COMPLIANCE RESPONSE TO FORMAL NOTICE MED-2023-097
Commission nationale de l'informatique et des libertés
CNIL Reference: MED-2023-097 Complaint Reference: PLT-2023-FR-04821
Date of Submission: 12 April 2024
Extended Compliance Deadline: 14 April 2024 (Extension granted 18 March 2024; original deadline 14 March 2024)
Submitted By:
Calderwood & Harkness LLP One Finsbury Square London EC2A 1AE United Kingdom
Acting as legal counsel on behalf of Aurelius Global Media Group PLC
Responsible Partner: Rachel Bernstein, Partner, Privacy & Data Security Practice C&H Matter No.: 1017-00008
On Behalf Of:
Aurelius Global Media Group PLC A public limited company incorporated in England and Wales (Companies House No. 08741562) 140 Threadneedle Row London EC2R 8AH United Kingdom
AGMG Signatories/Contacts:
• Sanjay Redworth, Group General Counsel & Company Secretary
• Margaux Fontaine-Li, Group Data Protection Officer
CONFIDENTIAL — This document and its exhibits contain confidential and commercially sensitive information belonging to Aurelius Global Media Group PLC. It is submitted to the Commission nationale de l'informatique et des libertés for the sole purpose of responding to Formal Notice MED-2023-097 and should not be disclosed to third parties without the prior written consent of Aurelius Global Media Group PLC or Calderwood & Harkness LLP.
Right-click to update Table of Contents
Section 1: Introduction and Purpose
This document constitutes the formal compliance response of Aurelius Global Media Group PLC ("AGMG" or the "Company") to the formal notice (mise en demeure) issued by the Commission nationale de l'informatique et des libertés (the "CNIL") on 14 December 2023, bearing reference MED-2023-097 (the "Formal Notice"). AGMG submits this response through its legal counsel, Calderwood & Harkness LLP ("C&H"), with the objective of demonstrating full and comprehensive remediation of all deficiencies identified by the CNIL in the Formal Notice.
The Formal Notice arose from complaint PLT-2023-FR-04821, filed on 8 November 2023 by Digitale Rechte Europa eingetragener Verein ("DRE"), a digital rights advocacy association registered in Berlin, Germany, under registration number VR 38217 B. DRE was represented in connection with the complaint by Dr. Tobias Kreisel of Kreisel & Hausmann Rechtsanwälte PartG mbB, a law firm specialising in data protection litigation and digital rights enforcement. The complaint concerned AGMG's French-language streaming platform, accessible at the domain aurelius-stream.fr (the "Subject Website"), and specifically alleged non-compliant cookie-consent mechanisms and advertising-technology data flows operating on that platform.
Upon receipt of the Formal Notice, AGMG's Board of Directors, on the recommendation of the Group General Counsel, Sanjay Redworth, authorised the engagement of external specialist counsel to conduct a comprehensive programme of remediation. Accordingly, AGMG retained Calderwood & Harkness LLP on 12 January 2024, as formalised in the engagement letter of that date, to lead a comprehensive review of, and remediation of, cookie-consent mechanisms and advertising-technology data flows across all of AGMG's European digital properties, with a view to achieving full compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), the ePrivacy Directive (Directive 2002/58/EC), and applicable national transposition legislation, including the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (the "Loi Informatique et Libertés"), as amended.
In parallel, AGMG, acting on C&H's recommendation, additionally retained Thistlewood Consulting Ltd ("Thistlewood"), a specialist cybersecurity and data governance consulting firm with offices at 9 Worship Street, London EC2A 2BF, to perform a comprehensive technical cookie and tracking technology audit across all of AGMG's European digital properties. Thistlewood was engaged under C&H's direction and supervision, and its audit work was conducted under the protection of legal professional privilege, to the fullest extent available.
The original compliance deadline set by the Formal Notice was 14 March 2024. Given the scope of the remediation programme — which AGMG voluntarily expanded beyond the Subject Website to encompass all of its European digital properties — AGMG submitted a request for an extension of the compliance deadline on 11 March 2024. The CNIL granted this extension on 18 March 2024, setting a revised compliance deadline of 14 April 2024. AGMG is grateful to the CNIL for this accommodation and submits the present response within the extended deadline.
This response demonstrates that AGMG has completed full remediation of all deficiencies identified in the Formal Notice, not only on aurelius-stream.fr but across all fourteen (14) of AGMG's European-facing websites and all three (3) mobile applications serving audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. AGMG's European digital properties collectively serve approximately 87 million monthly active users across the EU/EEA, making this remediation programme one of significant scale and complexity. The Company has approached this process with the seriousness and commitment to data protection compliance that the CNIL's intervention warranted, and AGMG respectfully submits that the measures described herein not only address the specific deficiencies identified but also establish a robust and sustainable compliance governance framework for the future.
The remainder of this response is structured as follows: Section 2 summarises the deficiencies identified in the Formal Notice; Section 3 describes the scope of AGMG's remediation programme; Section 4 details the technical cookie audit findings and remediation actions; Section 5 addresses the elimination of dark patterns and the redesign of consent mechanisms; Section 6 covers adtech vendor data processing agreement remediation; Section 7 addresses cross-border data transfer remediation; Sections 8 and 9 discuss updated Data Protection Impact Assessments and Records of Processing Activities, respectively; Section 10 provides a comprehensive remediation timeline; Section 11 outlines AGMG's ongoing compliance governance framework; and Section 12 sets forth AGMG's conclusion and request for closure of the proceedings. Supporting technical and documentary evidence is annexed as Exhibits A through F.
Section 2: Summary of Deficiencies Identified in Formal Notice MED-2023-097
The Formal Notice identified four principal categories of deficiency in AGMG's data processing practices on aurelius-stream.fr. For the purposes of this response, AGMG addresses each category in turn, providing a precise summary of the CNIL's findings before proceeding, in subsequent sections, to detail the remediation actions taken.
