1017-00008 · Aurelius Global Media Group · Regulatory Correspondence

cnil-extension-request-letter.docx DOCUMENT Finance & Banking

9 / 12 ← → ✕

Contract analysis Extract to table

CONFIDENTIAL — REGULATORY CORRESPONDENCE

CALDERWOOD & HARKNESS LLP Barristers & Solicitors

One Finsbury Square London EC2A 1AE United Kingdom

Tel: +44 (0)20 7842 3000

Fax: +44 (0)20 7842 3001

www.calderwoodharkness.com

11 March 2024

By Registered Post and Email

Commission nationale de l'informatique et des libertés (CNIL) Service des contrôles et des sanctions 3 Place de Fontenoy TSA 80715 75334 PARIS CEDEX 07 France

Re: Formal Notice MED-2023-097 — Request for Extension of Compliance Deadline

Complaint Reference: PLT-2023-FR-04821

Entity Concerned: Aurelius Global Media Group PLC (Companies House No. 08741562)

C&H Matter No.: 1017-00008

Mesdames, Messieurs,

1. Introduction and Authority to Act

I am Rachel Bernstein, Partner in the Privacy & Data Security Practice of Calderwood & Harkness LLP. I write on behalf of our client, Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated under the laws of England and Wales, with its registered office at 140 Threadneedle Row, London EC2R 8AH, United Kingdom. AGMG has duly authorised Calderwood & Harkness LLP to act as its legal representative in all matters relating to the above-referenced formal notice and the underlying complaint proceedings. A copy of the power of attorney, duly executed under seal on behalf of AGMG, is enclosed herewith as Annex 1.

This letter is submitted in response to the formal notice issued by the Commission nationale de l'informatique et des libertés (the "CNIL" or the "Commission") dated 14 December 2023, bearing reference MED-2023-097 (the "Formal Notice"). The Formal Notice was issued pursuant to a complaint filed on 8 November 2023 (reference: PLT-2023-FR-04821) by Digitale Rechte Europa eingetragener Verein ("DRE"), a registered association (eingetragener Verein) established under German law and based in Berlin, Germany.

AGMG's Group Data Protection Officer is Ms Margaux Fontaine-Li, who is based at AGMG's London headquarters and reports directly to the Board of Directors through the Audit and Risk Committee. AGMG's Group General Counsel and Company Secretary is Mr Sanjay Redworth, who likewise maintains his principal office in London. Both Ms Fontaine-Li and Mr Redworth are fully apprised of the matters set out in this letter and the remediation programme described herein.

For the purposes of ongoing correspondence in connection with this matter, the primary contact should be the undersigned, Rachel Bernstein, at Calderwood & Harkness LLP, One Finsbury Square, London EC2A 1AE, United Kingdom (email: r.bernstein@calderwoodharkness.com; direct dial: +44 (0)20 7842 3184). We respectfully request that all future communications relating to reference MED-2023-097 be directed to the undersigned in the first instance.

2. Acknowledgment of the Formal Notice and Its Requirements

AGMG acknowledges receipt of the Formal Notice MED-2023-097 dated 14 December 2023, which was received at AGMG's registered office on 18 December 2023. AGMG further acknowledges the gravity and importance of the Commission's findings and the compliance requirements set out therein.

For the avoidance of doubt and in a spirit of transparency, AGMG wishes to summarise its understanding of the CNIL's principal findings and requirements as articulated in the Formal Notice, as follows:

(a) The complaint filed by DRE alleged, and the CNIL's preliminary investigation confirmed, that AGMG's French-language streaming website, aurelius-stream.fr, deployed a total of forty-seven (47) third-party tracking cookies on page load, prior to any user consent interaction. These cookies were set immediately upon a user's first visit to the website, without any opportunity for the user to express or withhold consent, in contravention of Article 5(3) of Directive 2002/58/EC (the "ePrivacy Directive") as transposed into French law by Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (the "Loi Informatique et Libertés") and the CNIL's guidelines on cookies and other trackers adopted on 17 September 2020.

(b) The cookie consent banner displayed on aurelius-stream.fr was found to employ so-called "dark patterns" — manipulative user-interface design techniques intended to steer users towards a particular outcome — in a manner inconsistent with the requirement for freely given, specific, informed, and unambiguous consent under Article 4(11) and Article 7 of Regulation (EU) 2016/679 (the "GDPR"). Specifically, the banner featured pre-ticked consent boxes for all categories of non-essential cookies, and the visual design of the banner was asymmetric, with a prominently displayed, brightly coloured "Accept All" button and a significantly less visible, greyed-out "Manage Preferences" link, thereby favouring user acceptance of all cookies.

(c) No mechanism was made available to users of aurelius-stream.fr for the withdrawal of previously given consent without requiring the user to navigate away from the content page they were viewing. The CNIL found that the withdrawal of consent required users to locate and access a separate privacy settings page accessible only through the website's footer menu, a process involving a minimum of four (4) distinct navigational steps. This was found to be inconsistent with the requirement under Article 7(3) GDPR that the withdrawal of consent be as easy as the giving of consent.

(d) The Formal Notice required AGMG to bring the processing operations identified in the complaint into full compliance with the applicable legal framework within a period of three (3) months from the date of the Formal Notice, thereby establishing a compliance deadline of 14 March 2024.

AGMG takes these findings with the utmost seriousness. AGMG does not contest the substance of the deficiencies identified by the Commission in the Formal Notice. AGMG recognises that the practices described above fell short of the standards required by applicable European data protection and e-privacy legislation, and AGMG deeply regrets any impact these practices may have had upon the rights and freedoms of data subjects. AGMG wishes to assure the Commission that these deficiencies did not reflect a deliberate disregard for data protection law, but rather resulted from a combination of legacy technical configurations, inadequate vendor oversight processes, and insufficient integration between AGMG's data governance function and its digital product engineering teams — all of which are being comprehensively addressed through the remediation programme described in this letter.

3. Request for Extension of the Compliance Deadline

In view of the foregoing, AGMG respectfully requests that the CNIL grant a thirty (30) day extension of the compliance deadline established in the Formal Notice, from 14 March 2024 to 14 April 2024.

AGMG submits that this request is both proportionate and well-founded, for the following reasons:

(a) Scope of voluntary, enterprise-wide remediation. Upon receipt of the Formal Notice, AGMG's senior management and Board of Directors took the decision not to limit its remediation efforts to the single website identified in the complaint (aurelius-stream.fr), but rather to undertake a comprehensive, group-wide remediation programme extending to all fourteen (14) of AGMG's European-facing websites and all three (3) of its mobile applications. These digital properties serve audiences across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, and together account for approximately eighty-seven million (87,000,000) monthly active users across the EU and EEA. AGMG made this decision voluntarily, in the firm belief that a systemic, enterprise-wide approach to compliance is both more effective and more respectful of data subjects' rights than a narrow, site-specific fix that would leave potentially identical issues unaddressed on its other properties. The scope and scale of this voluntary programme are, however, necessarily substantial, and require a degree of time to implement fully that exceeds the original three-month compliance window.

