operates as AGMG's primary demand-side platform, receiving bid requests from AGMG's supply-side infrastructure and transmitting them to ad exchanges and other demand-side participants. Pendleton also provides RTB intermediary services, managing the auction process and returning the winning creative for display to the user. Under the remediated DPA (executed 5 April 2024, negotiated between C&H and Aoife Brennan of Dalrymple Kearney & Co.), Pendleton is bound by detailed processing instructions, sub-processor approval and notification obligations, data retention limitations, audit rights (including on-site inspection rights), and deletion obligations upon contract termination or upon AGMG instruction. Pendleton utilises certain US-based sub-processors for cloud hosting and data analytics functions; transfers to these sub-processors are governed by European Commission SCCs (Module 2: Controller to Processor), with a completed Transfer Impact Assessment documenting the assessment of the legal framework of the United States and the supplementary measures implemented.
3.7.2 Secondary Adtech Vendor — VoltGraph Analytics GmbH
VoltGraph provides cross-device tracking and audience segmentation services, ingesting data from server-side tracking pixels deployed on nine of AGMG's fourteen European websites. VoltGraph's technology uses probabilistic matching algorithms to link user activity across devices and sessions, creating unified user profiles that are then segmented into audience categories for ad targeting purposes. The updated DPA (executed 8 April 2024, negotiated between C&H and Dr. Luisa Feldstein of Feldstein Weber LLP) includes specific obligations requiring VoltGraph to: (a) delete all server-side pixel data collected without valid consent prior to the remediation (covering approximately 14 months of non-compliant data collection); (b) implement consent-gated pixel firing, ensuring that VoltGraph's server-side pixels are activated only upon receipt of a valid consent signal from the ConsentShield CMP; (c) grant AGMG annual audit and inspection rights; and (d) comply with enhanced sub-processor approval and flow-down requirements.
3.7.3 Additional Adtech Vendors (Seven Others)
In addition to Pendleton and VoltGraph, AGMG's programmatic advertising ecosystem involves seven additional adtech vendors whose data processing agreements were renegotiated and executed as part of the remediation programme. Updated DPAs with all seven vendors were executed on 10 April 2024. These vendors collectively generate approximately €3.9 million in direct annual revenue for AGMG, with an additional approximately €4.0 million in annual revenue attributable to the audience segmentation uplift enabled by VoltGraph-driven cross-device tracking capabilities that feed into these vendors' targeting processes.
All nine remediated vendor DPAs (Pendleton, VoltGraph, and the seven additional vendors) are now fully compliant with Article 28 GDPR, incorporating:
(a) documented processing instructions specifying the subject matter, duration, nature, and purpose of processing;
(b) confidentiality obligations binding all personnel with access to personal data;
(c) requirements to implement appropriate technical and organisational security measures;
(d) sub-processor approval and notification mechanisms, including flow-down of equivalent data protection obligations;
(e) cooperation obligations in respect of data subject rights requests;
(f) deletion and return of personal data obligations upon termination;
(g) provision of information necessary for AGMG to demonstrate GDPR compliance; and
(h) audit and inspection rights, including the right for AGMG (or its appointed auditor) to conduct on-site inspections of the processor's facilities and systems.
Where applicable, SCCs and completed TIAs have been incorporated to address international data transfers (see Section 3.9 below).
3.7.4 Consent Management Platform — Brightleaf Consent Technologies
Brightleaf ConsentShield serves as the central consent orchestration layer across all AGMG European properties. In the remediated architecture, ConsentShield acts as a consent signal gateway, controlling the activation of cookie placement, pixel firing, and vendor tag execution based on the user's consent choices. No non-essential cookie, tracking pixel, or vendor tag is activated unless and until ConsentShield has recorded a valid, affirmative consent signal for the relevant purpose. ConsentShield is certified under IAB Europe's Transparency and Consent Framework version 2.2 ("TCF 2.2"), ensuring interoperability with participating vendors' consent-signal consumption mechanisms. Brightleaf's EU establishment (Brightleaf Consent Technologies EU B.V.) acts as the contracting entity for AGMG's European deployment, and data processed by the CMP is hosted within the EU/EEA.
3.8 Data Retention Periods
AGMG has established the following data retention periods for personal data processed within the programmatic advertising ecosystem:
These retention periods have been established in accordance with the principles of storage limitation (Article 5(1)(e) GDPR) and data minimisation (Article 5(1)(c) GDPR), and are reflected in the updated Records of Processing Activities delivered on 22 April 2024.