2.1 Pre-Consent Cookie Deployment
The Formal Notice identified that aurelius-stream.fr deployed forty-seven (47) third-party tracking cookies upon page load, before any user consent interaction had occurred. These cookies were set automatically when a user navigated to the Subject Website, regardless of whether the user had been presented with a consent banner or had taken any affirmative action to indicate consent to the deployment of such cookies.
The CNIL found this practice to be in violation of Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive), as transposed into French law through Article 82 of the Loi Informatique et Libertés, which requires that the storage of, or access to, information stored in a user's terminal equipment is permitted only where the user has given prior consent, save in the limited exception for cookies that are strictly necessary for the provision of a service explicitly requested by the user. The CNIL further found that, to the extent that personal data was processed through these cookies, the absence of prior consent rendered such processing unlawful under Article 6(1)(a) of the GDPR, which requires that consent, where relied upon as a lawful basis, must be obtained prior to the commencement of processing.
The CNIL's findings on this point were consistent with its prior enforcement practice and its published guidance, including the CNIL's updated guidelines on cookies and other trackers published on 1 October 2020 (délibération n° 2020-091) and the associated recommendation of 17 September 2020 (délibération n° 2020-092).
2.2 Dark Pattern Consent Mechanisms
The Formal Notice identified several features of the cookie banner deployed on aurelius-stream.fr that the CNIL characterised as "dark patterns" — design choices intended to steer users toward acceptance of non-essential cookies rather than enabling genuine, free, and informed choice. Specifically, the CNIL identified the following issues:
(a) Pre-ticked consent boxes. The consent toggles presented within the cookie banner's preference management layer were set to the "on" position by default, such that a user who did not actively deselect individual purposes would be deemed to have consented to all processing purposes. This practice is incompatible with the requirement, set forth in GDPR Article 7 and Recital 32, that consent be given by a clear affirmative act, and is contrary to the Court of Justice of the European Union's ruling in Planet49 GmbH (Case C-673/17, 1 October 2019), which confirmed that pre-ticked checkboxes do not constitute valid consent.
(b) Asymmetric button design. The cookie banner employed a prominent, brightly coloured "Accept All" button, rendered in large font against a contrasting background, while the alternative option — labelled "Manage Preferences" — was displayed as a smaller, less visually prominent hyperlink in a subdued colour. This asymmetry was designed to draw users' attention to the acceptance option and to discourage interaction with the preference management function.
(c) Absence of a "Reject All" option. The first layer of the cookie banner did not present a "Reject All" option at the same level of prominence as the "Accept All" button. Users who wished to refuse non-essential cookies were required to navigate to a second-layer preference panel and individually deselect each consent toggle — a process that, given the pre-ticked default state, required affirmative action on each toggle, rather than a single refusal action.
The CNIL found that the cumulative effect of these design choices was to render consent neither freely given, specific, informed, nor unambiguous within the meaning of GDPR Article 4(11), Article 7, and Recital 32. The CNIL noted that its enforcement position is consistent with the European Data Protection Board's Guidelines 05/2020 on consent under Regulation 2016/679, particularly paragraphs 41–44 and 69–77, and with the EDPB's report on the work undertaken by the Cookie Banner Taskforce (adopted on 17 January 2023).
2.3 Absence of Effective Consent Withdrawal Mechanism
The Formal Notice identified that users of aurelius-stream.fr could not withdraw consent to non-essential cookies without navigating away from the content page on which they were browsing. The process of withdrawal required the user to locate a link in the website's footer, navigate to a dedicated privacy settings page, locate the cookie preferences section within that page, and then modify their consent settings. The CNIL's investigation determined that this process required a minimum of four (4) clicks on eight (8) of AGMG's fourteen (14) European websites, and in certain cases more.
This practice was found to be contrary to Article 7(3) of the GDPR, which provides that the data subject shall have the right to withdraw his or her consent at any time and that it shall be as easy to withdraw consent as to give it. The requirement for users to navigate through multiple pages and interactions to withdraw consent, when consent was given through a single click on the "Accept All" button, created a manifest asymmetry that the CNIL found to be incompatible with this provision.
2.4 Inadequate Data Processing Safeguards
Finally, the Formal Notice raised concerns regarding the adequacy of AGMG's data processing agreements with the third-party advertising technology ("adtech") vendors that received user data via the cookies and tracking technologies deployed on aurelius-stream.fr. The CNIL observed that the contractual arrangements governing these data flows did not appear to satisfy the requirements of Article 28 of the GDPR for processing carried out by processors on behalf of AGMG as controller, and that certain cross-border data transfers to vendors located outside the European Economic Area did not appear to be subject to adequate safeguards within the meaning of Chapter V of the GDPR. The CNIL directed AGMG to review and, where necessary, remediate its contractual arrangements with all adtech vendors receiving personal data from its European digital properties.
Section 3: Scope of AGMG's Remediation Programme
Upon receipt of the Formal Notice, and following the engagement of Calderwood & Harkness LLP as external counsel, AGMG made the decision — voluntarily and on C&H's recommendation — to extend the scope of its remediation programme beyond aurelius-stream.fr to encompass all fourteen (14) of its European-facing websites and all three (3) mobile applications. This decision reflected AGMG's commitment to comprehensive compliance and its recognition that the deficiencies identified by the CNIL on the Subject Website were likely to be replicated, in whole or in part, across the Company's broader European digital portfolio.
AGMG's European digital properties are deployed across six (6) jurisdictions — the United Kingdom, France, Germany, the Netherlands, Spain, and Italy — and collectively serve approximately 87 million monthly active users. The properties encompass a range of streaming, news, entertainment, and lifestyle platforms operating under various AGMG brands. The full list of properties within the scope of the remediation programme is maintained as a confidential annex to C&H's engagement letter and is available for CNIL review upon request.
The remediation programme was structured around seven (7) distinct workstreams, each with defined objectives, deliverables, and timelines. These workstreams were as follows:
1. Consent Mechanism Redesign — Complete redesign and redeployment of cookie consent mechanisms across all 14 European websites and 3 mobile applications, including elimination of dark patterns, implementation of symmetric "Accept All" / "Reject All" functionality, removal of pre-ticked consent boxes, and integration with a certified consent management platform.