(b) Complexity and multiplicity of concurrent workstreams. The remediation programme involves multiple concurrent and interdependent workstreams, including, but not limited to: (i) the complete redesign and redeployment of consent mechanisms across all European digital properties; (ii) the identification and remediation of server-side tracking pixels transmitting personal data to third-party vendors without valid consent; (iii) the renegotiation and execution of data processing agreements with nine (9) adtech vendors whose existing contractual arrangements were found to be absent or materially deficient; (iv) the preparation of updated Data Protection Impact Assessments for high-risk processing activities; and (v) the updating of AGMG's Records of Processing Activities to reflect the current state of processing operations. Each of these workstreams involves coordination across multiple internal teams (legal, engineering, product, commercial), external legal counsel, technical consultants, and third-party vendor counterparties, many of whom have their own internal review and approval processes.

(c) Significant progress already achieved. As detailed in Section 4 below, AGMG has already made substantial and demonstrable progress across all remediation workstreams. The technical cookie audit and data flow mapping exercises have been completed, the GDPR gap analysis memorandum has been delivered, and the consent interface redesign is well advanced. The additional thirty (30) days are required solely to complete the implementation and quality assurance of the technical remediations across all properties and to finalise vendor contractual negotiations that, despite AGMG's best efforts, require the agreement of third-party counterparties whose responsiveness and internal processes are not entirely within AGMG's control.

(d) Commitment to a definitive compliance response. AGMG commits to submitting a detailed and comprehensive compliance response to the CNIL, accompanied by full supporting evidence, no later than 12 April 2024 — two days before the requested extended deadline — thereby providing the Commission with complete visibility into the remediation achieved.

AGMG submits that the grant of this modest extension will enable it to deliver a more complete, more durable, and more comprehensive remediation than would be possible within the original deadline, to the ultimate benefit of the data subjects whose rights the Commission is charged with protecting.

4. Remediation Progress to Date

AGMG wishes to provide the Commission with a detailed account of the remediation progress achieved to date, in order to demonstrate both the seriousness with which AGMG has approached the Formal Notice and the substantial work already completed.

4.1 Engagement of Legal Counsel and Technical Consultants

On 12 January 2024 — within one calendar month of receipt of the Formal Notice — AGMG retained Calderwood & Harkness LLP, a specialist privacy and data security law firm with extensive experience advising multinational media and technology companies on GDPR and ePrivacy compliance, to lead the legal aspects of the remediation programme and to serve as AGMG's legal representative before the CNIL.

On the same date, AGMG retained Thistlewood Consulting Ltd, a cybersecurity and data governance consulting firm based at 9 Worship Street, London EC2A 2BF, United Kingdom, to conduct the technical cookie audit, server-side tracking pixel assessment, and comprehensive data flow mapping under the legal direction of Calderwood & Harkness LLP. Thistlewood Consulting is an ISO 27001-certified firm with particular expertise in adtech ecosystem auditing and consent management platform configuration reviews.

These engagements were established promptly in order to ensure that the remediation programme could commence without delay. AGMG's management team held its first joint working session with Calderwood & Harkness and Thistlewood Consulting on 15 January 2024, at which the scope, methodology, and timeline for the remediation programme were agreed.

4.2 Technical Cookie Audit (Completed)

A comprehensive technical cookie audit was commenced on 22 January 2024 and completed on 16 February 2024. The audit was conducted by Thistlewood Consulting using industry-standard automated scanning tools complemented by manual verification, and was supervised by Calderwood & Harkness in order to ensure that the methodology and scope were consistent with the CNIL's published guidance on cookies and trackers, as well as with the requirements of the ePrivacy Directive and the GDPR.

Critically, the scope of this audit was not limited to aurelius-stream.fr, the single website identified in the complaint. Rather, at AGMG's direction, the audit covered all fourteen (14) of AGMG's European-facing websites, spanning six language markets (English, French, German, Dutch, Spanish, and Italian). Each website was scanned across multiple pages, device types (desktop, mobile web, and tablet), and browser environments (Chrome, Firefox, Safari, and Edge) to ensure comprehensive coverage.

The audit yielded the following principal findings:

(a) A total of three hundred and twelve (312) unique cookies were identified across the fourteen (14) European properties.

(b) Of these, seventy-four (74) cookies were found to be firing before any consent interaction by the user — that is, they were set on page load, prior to the display of or any interaction with the cookie consent banner.

(c) Of the seventy-four (74) cookies firing before consent, thirty-eight (38) were classified as strictly necessary cookies with a legitimate basis for setting without consent (e.g., session management cookies, load-balancing cookies, and security-critical cookies), and accordingly did not present a compliance issue.

(d) The remaining thirty-six (36) cookies were identified as non-compliant. These cookies — which included third-party advertising cookies, audience measurement cookies, and social media tracking cookies — were firing before valid consent had been obtained from the user and lacked any valid legal basis under Article 5(3) of the ePrivacy Directive or Article 6(1)(a) GDPR. This finding confirmed, and indeed expanded upon, the deficiency identified in the Formal Notice with respect to aurelius-stream.fr, demonstrating its prevalence across the broader property portfolio.

The complete cookie audit report was delivered to AGMG management on 20 February 2024 and has been shared with Ms Fontaine-Li (Group DPO) and Mr Redworth (Group General Counsel) for their review and action.

4.3 Server-Side Tracking Pixel Assessment (Completed)

In addition to the cookie audit, Thistlewood Consulting conducted a server-side tracking pixel assessment across all of AGMG's European digital properties. This assessment was designed to identify tracking mechanisms that operate at the server level rather than through browser-based cookies, and which may therefore not be captured by conventional cookie-scanning tools.

The assessment identified nineteen (19) unique server-side tracking pixels deployed across AGMG's European properties. Of these nineteen pixels, twelve (12) were found to be transmitting personal data — including IP addresses, device fingerprints (based on user-agent strings, screen resolution, and installed fonts), and browsing history (including page URLs and referrer information) — to third-party adtech vendors without prior valid consent from the data subject. In several instances, the pixel was configured to fire on every page load regardless of the user's consent status, effectively bypassing the consent management platform entirely.

The technical remediation of these server-side pixels is currently in progress. The remediation involves reconfiguring each pixel to fire only after valid, GDPR-compliant consent has been obtained via the consent management platform, and in certain cases involves the removal of pixels altogether where no valid processing purpose or legal basis can be established. The target completion date for this workstream is 2 April 2024.

4.4 Data Flow Mapping (Completed)

A comprehensive mapping of adtech vendor data flows was commenced on 5 February 2024 and completed on 28 February 2024. This exercise was conducted jointly by Calderwood & Harkness and Thistlewood Consulting, with input from AGMG's internal commercial and technology teams.

The data flow mapping identified twenty-three (23) adtech vendors processing AGMG user data across its European digital properties, encompassing programmatic advertising demand-side platforms, supply-side platforms, data management platforms, analytics providers, audience segmentation services, and cross-device identification providers.