3.9 International Data Transfers
Pre-Remediation State. Prior to the remediation programme, six (6) of AGMG's 23 adtech vendors transferred personal data to recipients outside the European Economic Area:
• Four (4) vendors transferred data to the United States;
• One (1) vendor transferred data to India; and
• One (1) vendor transferred data to Singapore.
Of these six vendors, only two (2) had executed European Commission Standard Contractual Clauses ("SCCs") to provide adequate safeguards for the transfers. The remaining four vendors transferred data to third countries without any Article 44–49 GDPR transfer mechanism in place, representing a significant compliance deficiency and a high risk to data subjects.
Post-Remediation State. Following the remediation programme, all cross-border transfers of personal data to recipients outside the EEA are now covered by appropriate safeguards:
(a) SCCs. European Commission SCCs (adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021) have been executed with all relevant vendors. Module 2 (Controller to Processor) SCCs have been used where AGMG acts as controller and the third-country recipient acts as processor. Where applicable, Module 3 (Processor to Processor) SCCs have been incorporated to address onward transfers from AGMG's EEA-based processors to their own sub-processors located in third countries.
(b) Transfer Impact Assessments. Completed Transfer Impact Assessments ("TIAs") have been prepared for each transfer, assessing the laws and practices of the recipient country with particular reference to government access to data, the rule of law, the availability of effective judicial remedies, and the existence of an independent supervisory authority. The TIAs document the supplementary measures implemented to address any identified risks, including:
• Encryption of personal data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
• Pseudonymisation of user identifiers before cross-border transmission where technically feasible;
• Contractual commitments by the recipient to challenge disproportionate or unlawful government access requests and to notify AGMG promptly of any such requests (to the extent legally permissible); and
• Restrictions on the recipient's ability to make further onward transfers without AGMG's prior written consent and equivalent safeguards.
(c) Pendleton Transfers. Pendleton AdTech Solutions Ltd utilises certain US-based sub-processors for cloud infrastructure and analytics services. Transfers to these sub-processors are governed by Module 2 SCCs incorporated into the Pendleton DPA (executed 5 April 2024), supplemented by a comprehensive TIA assessing the impact of US surveillance law (including Section 702 of the Foreign intelligence Surveillance Act and Executive Order 12333) on the protection of transferred data.
Section 4: Legal Basis for Processing
4.1 Consent — Article 6(1)(a) GDPR and ePrivacy Directive Article 5(3)
The primary legal basis for all programmatic advertising processing activities conducted by or on behalf of AGMG is explicit, informed, freely given, and unambiguous consent obtained pursuant to Article 6(1)(a) GDPR, read in conjunction with Article 5(3) of the ePrivacy Directive (as transposed into the national law of each relevant jurisdiction).
Consent is the appropriate legal basis for these processing activities because:
(a) Article 5(3) of the ePrivacy Directive (and its national implementing measures, including Regulation 6 of PECR in the United Kingdom and Article 82 of the Loi Informatique et Libertés in France) requires prior consent for the storage of, or access to, information on a user's terminal equipment (including cookies, device fingerprints accessed via browser APIs, and tracking pixels that read device-level information);
(b) the CJEU has confirmed, in Planet49 (Case C-673/17, judgment of 1 October 2019), that the consent required for cookies under the ePrivacy Directive must meet the standard of consent under the GDPR — namely, it must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative act;
(c) the nature of the processing — systematic profiling based on browsing behaviour and interest data for the purpose of delivering targeted advertisements — is intrusive and goes significantly beyond what data subjects would reasonably expect, making consent the most appropriate and transparent legal basis;
(d) the Article 29 Working Party (now the European Data Protection Board) and multiple supervisory authorities have consistently taken the position that consent, rather than legitimate interest, is the appropriate legal basis for most adtech tracking and profiling activities; and
(e) reliance on legitimate interest under Article 6(1)(f) GDPR for online behavioural advertising and profiling has been rejected or severely constrained by the CJEU (see Adriatic Enterprises v. Bundeskartellamt, Case C-252/21, judgment of 4 July 2023) and by supervisory authorities including the CNIL, the ICO, and the Belgian Autorité de protection des données.