2. Server-Side Tracking Pixel Remediation — Identification, audit, and remediation of all server-side tracking pixels deployed across AGMG's European digital properties, ensuring that no pixel transmits personal data to third-party vendors without prior affirmative consent.
3. Data Processing Agreement Renegotiation — Review, renegotiation, and execution of GDPR Article 28-compliant data processing agreements with all adtech vendors receiving personal data from AGMG's European digital properties, including implementation of audit rights, sub-processor controls, and data deletion obligations.
4. Vendor Audit Rights Implementation — Establishment of contractual and operational frameworks enabling AGMG to exercise its rights of audit and inspection over processors' data processing activities, including annual audit scheduling and incident-triggered audit procedures.
5. Data Protection Impact Assessment Updates — Update of AGMG's Data Protection Impact Assessments to reflect remediated data flows, updated consent mechanisms, revised vendor DPAs, and new cross-border transfer safeguards, with a focus on the high-risk processing activities of programmatic advertising and audience analytics.
6. Record of Processing Activities Update — Comprehensive update of AGMG's Article 30 GDPR Records of Processing Activities to reflect all remediated processing activities across the 14 European websites and 3 mobile applications.
7. Regulatory Response Preparation — Preparation of the present compliance response to the CNIL, together with all supporting exhibits and technical documentation.
The technical audit underpinning the remediation programme was conducted by Thistlewood Consulting Ltd, under the direction of Marcus Drayford, Principal Consultant. The audit commenced on 22 January 2024 and was completed on 16 February 2024, with the final audit report delivered to Calderwood & Harkness on 20 February 2024. The audit report identified all cookies and tracking technologies deployed across AGMG's European digital properties, classified each by type, purpose, and timing of deployment (pre-consent versus post-consent), and documented all data flows to third-party vendors. A summary of the audit findings is annexed at Exhibit A.
Following delivery of the audit report, C&H conducted a comprehensive data flow mapping exercise, completed on 28 February 2024, which documented the end-to-end flow of personal data from user interaction through consent collection, cookie deployment, server-side pixel firing, data transmission to third-party vendors, and onward processing by those vendors. This data flow mapping formed the basis for the GDPR gap analysis memorandum delivered by C&H to AGMG on 4 March 2024, which identified all areas of non-compliance and recommended specific remediation actions for each workstream.
Section 4: Technical Cookie Audit Findings and Remediation
4.1 Audit Methodology
A full technical scan of all fourteen (14) European websites and three (3) mobile applications was conducted by Thistlewood Consulting Ltd between 22 January 2024 and 16 February 2024. The audit was performed under the direction and supervision of Marcus Drayford, Principal Consultant, Thistlewood Consulting, and was coordinated with Calderwood & Harkness's privacy and data security practice team throughout the engagement.
The audit methodology comprised the following elements:
(a) Automated cookie scanning. Thistlewood deployed its proprietary automated scanning tools against each of the 14 European websites, capturing all cookies set during page load sequences, both with and without user consent interaction. Scans were conducted from multiple geographic locations (Paris, Berlin, Amsterdam, Madrid, Rome, and London) to capture any jurisdiction-specific variations in cookie deployment.
(b) Manual verification. Following automated scanning, Thistlewood's analysts manually verified a sample of results across each website, using browser developer tools and network traffic analysis to confirm cookie deployment timing and data transmission behaviour.
(c) Cookie classification. Each identified cookie was classified by type (first-party or third-party), purpose (strictly necessary, functional, analytics, or advertising/tracking), timing of deployment (pre-consent or post-consent), and the identity and jurisdiction of the vendor receiving the cookie data.
(d) Server-side tracking pixel analysis. The audit extended to server-side tracking pixels, which operate outside the browser environment and are therefore not captured by conventional cookie-scanning tools. Thistlewood analysed server-side requests from AGMG's web servers to identify all tracking pixels, the personal data transmitted (including IP addresses, device fingerprints, and browsing history), and the recipient vendors.
(e) Mobile application analysis. For the three mobile applications, Thistlewood conducted a review of SDK integrations, tracking library configurations, and consent management implementations, including the interaction between GDPR consent flows and Tidewater Industries's App Tracking Transparency framework on the two iOS applications.
The audit findings were documented in the Thistlewood Consulting Cookie Audit Report, dated 20 February 2024, a summary extract of which is annexed at Exhibit A. The full audit report, which contains detailed technical findings and is subject to legal professional privilege, is available for CNIL review upon request through Calderwood & Harkness LLP.
4.2 Findings
The audit produced the following headline findings across all of AGMG's European digital properties:
Total unique cookies identified across 14 websites: 312. This figure represents the total number of distinct cookies deployed across all fourteen European websites, including both first-party and third-party cookies, across all functional categories.
Cookies firing before consent: 74 (representing 23.7% of the total). These cookies were deployed upon page load prior to any user consent interaction — that is, before the user had an opportunity to view or interact with a cookie consent banner.
Strictly necessary cookies (legitimate pre-consent firing): 38 of the 74 pre-consent cookies were determined, following review by both Thistlewood and Calderwood & Harkness, to qualify as "strictly necessary" cookies within the meaning of the Article 5(3) ePrivacy Directive exemption, as they were essential for the provision of a service explicitly requested by the user (e.g., session management cookies, load-balancing cookies, security tokens, and user authentication cookies). These 38 cookies are legitimately deployed prior to consent and do not require remediation.
Non-compliant pre-consent cookies: 36 cookies (74 minus 38) were identified as firing before consent without a valid legal basis. These cookies were associated with advertising, analytics, and cross-device tracking purposes and should not have been deployed prior to the collection of affirmative user consent. This finding was consistent with, and in fact lower than, the CNIL's finding of 47 non-compliant pre-consent cookies on aurelius-stream.fr alone. The discrepancy is explained by the fact that certain cookies identified by the CNIL in its investigation may have been set by vendors that AGMG had subsequently removed from aurelius-stream.fr prior to the commencement of the Thistlewood audit, or may have reflected transient cookie behaviour that was not captured during the Thistlewood scanning window.