The mapping revealed the following compliance gaps:

(a) Data Processing Agreements. Nine (9) of the twenty-three (23) vendors were found either to have no data processing agreement ("DPA") in place at all, or to have DPAs that were materially deficient and did not meet the minimum requirements of Article 28 GDPR. In particular, several DPAs lacked the mandatory provisions specified in Article 28(3), including provisions relating to the subject-matter and duration of processing, the nature and purpose of processing, the types of personal data and categories of data subjects, and the obligations and rights of AGMG as controller.

(b) Priority vendors for DPA renegotiation. Two vendors have been identified as requiring priority attention due to the volume and sensitivity of the personal data they process on behalf of AGMG:

(i) Pendleton AdTech Solutions Ltd, AGMG's primary programmatic advertising partner, incorporated in Ireland with its registered office in Dublin. Pendleton processes approximately 4.2 billion ad bid requests per month involving AGMG user data, including cookie identifiers, IP addresses, device identifiers, and inferred interest profiles. Pendleton's existing contractual arrangement with AGMG consists of a commercial services agreement executed in 2019 that contains a brief data processing addendum which is materially deficient under Article 28 GDPR, lacking, inter alia, provisions on sub-processor management, audit rights, data breach notification, and international data transfers.

(ii) VoltGraph Analytics GmbH, a cross-device tracking and audience segmentation provider incorporated under German law with its registered office in Hamburg. VoltGraph processes approximately 320 million unique user profiles per year derived from AGMG user data, including deterministic and probabilistic cross-device graphs, behavioural signals, and inferred demographic attributes. VoltGraph's existing DPA was last updated in 2020 and does not reflect the current scope of processing or the requirements of the CNIL's guidance.

(c) Reliance on "legitimate interest" under the IAB TCF. Seven (7) vendors were identified as relying on "legitimate interest" as a legal basis under the IAB Europe Transparency and Consent Framework ("TCF") version 2.2 for processing purposes that, in the view of Calderwood & Harkness and consistent with the CNIL's published guidance, properly require the consent of the data subject. These purposes include, in particular, the creation of advertising profiles and the use of personal data for personalised advertising. AGMG is in the process of reconfiguring its consent management platform to require consent (rather than accept a legitimate interest signal) for these purposes, and is communicating this change to the relevant vendors.

(d) International data transfers. Six (6) vendors were identified as transferring personal data originating from AGMG's European users outside the European Economic Area. Of these, four (4) transfer data to the United States, one (1) transfers data to India, and one (1) transfers data to Singapore. Only two (2) of the six vendors transferring data outside the EEA had executed Standard Contractual Clauses ("SCCs") in compliance with the European Commission's implementing decision of 4 June 2021. The remaining four (4) vendors had no adequate safeguard mechanism in place for their international data transfers, presenting a clear compliance gap under Articles 44–49 GDPR. AGMG is in the process of executing the latest approved SCCs with all six vendors, accompanied by Transfer Impact Assessments as recommended by the European Data Protection Board.

4.5 Dark Pattern Remediation (In Progress)

The technical audit conducted by Thistlewood Consulting confirmed the dark-pattern issues raised in the DRE complaint with respect to aurelius-stream.fr and, importantly, identified the prevalence of similar issues across AGMG's broader European property portfolio. The specific findings were as follows:

(a) Pre-ticked consent boxes were present on six (6) of the fourteen (14) European websites, including aurelius-stream.fr.

(b) Asymmetric button design — with a prominently displayed, brightly coloured "Accept All" button and a significantly less visible "Manage Preferences" option — was present on all fourteen (14) European websites.

(c) No "Reject All" button was offered on eleven (11) of the fourteen (14) European websites. On the remaining three websites, a "Reject All" option existed but was accessible only on a secondary settings layer, not on the first layer of the cookie banner.

(d) Withdrawal of consent required four (4) or more distinct clicks or navigational steps on eight (8) of the fourteen (14) European websites, in contravention of the principle that withdrawal of consent must be as easy as the giving of consent (Article 7(3) GDPR).

(e) All three (3) of AGMG's mobile applications (available on iOS and Android) lacked granular consent controls for the setting of advertising identifiers and the processing of personal data for advertising purposes. Furthermore, the two (2) iOS applications' implementation of Tidewater Industries's App Tracking Transparency ("ATT") framework did not align with GDPR consent requirements: specifically, the ATT prompt was presented after the in-app consent mechanism had already been displayed, creating confusion as to the scope of consent given and potentially resulting in personal data being processed on the basis of an ATT "allow" selection that did not constitute valid GDPR consent.

AGMG's engineering and product teams are actively redesigning the consent interfaces across all European digital properties, working in close collaboration with Calderwood & Harkness LLP and with AGMG's existing consent management platform provider, Brightleaf Consent Technologies EU B.V. ("Brightleaf"), a company incorporated in the Netherlands. Brightleaf's ConsentShield product, which is IAB TCF 2.2 certified and is deployed across all AGMG European properties, is being reconfigured to ensure that:

• All non-essential cookies and trackers are blocked by default until valid consent is obtained;

• The consent banner presents equally prominent "Accept All" and "Reject All" buttons on the first layer;

• All consent checkboxes are unticked by default;

• Granular, purpose-level consent options are available on the first or second layer of the banner;

• Consent withdrawal is available at all times through a persistent, easily accessible interface element (a floating "cookie settings" icon) requiring no more than two (2) clicks; and

• Consent signals are propagated to all server-side tracking pixels and third-party vendor tags via the TCF consent string, ensuring that no non-essential processing occurs absent valid consent.

The target deployment date for the remediated cookie banners across all fourteen (14) European websites is 22 March 2024. The target deployment date for the updated mobile application consent flows across all three (3) applications (including alignment of the iOS ATT prompts with GDPR consent requirements) is 29 March 2024.

4.6 GDPR Gap Analysis (Completed)

A comprehensive GDPR gap analysis memorandum was prepared by Calderwood & Harkness LLP and delivered to AGMG management on 4 March 2024. The memorandum assessed AGMG's European digital properties and associated processing operations against the following provisions of applicable law:

• GDPR Article 5 (Principles relating to processing of personal data);

• GDPR Article 6 (Lawfulness of processing);

• GDPR Article 7 (Conditions for consent);

• GDPR Articles 13 and 14 (Information to be provided to data subjects);

• GDPR Article 28 (Processor);

• GDPR Article 30 (Records of processing activities);

• GDPR Article 35 (Data protection impact assessment);

• GDPR Articles 44–49 (Transfers of personal data to third countries or international organisations);

• United Kingdom Privacy and Electronic Communications (EC Directive) Regulations 2003, Regulation 6 (Privacy and electronic communications); and

• The French Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (Loi Informatique et Libertés), with particular reference to Article 82 concerning trackers.

Each finding identified in the gap analysis was assessed against a four-tier risk rating (Critical, High, Medium, Low), and a phased remediation roadmap was developed. Each remediation item was assigned to a responsible workstream lead, given a target completion date, and classified by priority. The gap analysis memorandum has been reviewed and approved by AGMG's Group Data Protection Officer and Group General Counsel, and its remediation roadmap has been adopted as the governing framework for the remainder of the compliance programme.