Consent Architecture (Post-Remediation). In the remediated architecture, consent is obtained via the Brightleaf ConsentShield CMP, configured to present users with a clear and accessible consent interface that meets the requirements of Article 7 GDPR, the IAB TCF 2.2 framework, and the CNIL's cookie guidance. Key features of the remediated consent mechanism include:
(a) Purpose-Specific Toggles. Users are presented with separate, individually actionable toggles for each category of non-essential processing: advertising/targeting cookies, analytics cookies, and functional cookies. Consent is not bundled; users may accept or reject each purpose independently.
(b) IAB TCF 2.2 Granularity. The ConsentShield configuration maps IAB TCF 2.2 purposes and special features to the consent toggles, ensuring that vendor-level and purpose-level consent signals are granularly captured and propagated to participating vendors.
(c) Consent-Gated Processing. No non-essential cookie is placed, no server-side tracking pixel fires, and no vendor tag activates until the ConsentShield CMP has recorded a valid affirmative consent signal for the relevant purpose. This is enforced through ConsentShield's tag management integration, which conditionally loads third-party scripts based on the consent state.
(d) No Pre-Ticked boxes. All consent toggles default to the "off" (rejected) position. Users must affirmatively switch toggles to the "on" position to grant consent for each purpose.
Pre-Remediation Deficiencies. Prior to the remediation, the following consent-related deficiencies were identified:
(a) Thirty-six (36) non-essential cookies were found to fire before any consent interaction occurred, in direct violation of Article 5(3) of the ePrivacy Directive;
(b) Twelve (12) server-side tracking pixels were transmitting personal data (IP addresses, device fingerprints, and browsing history) to third-party adtech vendors without obtaining consent;
(c) Seven (7) vendors — including Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH — were relying on "legitimate interest" as a legal basis under the IAB TCF framework for processing purposes that, under applicable law and regulatory guidance, require consent (specifically, TCF Purposes 2–7 and 9–10 and Special Purposes 1–2). This reliance was not supported by a valid legitimate interest assessment and was inconsistent with the positions of the CNIL, the Belgian DPA (in its decision against IAB Europe, Decision 21/2022 of 2 February 2022, upheld on appeal), and the CJEU's guidance in Adriatic Enterprises; and
(d) Pre-ticked consent boxes were present on six (6) of the fourteen (14) European websites, rendering consent non-unambiguous under Planet49.
All of the foregoing deficiencies have been remediated as part of the programme described in Section 8.
4.2 Legitimate Interest — Article 6(1)(f) GDPR
Legitimate interest under Article 6(1)(f) GDPR is relied upon as the legal basis for the following narrowly defined processing activities only:
(a) Fraud detection and prevention in ad delivery: The analysis of traffic patterns, device fingerprints, and behavioural signals to identify and mitigate invalid traffic, bot-generated impressions, click fraud, and other forms of ad fraud. AGMG has a legitimate interest in protecting its advertising revenue from fraud, and this interest is not overridden by the rights and freedoms of data subjects given the limited nature of the processing (automated fraud-scoring using pseudonymised data, with no impact on the user's access to content or services). This processing may also qualify as "strictly necessary" under the ePrivacy Directive to the extent that fraud detection is essential to the provision of the advertising service.
(b) Basic aggregate analytics: The generation of aggregate, non-identifying metrics (such as total page views, unique visitor counts at a geographic region level, and average session duration) used for internal business intelligence and capacity planning. This processing does not involve individual-level profiling and does not produce outputs that are linked or linkable to individual data subjects.
Legitimate interest is not used as the legal basis for any targeting, profiling, cross-device tracking, audience segmentation, or personalised advertising activity. A Legitimate Interest Assessment ("LIA") documenting the analysis under the three-part test (legitimacy of interest, necessity of processing, and balancing against data subject rights) has been prepared separately and is maintained in AGMG's data protection records.
4.3 ePrivacy and PECR Compliance
The consent requirements applicable to AGMG's programmatic advertising activities arise not only from the GDPR but also from the ePrivacy Directive and its national implementing legislation:
ePrivacy Directive Article 5(3). Article 5(3) of Directive 2002/58/EC (as amended by Directive 2009/136/EC) requires Member States to ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user has given his or her consent, having been provided with clear and comprehensive information about the purposes of the processing. This provision applies to cookies, tracking pixels (to the extent they access device-level information), and device fingerprinting techniques. The only exception is for storage or access that is "strictly necessary" for the provision of an information society service explicitly requested by the user.