Server-side tracking pixels identified: 19 unique server-side tracking pixels were identified across all properties. These pixels operated through server-to-server communications and were not dependent on browser-based cookie mechanisms.
Non-compliant server-side pixels: 12 of the 19 server-side tracking pixels were found to be transmitting personal data — including IP addresses, device fingerprints, and user browsing history — to third-party adtech vendors without any consent mechanism in place. These pixels operated entirely independently of the browser-based consent management platform and were therefore not subject to any consent controls at the time of the audit.
Third-party vendors receiving data without consent: 9 vendors were identified as receiving personal data from AGMG's European digital properties without valid user consent. These included, among others:
• Pendleton AdTech Solutions Ltd, a programmatic advertising technology provider incorporated in Ireland, with registered office at 22 Grand Canal Dock, Block 4, Dublin D02 HW94, Ireland (Companies Registration Office No. 614823). Pendleton serves as AGMG's primary programmatic advertising partner.
• VoltGraph Analytics GmbH, a cross-device tracking and audience segmentation analytics provider incorporated in Germany, with registered office at Große Elbstraße 44, 22767 Hamburg, Germany (Handelsregister Hamburg, HRB 159742). VoltGraph deploys server-side tracking pixels on nine of AGMG's fourteen European websites.
The remaining seven vendors are identified in the summary table annexed at Exhibit E. Detailed findings relating to each vendor's data receipt practices are set forth in the full Thistlewood audit report.
4.3 Remediation Actions — Cookies
All thirty-six (36) non-compliant pre-consent cookies have been reconfigured to fire only after affirmative user consent is recorded through the Brightleaf ConsentShield consent management platform (the "CMP"). Brightleaf ConsentShield is provided by Brightleaf Consent Technologies EU B.V., a company incorporated in the Netherlands with registered office at Herengracht 520, 1017 CC Amsterdam, Netherlands (KvK No. 81294503). The Brightleaf ConsentShield CMP is certified under the IAB Europe Transparency and Consent Framework version 2.2 ("IAB TCF 2.2"), ensuring that consent signals are generated, stored, and transmitted to vendor tags in accordance with industry-standard technical protocols.
The reconfiguration involved the integration of each non-compliant cookie's associated tag or script with the Brightleaf ConsentShield tag management system, such that the tag or script is blocked from execution until the CMP has recorded a valid consent signal for the relevant processing purpose. The integration was implemented by AGMG's in-house engineering team in coordination with Thistlewood Consulting and Brightleaf's technical integration team, and was subject to post-implementation verification scanning (see Section 4.4 below and Exhibit C).
Separately, the thirty-eight (38) cookies previously identified as "strictly necessary" were reviewed by Calderwood & Harkness in consultation with Thistlewood Consulting and confirmed to qualify under the strict necessity exemption of Article 5(3) of the ePrivacy Directive. This review applied the criteria set forth in the CNIL's guidance, the EDPB's Opinion 04/2012 on Cookie Consent Exemption, and the relevant CJEU jurisprudence. The strictly necessary classification of each cookie has been documented and is maintained in AGMG's internal cookie inventory.
Remediated cookie banners were deployed across all fourteen (14) European websites on 22 March 2024. From that date forward, no non-essential cookies or tracking technologies fire on any of AGMG's European websites before affirmative consent is obtained and recorded through the Brightleaf ConsentShield CMP.
4.4 Remediation Actions — Server-Side Tracking Pixels
All twelve (12) non-compliant server-side tracking pixels have been reconfigured to operate on a consent-gated basis through integration with the Brightleaf ConsentShield tag manager. This integration required the development of a server-side consent verification layer, whereby AGMG's web servers query the CMP's consent record for the relevant user before permitting the execution of any server-side pixel that transmits personal data to a third-party vendor. The consent verification is performed in real time and operates on a per-user, per-purpose basis, ensuring that a pixel will only transmit data to a third-party vendor after the user has provided specific, informed, and affirmative consent for the relevant processing purpose.
This server-side remediation presented greater technical complexity than the browser-based cookie remediation, as server-side pixels operate outside the browser's document object model and are not natively subject to CMP-controlled tag blocking. The development and testing of the server-side consent verification layer was conducted by AGMG's engineering team, under the technical direction of Thistlewood Consulting, over a period of approximately five weeks. Server-side pixel remediation was completed on 2 April 2024.
Following the completion of the server-side pixel remediation, Thistlewood Consulting conducted verification scans across all fourteen websites, confirming zero instances of non-compliant server-side pixel firing. The results of these verification scans are annexed at Exhibit C.
Section 5: Dark Pattern Elimination and Consent Mechanism Redesign
5.1 Scope of Dark Pattern Issues Identified
The CNIL's Formal Notice specifically addressed dark pattern practices on aurelius-stream.fr. AGMG's own internal review, conducted as part of the wider remediation programme, identified that dark pattern issues extended across multiple properties in AGMG's European digital portfolio. The findings were as follows:
(a) Pre-ticked consent boxes were found on six (6) of fourteen (14) European websites, including aurelius-stream.fr. On these six websites, the second-layer preference management panel presented consent toggles in a pre-selected "on" state, requiring users to affirmatively deselect each toggle to refuse consent for individual processing purposes.
(b) Asymmetric "Accept All" vs. "Manage Preferences" button design was found on all fourteen (14) European websites. In each case, the "Accept All" button was visually prominent — larger, with a brighter or more saturated colour — while the alternative option was rendered as a smaller text link or as a button with a subdued colour palette, reducing its visual salience.
(c) No "Reject All" option was provided on eleven (11) of fourteen (14) European websites. On three websites, a "Reject All" button was present but was rendered with significantly less visual prominence than the "Accept All" button, in a manner that did not satisfy the CNIL's requirement for equal prominence.