5. Remaining Remediation Workstreams and Proposed Timeline

The following table sets out the remaining remediation workstreams and their respective target completion dates, all of which fall within the requested extension period:

As the foregoing table demonstrates, all remediation workstreams will be completed by 12 April 2024, a full two (2) days before the requested extended deadline of 14 April 2024. This buffer has been deliberately built into the timeline to account for any unforeseen delays in vendor contractual negotiations or technical deployment.

AGMG commits to submitting a detailed compliance response to the CNIL on or before 12 April 2024, demonstrating full remediation of all identified deficiencies. The compliance response will be accompanied by comprehensive supporting evidence, including:

(a) Technical scan results from Thistlewood Consulting confirming that no non-essential cookies or tracking pixels fire prior to the obtaining of valid consent across all European properties;

(b) Screenshots and screen recordings of the compliant consent interfaces as deployed on each of the fourteen (14) websites and three (3) mobile applications, demonstrating compliance with the CNIL's guidance on cookies and dark patterns;

(c) Fully executed Data Processing Agreements with all twenty-three (23) adtech vendors, including Standard Contractual Clauses and Transfer Impact Assessments where applicable;

(d) Updated Data Protection Impact Assessments for all high-risk processing activities identified in the gap analysis;

(e) Updated Records of Processing Activities reflecting the current state of AGMG's European processing operations; and

(f) A summary of the long-term compliance governance measures being implemented, as described in Section 6 below.

6. AGMG's Good Faith and Commitment to Compliance

AGMG wishes to emphasise to the Commission several factors that, it respectfully submits, demonstrate its genuine good faith and deep commitment to data protection compliance.

First, AGMG's remediation programme goes significantly beyond the scope of the specific complaint regarding aurelius-stream.fr. Rather than adopting a narrow approach limited to resolving the identified issues on a single website, AGMG has voluntarily extended its remediation to encompass all fourteen (14) of its European-facing websites and all three (3) of its mobile applications, serving approximately eighty-seven million monthly active users. This decision was taken at Board level and reflects AGMG's conviction that data protection compliance is a systemic, organisation-wide responsibility, not a matter of addressing individual complaints on an ad hoc basis.

Second, AGMG has committed substantial financial and human resources to the remediation programme. This includes the retention of external specialist legal counsel (Calderwood & Harkness LLP) and a dedicated technical consultant (Thistlewood Consulting Ltd), in addition to the significant internal resources dedicated to the programme, including personnel from AGMG's legal, data protection, engineering, product, and commercial teams.

Third, the remediation programme encompasses seven (7) comprehensive and interdependent workstreams:

1. Consent mechanism redesign — complete overhaul of cookie banners and in-app consent flows to eliminate dark patterns and ensure GDPR-compliant consent across all properties;

2. Server-side pixel remediation — identification and remediation of all server-side tracking pixels firing without valid consent;

3. DPA renegotiation — negotiation and execution of GDPR-compliant data processing agreements with all nine (9) vendors identified as having no DPA or a materially deficient DPA;

4. Vendor audit rights — insertion of contractual audit rights in all vendor DPAs in accordance with Article 28(3)(h) GDPR, enabling AGMG (or its appointed auditors) to conduct and contribute to audits of vendor processing activities;

5. DPIA updates — preparation and approval of updated Data Protection Impact Assessments for all processing activities assessed as presenting a high risk to the rights and freedoms of data subjects;

6. ROPA updates — comprehensive updating of AGMG's Records of Processing Activities to reflect the current state of processing operations across all European properties; and

7. Regulatory response preparation — preparation of a complete compliance response to the CNIL, accompanied by full supporting documentation and evidence.

Fourth, the remediation programme is being personally overseen at the most senior levels of AGMG's organisation. AGMG's Group Data Protection Officer, Ms Margaux Fontaine-Li, chairs weekly programme steering committee meetings and has direct reporting access to the Board of Directors through the Audit and Risk Committee on the progress of the remediation. AGMG's Chief Technology Officer, Mr Leander Voss, is personally overseeing the technical implementation workstreams and has committed dedicated engineering resources to the programme.

Fifth, and importantly, AGMG is not treating this remediation as a one-time exercise. AGMG is developing and implementing a long-term compliance governance framework designed to prevent the recurrence of the types of deficiencies identified in the Formal Notice. This framework includes, among other measures:

• Quarterly automated cookie scans of all European digital properties, conducted by Thistlewood Consulting or an equivalent specialist provider, with results reported to the Group DPO;

• Annual reviews of all Data Processing Agreements with adtech and data processing vendors, to ensure continued compliance with Article 28 GDPR and applicable guidance;

• Biannual refreshes of Data Protection Impact Assessments for all high-risk processing activities, with any material changes to processing triggering an ad hoc DPIA review;

• Quarterly CMP configuration audits to verify that the consent management platform is correctly configured and that consent signals are being accurately propagated to all vendor tags and pixels;

• Mandatory privacy training for all members of AGMG's digital media, product, and engineering teams, to be conducted annually and upon onboarding of new team members, covering GDPR consent requirements, ePrivacy obligations, dark pattern avoidance, and vendor management best practices; and

• Establishment of a Privacy Engineering function within AGMG's technology division, responsible for embedding privacy-by-design and privacy-by-default principles into the development lifecycle of all digital products and features.

AGMG is confident that these measures, taken together, will establish a robust and sustainable compliance infrastructure that goes well beyond the minimum requirements of the applicable legal framework and reflects AGMG's genuine commitment to respecting the privacy and data protection rights of its users.

7. Conclusion and Request

In light of the substantial remediation progress already achieved, as detailed in Section 4 above, and the comprehensive, group-wide scope of the remediation programme voluntarily undertaken by AGMG — extending well beyond the single website identified in the complaint to encompass all fourteen (14) European websites and three (3) mobile applications — AGMG respectfully requests that the Commission grant a thirty (30) day extension of the compliance deadline established in the Formal Notice, from 14 March 2024 to 14 April 2024.

AGMG commits to submitting a full and detailed compliance response to the Commission, accompanied by comprehensive supporting evidence as described in Section 5 above, no later than 12 April 2024.

AGMG remains entirely at the Commission's disposal for any questions, requests for clarification, or requests for additional information that the Commission may have in connection with this matter or the remediation programme. Should the Commission wish to discuss any aspect of this letter or the remediation programme, the undersigned is available at the Commission's convenience.

AGMG respectfully requests that the Commission acknowledge receipt of this letter and confirm its decision regarding the requested extension at its earliest convenience. Any such acknowledgment or confirmation may be directed to the undersigned at the contact details provided in Section 1 above.

We thank the Commission for its consideration of this request and for its continued dedication to the protection of the fundamental rights and freedoms of data subjects.