(d) Consent withdrawal requiring four or more clicks was found on eight (8) of fourteen (14) European websites. On these websites, withdrawing consent required users to navigate to a footer link, access a dedicated privacy settings page, locate the cookie preferences section, and modify their consent settings — a process involving a minimum of four distinct user interactions, in contrast to the single click required to accept all cookies.
(e) Mobile application consent deficiencies were identified across all three (3) mobile applications. None of the three applications provided granular consent controls aligned with GDPR requirements. In the case of the two iOS applications, the GDPR consent flow was conflated with Tidewater Industries's App Tracking Transparency ("ATT") prompt. The ATT prompt, while serving a related purpose under Tidewater Industries's platform policies, does not satisfy the specific requirements of GDPR consent, as it does not provide purpose-level granularity, does not identify specific data recipients, and is controlled by Tidewater Industries's operating system framework rather than by the data controller. The single Android application similarly lacked granular GDPR-compliant consent controls.
5.2 Remediation — Website Cookie Banners
All fourteen (14) European website cookie banners have been completely redesigned and redeployed. The redeployment was completed on 22 March 2024, and all banners have been operational in their remediated form since that date. The redesigned cookie banners incorporate the following features, each of which is designed to ensure compliance with the GDPR's consent requirements, the CNIL's guidance on cookies and trackers, the EDPB's Guidelines 05/2020 on consent, and the EDPB Cookie Banner Taskforce report:
(a) "Reject All" button of equal visual prominence to "Accept All" on the first layer of the consent banner. Users are presented, on the initial banner that appears upon first visiting the website, with two options of equal visual weight: "Accept All" and "Reject All." Both options are available in a single interaction, without requiring the user to navigate to a second layer or preference panel.
(b) Symmetric button design. The "Accept All" and "Reject All" buttons are rendered in identical size (font size, button dimensions, and padding), identical colour weight (both using the same colour palette, with sufficient contrast against the banner background to ensure legibility and equal visual salience), and identical position within the banner layout (placed side by side on the same horizontal plane, with neither button given spatial priority over the other).
(c) Removal of all pre-ticked boxes. All consent toggles within the second-layer granular preference management panel default to the "off" position. Users must affirmatively activate each toggle to provide consent for a specific processing purpose. No consent is inferred from inaction or from the default state of any toggle.
(d) Granular purpose-level consent toggles on the second layer. The second-layer preference panel presents consent toggles organised by processing purpose, aligned with the purposes defined under the IAB TCF 2.2 framework. Each purpose is accompanied by a clear and concise description of the processing activity, the categories of data processed, and the categories of vendors that will receive data for that purpose. Users may accept or refuse consent on a purpose-by-purpose basis.
(e) Consent withdrawal accessible in no more than two clicks from any page. A persistent cookie-settings icon (a universally recognisable gear or shield icon) is displayed on every page of the website, in a fixed position that does not scroll with the page content. Clicking this icon opens the consent preference panel, allowing the user to modify or withdraw consent in a single additional interaction. The total number of user interactions required to withdraw consent is therefore no more than two (2): one click to open the preference panel, and one click to modify or withdraw consent.
(f) Multilingual copy. The consent banner, granular preference panel, and all associated informational text are presented in the language corresponding to the user's jurisdiction, with six language versions: English, French, German, Dutch, Spanish, and Italian. Each language version has been reviewed for accuracy and clarity by native-language speakers within AGMG's localisation team and verified by Calderwood & Harkness's multilingual privacy practice.
(g) Integration with Brightleaf ConsentShield CMP. All consent signals are collected, recorded, timestamped, and stored by the Brightleaf ConsentShield CMP. The consent string generated by the CMP is transmitted to all vendor tags via the IAB TCF 2.2 protocol, ensuring that each vendor receives only the data for which valid consent has been obtained. The CMP maintains a comprehensive, auditable log of all consent interactions, including the time of consent, the purposes consented to, the version of the consent notice presented to the user, and the user's subsequent consent modifications or withdrawals.
Screenshots of the remediated first-layer consent banners, second-layer granular preference panels, and persistent cookie-settings icons for all fourteen European websites, in all six languages, are annexed at Exhibit B.
5.3 Remediation — Mobile Application Consent Flows
All three (3) mobile applications have been updated with granular consent controls that are fully aligned with GDPR requirements. The mobile application updates were completed on 29 March 2024, with updated versions published to the Tidewater Industries App Store and Severin Industries Play Store on or before that date.
The remediated mobile application consent flows incorporate the following features:
(a) Granular purpose-level consent. Upon first launch or upon a significant update to the consent notice, users are presented with a consent flow that requests consent on a purpose-by-purpose basis, with clear descriptions of each processing purpose and the categories of data involved. All consent toggles default to the "off" position.
(b) GDPR consent independent of ATT. For the two iOS applications, the GDPR-compliant consent flow is now presented to the user prior to the Tidewater Industries ATT prompt. This ensures that GDPR consent is obtained on the basis of a controller-managed consent mechanism that satisfies the GDPR's requirements for granularity, specificity, and informed choice, independently of the ATT framework. The ATT prompt continues to be presented after the GDPR consent flow, in compliance with Tidewater Industries's platform requirements, but AGMG does not rely on the ATT response as the legal basis for data processing under the GDPR.
(c) Consent withdrawal within two taps. Users can access consent settings from the application's settings menu and modify or withdraw consent in no more than two taps from any screen within the application.
Screenshots of the remediated mobile application consent flows for all three applications are included in Exhibit B.
Section 6: Adtech Vendor Data Processing Agreement Remediation
6.1 Vendor Landscape
AGMG's European digital properties utilise a total of twenty-three (23) adtech vendors for the purposes of programmatic advertising, audience analytics, ad verification, attribution, and related advertising technology functions. These vendors process personal data obtained from users of AGMG's European websites and mobile applications, primarily through cookies, server-side tracking pixels, and mobile SDK integrations.