Yours faithfully,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security Practice Calderwood & Harkness LLP One Finsbury Square, London EC2A 1AE, United Kingdom

On behalf of Aurelius Global Media Group PLC

cc:

Sanjay Redworth, Group General Counsel & Company Secretary, Aurelius Global Media Group PLC, 140 Threadneedle Row, London EC2R 8AH, United Kingdom

Margaux Fontaine-Li, Group Data Protection Officer, Aurelius Global Media Group PLC, 140 Threadneedle Row, London EC2R 8AH, United Kingdom

Enclosures:

Annex 1: Power of Attorney — Aurelius Global Media Group PLC authorising Calderwood & Harkness LLP to act on its behalf before the Commission nationale de l'informatique et des libertés (CNIL) in connection with Formal Notice MED-2023-097 and Complaint PLT-2023-FR-04821 (executed under seal by Sanjay Redworth, Group General Counsel & Company Secretary, on behalf of the Board of Directors of Aurelius Global Media Group PLC, dated 12 January 2024).

Annex 2: Summary Timeline of Remediation Milestones (consolidated table setting out all completed and remaining milestones from Sections 4 and 5 of this letter, with completion status and responsible workstream lead).

ANNEX 2

SUMMARY TIMELINE OF REMEDIATION MILESTONES

Aurelius Global Media Group PLC — Formal Notice MED-2023-097

End of Annex 2

Workstream	Target Completion Date
Remediated cookie banners deployed across all 14 European websites	22 March 2024
Updated mobile application consent flows deployed across all 3 applications	29 March 2024
Server-side tracking pixel remediation completed across all properties	2 April 2024
Execution of revised Data Processing Agreement with Pendleton AdTech Solutions Ltd (including SCCs and TIA)	5 April 2024
Execution of revised Data Processing Agreement with VoltGraph Analytics GmbH (including SCCs and TIA)	8 April 2024
Execution of remaining 7 vendor DPAs (with SCCs and Transfer Impact Assessments where required for extra-EEA transfers)	10 April 2024
Updated Data Protection Impact Assessments finalised and approved	10 April 2024
Updated Records of Processing Activities completed	10 April 2024
Submission of comprehensive CNIL compliance response with full supporting evidence	12 April 2024
No.	Milestone	Date	Status
1	Retention of Calderwood & Harkness LLP and Thistlewood Consulting Ltd	12 January 2024	Completed
2	First joint working session — scope, methodology, and timeline agreed	15 January 2024	Completed
3	Comprehensive technical cookie audit commenced	22 January 2024	Completed
4	Server-side tracking pixel assessment commenced	22 January 2024	Completed
5	Adtech vendor data flow mapping commenced	5 February 2024	Completed
6	Technical cookie audit completed — 312 cookies identified, 36 non-compliant	16 February 2024	Completed
7	Cookie audit report delivered to AGMG management	20 February 2024	Completed
8	Server-side tracking pixel assessment completed — 19 pixels identified, 12 non-compliant	23 February 2024	Completed
9	Adtech vendor data flow mapping completed — 23 vendors, 9 deficient DPAs	28 February 2024	Completed
10	GDPR gap analysis memorandum delivered to AGMG management	4 March 2024	Completed
11	Submission of extension request to CNIL	11 March 2024	Completed
12	Remediated cookie banners deployed across all 14 European websites	22 March 2024	In Progress
13	Updated mobile application consent flows deployed across all 3 applications	29 March 2024	In Progress
14	Server-side tracking pixel remediation completed across all properties	2 April 2024	In Progress

15	Execution of revised DPA with Pendleton AdTech Solutions Ltd	5 April 2024	In Progress
16	Execution of revised DPA with VoltGraph Analytics GmbH	8 April 2024	In Progress
17	Execution of remaining 7 vendor DPAs (with SCCs and TIAs where applicable)	10 April 2024	In Progress
18	Updated DPIAs finalised and approved	10 April 2024	In Progress
19	Updated Records of Processing Activities completed	10 April 2024	In Progress
20	Submission of comprehensive CNIL compliance response with full supporting evidence	12 April 2024	Pending