Prior to the commencement of the remediation programme, Calderwood & Harkness conducted a comprehensive review of AGMG's existing contractual arrangements with each of these twenty-three vendors. The review assessed the presence and adequacy of data processing agreements pursuant to GDPR Article 28, the inclusion of appropriate audit and inspection rights, sub-processor controls, data deletion provisions, and, where applicable, the existence of adequate safeguards for cross-border data transfers under Chapter V of the GDPR.
The findings of this review were as follows:
• Only fourteen (14) of twenty-three (23) vendors (60.9%) had data processing agreements that were assessed as materially compliant with Article 28 of the GDPR.
• Nine (9) of twenty-three (23) vendors (39.1%) either had no data processing agreement in place with AGMG or had data processing agreements that were materially deficient in one or more respects, including the absence of documented processing instructions, inadequate security obligations, the absence of audit rights, the absence of sub-processor notification and approval mechanisms, or the absence of data deletion and return provisions.
• Seven (7) vendors, including Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH, had been relying on "legitimate interest" under the IAB TCF framework as the lawful basis for certain processing purposes (including the creation of personalised advertising profiles and the measurement of advertising effectiveness). Under the CNIL's enforcement position, as set forth in its December 2021 deliberation on the use of Ostrander Services Inc. and its broader guidance on the IAB TCF, and under the EDPB's guidance, these processing purposes require consent as the lawful basis, and reliance on legitimate interest for these purposes within the TCF framework is not permissible.
The following subsections describe the remediation of the data processing agreements with each of the nine non-compliant vendors.
6.2 DPA Renegotiation — Pendleton AdTech Solutions Ltd
A revised Data Processing Agreement was negotiated, finalised, and executed on 5 April 2024 between AGMG, acting in its capacity as data controller, and Pendleton AdTech Solutions Ltd ("Pendleton"), acting in its capacity as data processor.
Pendleton serves as AGMG's primary programmatic advertising partner and operates a real-time bidding platform through which AGMG's advertising inventory is made available to demand-side platforms and advertisers. In the course of this relationship, Pendleton processes approximately 4.2 billion ad bid requests per month involving personal data originating from users of AGMG's European digital properties. The personal data processed includes, but is not limited to, user IP addresses, device identifiers, cookie identifiers, browsing history, content preferences, and inferred audience segment data.
The revised DPA incorporates all requirements of Article 28 of the GDPR, including:
(a) Documented processing instructions. Pendleton is required to process personal data only on the basis of AGMG's documented instructions, as set forth in the DPA's processing schedule, and may not process personal data for any purpose other than those specified in the documented instructions without AGMG's prior written authorisation.
(b) Confidentiality obligations. Pendleton is required to ensure that all persons authorised to process personal data under the DPA have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) Security measures. Pendleton is required to implement and maintain appropriate technical and organisational security measures, as specified in the DPA's security annex, to ensure a level of security appropriate to the risk of processing, including encryption of personal data in transit and at rest, pseudonymisation measures, access controls, and incident response procedures.
(d) Sub-processor approval and flow-down obligations. Pendleton may not engage a sub-processor without AGMG's prior specific or general written authorisation. Where general authorisation is granted, Pendleton must inform AGMG of any intended changes concerning the addition or replacement of sub-processors, giving AGMG the opportunity to object. All sub-processor engagements must be governed by written agreements that impose data protection obligations no less stringent than those set forth in the DPA between AGMG and Pendleton.
(e) Data subject rights assistance. Pendleton is required to assist AGMG, by appropriate technical and organisational measures, in fulfilling AGMG's obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR.
(f) Data deletion and return upon termination. Upon termination of the DPA, Pendleton is required to delete or return all personal data to AGMG, at AGMG's choice, and to delete existing copies unless retention is required by applicable law.
(g) Cooperation with DPIAs. Pendleton is required to provide reasonable assistance to AGMG in ensuring compliance with the obligations set forth in Articles 32 to 36 of the GDPR, including Data Protection Impact Assessments and prior consultation with supervisory authorities.
In addition, the revised DPA includes comprehensive audit and inspection rights pursuant to Article 28(3)(h) of the GDPR, entitling AGMG to conduct or commission audits of Pendleton's processing activities, including on-site inspections, with reasonable notice and subject to appropriate confidentiality safeguards.
For transfers of personal data to Pendleton's sub-processors located in the United States, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller to Processor) have been annexed to the DPA. A completed Transfer Impact Assessment has been prepared, documenting the assessment of the legal framework of the United States as it applies to the relevant sub-processors, the supplementary measures implemented (including encryption in transit and at rest, pseudonymisation prior to transfer, and contractual prohibitions on disclosure to government authorities except as required by applicable law), and the residual risk to data subjects.
The revised DPA was signed by Sanjay Redworth, Group General Counsel & Company Secretary, on behalf of AGMG, and by Conor Rafferty, Chief Executive Officer, on behalf of Pendleton AdTech Solutions Ltd. The DPA was negotiated opposite Aoife Brennan of Dalrymple Kearney & Co. (15 Fitzwilliam Place, Dublin D02 YX28, Ireland), external legal counsel to Pendleton.
Critically, as part of the DPA renegotiation, Pendleton's lawful basis for processing personal data from AGMG's European digital properties has been converted from legitimate interest to consent-dependent processing. Pendleton's systems have been configured to process personal data only where a valid consent signal is received from the Brightleaf ConsentShield CMP, transmitted via the IAB TCF 2.2 consent string. In the absence of a valid consent signal for a given user and purpose, Pendleton's systems are configured to suppress processing for that user and purpose.
6.3 DPA Renegotiation — VoltGraph Analytics GmbH
A revised Data Processing Agreement was negotiated, finalised, and executed on 8 April 2024 between AGMG, acting in its capacity as data controller, and VoltGraph Analytics GmbH ("VoltGraph"), acting in its capacity as data processor.
VoltGraph provides cross-device tracking and audience segmentation analytics services to AGMG. VoltGraph's technology deploys server-side tracking pixels on nine (9) of AGMG's fourteen (14) European websites, collecting personal data including IP addresses, device fingerprints, browsing behaviour, and content interaction data, and using this data to construct audience profiles and cross-device identity graphs. VoltGraph processes approximately 320 million unique user profiles per year derived from AGMG's European digital properties. The annual contract value of the VoltGraph engagement is approximately €1.15 million.
The revised DPA incorporates all requirements of Article 28 of the GDPR, including the provisions described in Section 6.2 above with respect to Pendleton (documented processing instructions, confidentiality, security, sub-processor controls, data subject rights assistance, data deletion and return, and DPIA cooperation). Comprehensive audit and inspection rights pursuant to Article 28(3)(h) are included.
In addition, the VoltGraph DPA includes specific data deletion obligations for all historical server-side pixel data collected by VoltGraph without valid user consent prior to the remediation. AGMG and VoltGraph have agreed that VoltGraph will delete all personal data collected from AGMG's European digital properties during the period in which the non-compliant server-side pixels were operational, to the extent that such data can be identified and isolated within VoltGraph's systems. VoltGraph has committed to completing this historical data deletion within ninety (90) days of execution of the revised DPA and to providing written certification of deletion to AGMG upon completion.
The revised DPA further includes consent-gated pixel firing requirements going forward, whereby VoltGraph's server-side tracking pixels on AGMG's European websites will fire only upon receipt of a valid consent signal from the Brightleaf ConsentShield CMP via the server-side consent verification layer described in Section 4.4 above.
The revised DPA was signed by Margaux Fontaine-Li, Group Data Protection Officer, on behalf of AGMG, and by Dr. Kai-Henrik Möller, Managing Director, on behalf of VoltGraph Analytics GmbH. The DPA was negotiated opposite Dr. Luisa Feldstein of Feldstein Weber LLP (Bockenheimer Landstraße 24, 60323 Frankfurt am Main, Germany), external legal counsel to VoltGraph.
6.4 DPA Renegotiation — Remaining 7 Vendors
Data Processing Agreements with the remaining seven (7) non-compliant vendors were executed on 10 April 2024. These vendors, which are identified in the summary table at Exhibit E, operate across various segments of the advertising technology ecosystem, including demand-side platforms, ad exchanges, data management platforms, and attribution analytics providers.
All nine (9) remediated DPAs (encompassing Pendleton, VoltGraph, and the seven additional vendors) now incorporate:
• Full Article 28 GDPR-compliant provisions, including documented processing instructions, confidentiality, security, data subject rights assistance, data deletion and return, and DPIA cooperation;
• Audit and inspection rights per Article 28(3)(h) of the GDPR;
• Sub-processor controls and flow-down obligations, requiring all sub-processors to be bound by equivalent data protection obligations;
• Consent-dependent processing aligned with IAB TCF 2.2 consent signals from the Brightleaf ConsentShield CMP.
For the six (6) vendors with cross-border data transfer issues — four (4) vendors transferring data to the United States, one (1) to India, and one (1) to Singapore — Standard Contractual Clauses have been executed and Transfer Impact Assessments completed. Prior to remediation, only two (2) of these six (6) vendors had Standard Contractual Clauses in place, and none had completed Transfer Impact Assessments. All six vendors are now subject to appropriate Chapter V safeguards, as described in further detail in Section 7 below.
Section 7: Cross-Border Data Transfer Remediation
Prior to the commencement of the remediation programme, Calderwood & Harkness's review identified that six (6) of AGMG's adtech vendors were transferring personal data originating from AGMG's European digital properties to destinations outside the European Economic Area without adequate safeguards within the meaning of Chapter V of the GDPR. Specifically:
• Four (4) vendors were transferring personal data to the United States;
• One (1) vendor was transferring personal data to India; and
• One (1) vendor was transferring personal data to Singapore.
Of these six vendors, only two (2) had previously executed European Commission Standard Contractual Clauses with AGMG, and neither of those two had been subject to a Transfer Impact Assessment. The remaining four vendors had no contractual safeguards in place for their cross-border data transfers.
The following remediation actions have been completed:
(a) Standard Contractual Clauses. All six (6) vendors have now executed the European Commission's Standard Contractual Clauses, adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, using the appropriate module for each transfer relationship. For transfers where AGMG acts as controller and the vendor acts as processor, Module 2 (Controller to Processor) has been used. For transfers where the vendor acts as an independent controller for certain processing purposes (applicable in one case), Module 1 (Controller to Controller) has been used.
(b) Transfer Impact Assessments. Transfer Impact Assessments ("TIAs") have been completed for each of the six cross-border transfer relationships. Each TIA documents:
(i) An assessment of the legal framework of the recipient country, including the laws and practices governing government access to personal data, the existence of independent data protection supervision, and the availability of effective legal remedies for data subjects;
(ii) An evaluation of the specific circumstances of the transfer, including the nature and volume of personal data transferred, the categories of data subjects affected, the purposes of the transfer, and the technical and organisational measures implemented by the data importer;
(iii) An identification and assessment of supplementary measures implemented to address any gaps identified in the legal framework assessment, including technical measures (such as encryption in transit and at rest, pseudonymisation, and data minimisation), contractual measures (such as enhanced audit rights, notification obligations in the event of government access requests, and contractual prohibitions on onward transfers without AGMG's consent), and organisational measures (such as security certifications and access control policies); and
(iv) An overall risk assessment documenting the residual risk to data subjects, taking into account the supplementary measures implemented, and concluding that the level of protection afforded to the transferred personal data is essentially equivalent to that guaranteed within the EEA.
All Transfer Impact Assessments are maintained on file by Calderwood & Harkness LLP and by AGMG's Data Protection Office, and are available for CNIL review upon request.
Section 8: Updated Data Protection Impact Assessments
In connection with the remediation programme, AGMG has undertaken to update its Data Protection Impact Assessments ("DPIAs") for the processing activities identified as presenting a high risk to the rights and freedoms of data subjects, pursuant to Article 35 of the GDPR. The processing activities subject to updated DPIAs include:
(a) Programmatic advertising, including real-time bidding processes that involve the processing of user personal data for the purpose of serving targeted advertisements;
(b) Audience analytics, including cross-device tracking and audience segmentation activities performed by vendors such as VoltGraph Analytics GmbH;
(c) Profiling activities, including the creation of user interest profiles and behavioural segments based on browsing history, content preferences, and interaction data; and
(d) International data transfers to third-party adtech vendors located outside the EEA.