CONFIDENTIAL — REGULATORY CORRESPONDENCE
CALDERWOOD & HARKNESS LLP Barristers & Solicitors
One Finsbury Square London EC2A 1AE United Kingdom
Tel: +44 (0)20 7842 3000
Fax: +44 (0)20 7842 3001
www.calderwoodharkness.com
11 March 2024
By Registered Post and Email
Commission nationale de l'informatique et des libertés (CNIL) Service des contrôles et des sanctions 3 Place de Fontenoy TSA 80715 75334 PARIS CEDEX 07 France
Re: Formal Notice MED-2023-097 — Request for Extension of Compliance Deadline
Complaint Reference: PLT-2023-FR-04821
Entity Concerned: Aurelius Global Media Group PLC (Companies House No. 08741562)
C&H Matter No.: 1017-00008
Mesdames, Messieurs,
1. Introduction and Authority to Act
I am Rachel Bernstein, Partner in the Privacy & Data Security Practice of Calderwood & Harkness LLP. I write on behalf of our client, Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated under the laws of England and Wales, with its registered office at 140 Threadneedle Row, London EC2R 8AH, United Kingdom. AGMG has duly authorised Calderwood & Harkness LLP to act as its legal representative in all matters relating to the above-referenced formal notice and the underlying complaint proceedings. A copy of the power of attorney, duly executed under seal on behalf of AGMG, is enclosed herewith as Annex 1.
This letter is submitted in response to the formal notice issued by the Commission nationale de l'informatique et des libertés (the "CNIL" or the "Commission") dated 14 December 2023, bearing reference MED-2023-097 (the "Formal Notice"). The Formal Notice was issued pursuant to a complaint filed on 8 November 2023 (reference: PLT-2023-FR-04821) by Digitale Rechte Europa eingetragener Verein ("DRE"), a registered association (eingetragener Verein) established under German law and based in Berlin, Germany.
AGMG's Group Data Protection Officer is Ms Margaux Fontaine-Li, who is based at AGMG's London headquarters and reports directly to the Board of Directors through the Audit and Risk Committee. AGMG's Group General Counsel and Company Secretary is Mr Sanjay Redworth, who likewise maintains his principal office in London. Both Ms Fontaine-Li and Mr Redworth are fully apprised of the matters set out in this letter and the remediation programme described herein.
For the purposes of ongoing correspondence in connection with this matter, the primary contact should be the undersigned, Rachel Bernstein, at Calderwood & Harkness LLP, One Finsbury Square, London EC2A 1AE, United Kingdom (email: r.bernstein@calderwoodharkness.com; direct dial: +44 (0)20 7842 3184). We respectfully request that all future communications relating to reference MED-2023-097 be directed to the undersigned in the first instance.
2. Acknowledgment of the Formal Notice and Its Requirements
AGMG acknowledges receipt of the Formal Notice MED-2023-097 dated 14 December 2023, which was received at AGMG's registered office on 18 December 2023. AGMG further acknowledges the gravity and importance of the Commission's findings and the compliance requirements set out therein.
For the avoidance of doubt and in a spirit of transparency, AGMG wishes to summarise its understanding of the CNIL's principal findings and requirements as articulated in the Formal Notice, as follows:
(a) The complaint filed by DRE alleged, and the CNIL's preliminary investigation confirmed, that AGMG's French-language streaming website, aurelius-stream.fr, deployed a total of forty-seven (47) third-party tracking cookies on page load, prior to any user consent interaction. These cookies were set immediately upon a user's first visit to the website, without any opportunity for the user to express or withhold consent, in contravention of Article 5(3) of Directive 2002/58/EC (the "ePrivacy Directive") as transposed into French law by Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (the "Loi Informatique et Libertés") and the CNIL's guidelines on cookies and other trackers adopted on 17 September 2020.
(b) The cookie consent banner displayed on aurelius-stream.fr was found to employ so-called "dark patterns" — manipulative user-interface design techniques intended to steer users towards a particular outcome — in a manner inconsistent with the requirement for freely given, specific, informed, and unambiguous consent under Article 4(11) and Article 7 of Regulation (EU) 2016/679 (the "GDPR"). Specifically, the banner featured pre-ticked consent boxes for all categories of non-essential cookies, and the visual design of the banner was asymmetric, with a prominently displayed, brightly coloured "Accept All" button and a significantly less visible, greyed-out "Manage Preferences" link, thereby favouring user acceptance of all cookies.
(c) No mechanism was made available to users of aurelius-stream.fr for the withdrawal of previously given consent without requiring the user to navigate away from the content page they were viewing. The CNIL found that the withdrawal of consent required users to locate and access a separate privacy settings page accessible only through the website's footer menu, a process involving a minimum of four (4) distinct navigational steps. This was found to be inconsistent with the requirement under Article 7(3) GDPR that the withdrawal of consent be as easy as the giving of consent.
(d) The Formal Notice required AGMG to bring the processing operations identified in the complaint into full compliance with the applicable legal framework within a period of three (3) months from the date of the Formal Notice, thereby establishing a compliance deadline of 14 March 2024.
AGMG takes these findings with the utmost seriousness. AGMG does not contest the substance of the deficiencies identified by the Commission in the Formal Notice. AGMG recognises that the practices described above fell short of the standards required by applicable European data protection and e-privacy legislation, and AGMG deeply regrets any impact these practices may have had upon the rights and freedoms of data subjects. AGMG wishes to assure the Commission that these deficiencies did not reflect a deliberate disregard for data protection law, but rather resulted from a combination of legacy technical configurations, inadequate vendor oversight processes, and insufficient integration between AGMG's data governance function and its digital product engineering teams — all of which are being comprehensively addressed through the remediation programme described in this letter.
3. Request for Extension of the Compliance Deadline
In view of the foregoing, AGMG respectfully requests that the CNIL grant a thirty (30) day extension of the compliance deadline established in the Formal Notice, from 14 March 2024 to 14 April 2024.
AGMG submits that this request is both proportionate and well-founded, for the following reasons:
(a) Scope of voluntary, enterprise-wide remediation. Upon receipt of the Formal Notice, AGMG's senior management and Board of Directors took the decision not to limit its remediation efforts to the single website identified in the complaint (aurelius-stream.fr), but rather to undertake a comprehensive, group-wide remediation programme extending to all fourteen (14) of AGMG's European-facing websites and all three (3) of its mobile applications. These digital properties serve audiences across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, and together account for approximately eighty-seven million (87,000,000) monthly active users across the EU and EEA. AGMG made this decision voluntarily, in the firm belief that a systemic, enterprise-wide approach to compliance is both more effective and more respectful of data subjects' rights than a narrow, site-specific fix that would leave potentially identical issues unaddressed on its other properties. The scope and scale of this voluntary programme are, however, necessarily substantial, and require a degree of time to implement fully that exceeds the original three-month compliance window.
(b) Complexity and multiplicity of concurrent workstreams. The remediation programme involves multiple concurrent and interdependent workstreams, including, but not limited to: (i) the complete redesign and redeployment of consent mechanisms across all European digital properties; (ii) the identification and remediation of server-side tracking pixels transmitting personal data to third-party vendors without valid consent; (iii) the renegotiation and execution of data processing agreements with nine (9) adtech vendors whose existing contractual arrangements were found to be absent or materially deficient; (iv) the preparation of updated Data Protection Impact Assessments for high-risk processing activities; and (v) the updating of AGMG's Records of Processing Activities to reflect the current state of processing operations. Each of these workstreams involves coordination across multiple internal teams (legal, engineering, product, commercial), external legal counsel, technical consultants, and third-party vendor counterparties, many of whom have their own internal review and approval processes.
(c) Significant progress already achieved. As detailed in Section 4 below, AGMG has already made substantial and demonstrable progress across all remediation workstreams. The technical cookie audit and data flow mapping exercises have been completed, the GDPR gap analysis memorandum has been delivered, and the consent interface redesign is well advanced. The additional thirty (30) days are required solely to complete the implementation and quality assurance of the technical remediations across all properties and to finalise vendor contractual negotiations that, despite AGMG's best efforts, require the agreement of third-party counterparties whose responsiveness and internal processes are not entirely within AGMG's control.
(d) Commitment to a definitive compliance response. AGMG commits to submitting a detailed and comprehensive compliance response to the CNIL, accompanied by full supporting evidence, no later than 12 April 2024 — two days before the requested extended deadline — thereby providing the Commission with complete visibility into the remediation achieved.