The updated DPIAs will reflect the remediated data flows described in this response, including the implementation of the Brightleaf ConsentShield CMP, the consent-gated cookie and pixel deployment mechanisms, the revised vendor DPAs, and the new cross-border transfer safeguards. The DPIAs will assess the risks to data subjects arising from each of the above processing activities, including the risks associated with profiling, cross-device identity resolution, the exposure of personal data through real-time bidding protocols, and the transfer of personal data to jurisdictions that do not provide an adequate level of data protection.
Residual risks will be assessed and documented, together with the mitigating measures that AGMG has implemented or will implement to reduce those risks to an acceptable level. The DPIAs will also document the consultations undertaken with AGMG's Data Protection Officer in the course of the assessment.
The updated DPIAs are anticipated to be delivered on 18 April 2024, which is six (6) days after the submission of this compliance response. AGMG acknowledges that the DPIAs will not be completed by the extended compliance deadline of 14 April 2024. However, AGMG respectfully notes that the DPIAs are an internal compliance documentation exercise that does not affect the user-facing remediation measures, all of which have been fully implemented. AGMG confirms that the updated DPIAs will be signed off by Margaux Fontaine-Li, Group Data Protection Officer, and will be made available to the CNIL upon delivery.
Section 9: Updated Records of Processing Activities
AGMG's Records of Processing Activities ("ROPA"), maintained pursuant to Article 30 of the GDPR, are being updated to reflect all remediated processing activities across the Company's European digital properties. The existing ROPA required updating to account for the changes in data flows, consent mechanisms, vendor relationships, and cross-border transfer safeguards implemented through the remediation programme.
The updated ROPA delivery is anticipated on 22 April 2024. The updated ROPA will comprehensively document all processing activities across the fourteen (14) European websites and three (3) mobile applications, including:
• The name and contact details of the controller (AGMG) and, where applicable, the joint controller, the controller's representative, and the Data Protection Officer;
• The purposes of each processing activity;
• A description of the categories of data subjects and of the categories of personal data processed;
• The categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations;
• Where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and the documentation of suitable safeguards;
• Where possible, the envisaged time limits for erasure of the different categories of data (retention periods); and
• Where possible, a general description of the technical and organisational security measures referred to in Article 32(1) of the GDPR.
AGMG undertakes to make the updated ROPA available to the CNIL upon request, and to maintain the ROPA on an ongoing basis in accordance with Article 30 of the GDPR.
Section 10: Remediation Timeline Summary
The following table provides a comprehensive summary of all key remediation milestones, with dates, from the commencement of the remediation programme through the submission of this compliance response and the anticipated delivery of remaining documentation:
AGMG confirms that all remediation actions directly affecting user-facing consent mechanisms, cookie deployment behaviour, server-side tracking pixel firing, and vendor data processing agreements have been completed in advance of the extended compliance deadline of 14 April 2024. The only items that will be delivered after the deadline are the updated DPIAs and ROPA, which are internal governance documents that do not affect the technical or operational remediation measures already in place. AGMG commits to delivering these documents on the dates indicated and to making them available to the CNIL upon request.
A visual Gantt-style timeline chart illustrating the parallel execution of all seven workstreams is annexed at Exhibit F.
Section 11: Ongoing Compliance Governance Framework
In addition to the specific remediation actions described in this response, AGMG has committed to implementing a forward-looking compliance governance framework designed to prevent the recurrence of the deficiencies identified in the Formal Notice and to ensure the ongoing compliance of AGMG's European digital properties with the GDPR, the ePrivacy Directive, and applicable national legislation. The key elements of this framework are as follows:
Quarterly Automated Cookie Scans. AGMG will conduct automated cookie and tracking technology scans across all European digital properties on a quarterly basis. These scans will utilise both Thistlewood Consulting's proprietary scanning tools and the monitoring capabilities of the Brightleaf ConsentShield CMP. The scans will verify that no non-essential cookies or tracking technologies fire before affirmative consent, that all consent-gated tags and pixels are functioning correctly, and that no new cookies or tracking technologies have been deployed without appropriate integration with the CMP. Scan results will be reviewed by AGMG's Data Protection Office and any issues identified will be remediated within a defined triage and resolution process.
Annual DPA Review Cycle. AGMG will conduct a comprehensive annual review of all data processing agreements with adtech vendors to ensure continued compliance with Article 28 of the GDPR. This review will assess whether any material changes in processing activities, vendor sub-processor arrangements, or cross-border data transfer configurations have occurred since the last review, and whether amendments to the DPAs are required. The annual DPA review will be coordinated by AGMG's legal department, with support from Calderwood & Harkness LLP as needed.
Biannual DPIA Refreshes. AGMG will refresh its Data Protection Impact Assessments for programmatic advertising and audience analytics processing activities on a biannual basis (i.e., every six months), or more frequently in the event of material changes to the processing activities or the risk landscape. DPIA refreshes will be conducted by AGMG's Data Protection Office, with input from the relevant business units and, where appropriate, from external technical and legal advisors.
CMP Configuration Audits. Quarterly audits of the Brightleaf ConsentShield CMP configuration will be conducted to ensure continued compliance with IAB TCF 2.2 requirements, correct functioning of consent signal generation and transmission, correct default states for all consent toggles, and proper integration with all vendor tags and server-side pixel controls. These audits will be performed by Thistlewood Consulting in coordination with AGMG's engineering team and the Brightleaf technical support function.
Vendor Onboarding Privacy Assessments. All new adtech vendors proposed for deployment on any of AGMG's European digital properties will be required to undergo a privacy assessment prior to onboarding. This assessment will evaluate the vendor's data protec