AGMG submits that the grant of this modest extension will enable it to deliver a more complete, more durable, and more comprehensive remediation than would be possible within the original deadline, to the ultimate benefit of the data subjects whose rights the Commission is charged with protecting.
4. Remediation Progress to Date
AGMG wishes to provide the Commission with a detailed account of the remediation progress achieved to date, in order to demonstrate both the seriousness with which AGMG has approached the Formal Notice and the substantial work already completed.
4.1 Engagement of Legal Counsel and Technical Consultants
On 12 January 2024 — within one calendar month of receipt of the Formal Notice — AGMG retained Calderwood & Harkness LLP, a specialist privacy and data security law firm with extensive experience advising multinational media and technology companies on GDPR and ePrivacy compliance, to lead the legal aspects of the remediation programme and to serve as AGMG's legal representative before the CNIL.
On the same date, AGMG retained Thistlewood Consulting Ltd, a cybersecurity and data governance consulting firm based at 9 Worship Street, London EC2A 2BF, United Kingdom, to conduct the technical cookie audit, server-side tracking pixel assessment, and comprehensive data flow mapping under the legal direction of Calderwood & Harkness LLP. Thistlewood Consulting is an ISO 27001-certified firm with particular expertise in adtech ecosystem auditing and consent management platform configuration reviews.
These engagements were established promptly in order to ensure that the remediation programme could commence without delay. AGMG's management team held its first joint working session with Calderwood & Harkness and Thistlewood Consulting on 15 January 2024, at which the scope, methodology, and timeline for the remediation programme were agreed.
4.2 Technical Cookie Audit (Completed)
A comprehensive technical cookie audit was commenced on 22 January 2024 and completed on 16 February 2024. The audit was conducted by Thistlewood Consulting using industry-standard automated scanning tools complemented by manual verification, and was supervised by Calderwood & Harkness in order to ensure that the methodology and scope were consistent with the CNIL's published guidance on cookies and trackers, as well as with the requirements of the ePrivacy Directive and the GDPR.
Critically, the scope of this audit was not limited to aurelius-stream.fr, the single website identified in the complaint. Rather, at AGMG's direction, the audit covered all fourteen (14) of AGMG's European-facing websites, spanning six language markets (English, French, German, Dutch, Spanish, and Italian). Each website was scanned across multiple pages, device types (desktop, mobile web, and tablet), and browser environments (Chrome, Firefox, Safari, and Edge) to ensure comprehensive coverage.
The audit yielded the following principal findings:
(a) A total of three hundred and twelve (312) unique cookies were identified across the fourteen (14) European properties.
(b) Of these, seventy-four (74) cookies were found to be firing before any consent interaction by the user — that is, they were set on page load, prior to the display of or any interaction with the cookie consent banner.
(c) Of the seventy-four (74) cookies firing before consent, thirty-eight (38) were classified as strictly necessary cookies with a legitimate basis for setting without consent (e.g., session management cookies, load-balancing cookies, and security-critical cookies), and accordingly did not present a compliance issue.
(d) The remaining thirty-six (36) cookies were identified as non-compliant. These cookies — which included third-party advertising cookies, audience measurement cookies, and social media tracking cookies — were firing before valid consent had been obtained from the user and lacked any valid legal basis under Article 5(3) of the ePrivacy Directive or Article 6(1)(a) GDPR. This finding confirmed, and indeed expanded upon, the deficiency identified in the Formal Notice with respect to aurelius-stream.fr, demonstrating its prevalence across the broader property portfolio.
The complete cookie audit report was delivered to AGMG management on 20 February 2024 and has been shared with Ms Fontaine-Li (Group DPO) and Mr Redworth (Group General Counsel) for their review and action.
4.3 Server-Side Tracking Pixel Assessment (Completed)
In addition to the cookie audit, Thistlewood Consulting conducted a server-side tracking pixel assessment across all of AGMG's European digital properties. This assessment was designed to identify tracking mechanisms that operate at the server level rather than through browser-based cookies, and which may therefore not be captured by conventional cookie-scanning tools.
The assessment identified nineteen (19) unique server-side tracking pixels deployed across AGMG's European properties. Of these nineteen pixels, twelve (12) were found to be transmitting personal data — including IP addresses, device fingerprints (based on user-agent strings, screen resolution, and installed fonts), and browsing history (including page URLs and referrer information) — to third-party adtech vendors without prior valid consent from the data subject. In several instances, the pixel was configured to fire on every page load regardless of the user's consent status, effectively bypassing the consent management platform entirely.
The technical remediation of these server-side pixels is currently in progress. The remediation involves reconfiguring each pixel to fire only after valid, GDPR-compliant consent has been obtained via the consent management platform, and in certain cases involves the removal of pixels altogether where no valid processing purpose or legal basis can be established. The target completion date for this workstream is 2 April 2024.
4.4 Data Flow Mapping (Completed)
A comprehensive mapping of adtech vendor data flows was commenced on 5 February 2024 and completed on 28 February 2024. This exercise was conducted jointly by Calderwood & Harkness and Thistlewood Consulting, with input from AGMG's internal commercial and technology teams.
The data flow mapping identified twenty-three (23) adtech vendors processing AGMG user data across its European digital properties, encompassing programmatic advertising demand-side platforms, supply-side platforms, data management platforms, analytics providers, audience segmentation services, and cross-device identification providers.
The mapping revealed the following compliance gaps:
(a) Data Processing Agreements. Nine (9) of the twenty-three (23) vendors were found either to have no data processing agreement ("DPA") in place at all, or to have DPAs that were materially deficient and did not meet the minimum requirements of Article 28 GDPR. In particular, several DPAs lacked the mandatory provisions specified in Article 28(3), including provisions relating to the subject-matter and duration of processing, the nature and purpose of processing, the types of personal data and categories of data subjects, and the obligations and rights of AGMG as controller.
(b) Priority vendors for DPA renegotiation. Two vendors have been identified as requiring priority attention due to the volume and sensitivity of the personal data they process on behalf of AGMG:
(i) Pendleton AdTech Solutions Ltd, AGMG's primary programmatic advertising partner, incorporated in Ireland with its registered office in Dublin. Pendleton processes approximately 4.2 billion ad bid requests per month involving AGMG user data, including cookie identifiers, IP addresses, device identifiers, and inferred interest profiles. Pendleton's existing contractual arrangement with AGMG consists of a commercial services agreement executed in 2019 that contains a brief data processing addendum which is materially deficient under Article 28 GDPR, lacking, inter alia, provisions on sub-processor management, audit rights, data breach notification, and international data transfers.
(ii) VoltGraph Analytics GmbH, a cross-device tracking and audience segmentation provider incorporated under German law with its registered office in Hamburg. VoltGraph processes approximately 320 million unique user profiles per year derived from AGMG user data, including deterministic and probabilistic cross-device graphs, behavioural signals, and inferred demographic attributes. VoltGraph's existing DPA was last updated in 2020 and does not reflect the current scope of processing or the requirements of the CNIL's guidance.
(c) Reliance on "legitimate interest" under the IAB TCF. Seven (7) vendors were identified as relying on "legitimate interest" as a legal basis under the IAB Europe Transparency and Consent Framework ("TCF") version 2.2 for processing purposes that, in the view of Calderwood & Harkness and consistent with the CNIL's published guidance, properly require the consent of the data subject. These purposes include, in particular, the creation of advertising profiles and the use of personal data for personalised advertising. AGMG is in the process of reconfiguring its consent management platform to require consent (rather than accept a legitimate interest signal) for these purposes, and is communicating this change to the relevant vendors.
(d) International data transfers. Six (6) vendors were identified as transferring personal data originating from AGMG's European users outside the European Economic Area. Of these, four (4) transfer data to the United States, one (1) transfers data to India, and one (1) transfers data to Singapore. Only two (2) of the six vendors transferring data outside the EEA had executed Standard Contractual Clauses ("SCCs") in compliance with the European Commission's implementing decision of 4 June 2021. The remaining four (4) vendors had no adequate safeguard mechanism in place for their international data transfers, presenting a clear compliance gap under Articles 44–49 GDPR. AGMG is in the process of executing the latest approved SCCs with all six vendors, accompanied by Transfer Impact Assessments as recommended by the European Data Protection Board.
4.5 Dark Pattern Remediation (In Progress)
The technical audit conducted by Thistlewood Consulting confirmed the dark-pattern issues raised in the DRE complaint with respect to aurelius-stream.fr and, importantly, identified the prevalence of similar issues across AGMG's broader European property portfolio. The specific findings were as follows:
(a) Pre-ticked consent boxes were present on six (6) of the fourteen (14) European websites, including aurelius-stream.fr.
(b) Asymmetric button design — with a prominently displayed, brightly coloured "Accept All" button and a significantly less visible "Manage Preferences" option — was present on all fourteen (14) European websites.
(c) No "Reject All" button was offered on eleven (11) of the fourteen (14) European websites. On the remaining three websites, a "Reject All" option existed but was accessible only on a secondary settings layer, not on the first layer of the cookie banner.
(d) Withdrawal of consent required four (4) or more distinct clicks or navigational steps on eight (8) of the fourteen (14) European websites, in contravention of the principle that withdrawal of consent must be as easy as the giving of consent (Article 7(3) GDPR).
(e) All three (3) of AGMG's mobile applications (available on iOS and Android) lacked granular consent controls for the setting of advertising identifiers and the processing of personal data for advertising purposes. Furthermore, the two (2) iOS applications' implementation of Tidewater Industries's App Tracking Transparency ("ATT") framework did not align with GDPR consent requirements: specifically, the ATT prompt was presented after the in-app consent mechanism had already been displayed, creating confusion as to the scope of consent given and potentially resulting in personal data being processed on the basis of an ATT "allow" selection that did not constitute valid GDPR consent.
AGMG's engineering and product teams are actively redesigning the consent interfaces across all European digital properties, working in close collaboration with Calderwood & Harkness LLP and with AGMG's existing consent management platform provider, Brightleaf Consent Technologies EU B.V. ("Brightleaf"), a company incorporated in the Netherlands. Brightleaf's ConsentShield product, which is IAB TCF 2.2 certified and is deployed across all AGMG European properties, is being reconfigured to ensure that:
•  All non-essential cookies and trackers are blocked by default until valid consent is obtained;
•  The consent banner presents equally prominent "Accept All" and "Reject All" buttons on the first layer;
•  All consent checkboxes are unticked by default;
•  Granular, purpose-level consent options are available on the first or second layer of the banner;
•  Consent withdrawal is available at all times through a persistent, easily accessible interface element (a floating "cookie settings" icon) requiring no more than two (2) clicks; and
•  Consent signals are propagated to all server-side tracking pixels and third-party vendor tags via the TCF consent string, ensuring that no non-essential processing occurs absent valid consent.
The target deployment date for the remediated cookie banners across all fourteen (14) European websites is 22 March 2024. The target deployment date for the updated mobile application consent flows across all three (3) applications (including alignment of the iOS ATT prompts with GDPR consent requirements) is 29 March 2024.
4.6 GDPR Gap Analysis (Completed)
A comprehensive GDPR gap analysis memorandum was prepared by Calderwood & Harkness LLP and delivered to AGMG management on 4 March 2024. The memorandum assessed AGMG's European digital properties and associated processing operations against the following provisions of applicable law:
•  GDPR Article 5 (Principles relating to processing of personal data);
•  GDPR Article 6 (Lawfulness of processing);
•  GDPR Article 7 (Conditions for consent);
•  GDPR Articles 13 and 14 (Information to be provided to data subjects);
•  GDPR Article 28 (Processor);
•  GDPR Article 30 (Records of processing activities);
•  GDPR Article 35 (Data protection impact assessment);
•  GDPR Articles 44–49 (Transfers of personal data to third countries or international organisations);
•  United Kingdom Privacy and Electronic Communications (EC Directive) Regulations 2003, Regulation 6 (Privacy and electronic communications); and
•  The French Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (Loi Informatique et Libertés), with particular reference to Article 82 concerning trackers.
Each finding identified in the gap analysis was assessed against a four-tier risk rating (Critical, High, Medium, Low), and a phased remediation roadmap was developed. Each remediation item was assigned to a responsible workstream lead, given a target completion date, and classified by priority. The gap analysis memorandum has been reviewed and approved by AGMG's Group Data Protection Officer and Group General Counsel, and its remediation roadmap has been adopted as the governing framework for the remainder of the compliance programme.
5. Remaining Remediation Workstreams and Proposed Timeline
The following table sets out the remaining remediation workstreams and their respective target completion dates, all of which fall within the requested extension period:
As the foregoing table demonstrates, all remediation workstreams will be completed by 12 April 2024, a full two (2) days before the requested extended deadline of 14 April 2024. This buffer has been deliberately built into the timeline to account for any unforeseen delays in vendor contractual negotiations or technical deployment.
AGMG commits to submitting a detailed compliance response to the CNIL on or before 12 April 2024, demonstrating full remediation of all identified deficiencies. The compliance response will be accompanied by comprehensive supporting evidence, including:
(a) Technical scan results from Thistlewood Consulting confirming that no non-essential cookies or tracking pixels fire prior to the obtaining of valid consent across all European properties;
(b) Screenshots and screen recordings of the compliant consent interfaces as deployed on each of the fourteen (14) websites and three (3) mobile applications, demonstrating compliance with the CNIL's guidance on cookies and dark patterns;
(c) Fully executed Data Processing Agreements with all twenty-three (23) adtech vendors, including Standard Contractual Clauses and Transfer Impact Assessments where applicable;
(d) Updated Data Protection Impact Assessments for all high-risk processing activities identified in the gap analysis;
(e) Updated Records of Processing Activities reflecting the current state of AGMG's European processing operations; and
(f) A summary of the long-term compliance governance measures being implemented, as described in Section 6 below.
6. AGMG's Good Faith and Commitment to Compliance
AGMG wishes to emphasise to the Commission several factors that, it respectfully submits, demonstrate its genuine good faith and deep commitment to data protection compliance.
First, AGMG's remediation programme goes significantly beyond the scope of the specific complaint regarding aurelius-stream.fr. Rather than adopting a narrow approach limited to resolving the identified issues on a single website, AGMG has voluntarily extended its remediation to encompass all fourteen (14) of its European-facing websites and all three (3) of its mobile applications, serving approximately eighty-seven million monthly active users. This decision was taken at Board level and reflects AGMG's conviction that data protection compliance is a systemic, organisation-wide responsibility, not a matter of addressing individual complaints on an ad hoc basis.
Second, AGMG has committed substantial financial and human resources to the remediation programme. This includes the retention of external specialist legal counsel (Calderwood & Harkness LLP) and a dedicated technical consultant (Thistlewood Consulting Ltd), in addition to the significant internal resources dedicated to the programme, including personnel from AGMG's legal, data protection, engineering, product, and commercial teams.
Third, the remediation programme encompasses seven (7) comprehensive and interdependent workstreams:
1.  Consent mechanism redesign — complete overhaul of cookie banners and in-app consent flows to eliminate dark patterns and ensure GDPR-compliant consent across all properties;
2.  Server-side pixel remediation — identification and remediation of all server-side tracking pixels firing without valid consent;
3.  DPA renegotiation — negotiation and execution of GDPR-compliant data processing agreements with all nine (9) vendors identified as having no DPA or a materially deficient DPA;
4.  Vendor audit rights — insertion of contractual audit rights in all vendor DPAs in accordance with Article 28(3)(h) GDPR, enabling AGMG (or its appointed auditors) to conduct and contribute to audits of vendor processing activities;
5.  DPIA updates — preparation and approval of updated Data Protection Impact Assessments for all processing activities assessed as presenting a high risk to the rights and freedoms of data subjects;
6.  ROPA updates — comprehensive updating of AGMG's Records of Processing Activities to reflect the current state of processing operations across all European properties; and
7.  Regulatory response preparation — preparation of a complete compliance response to the CNIL, accompanied by full supporting documentation and evidence.
Fourth, the remediation programme is being personally overseen at the most senior levels of AGMG's organisation. AGMG's Group Data Protection Officer, Ms Margaux Fontaine-Li, chairs weekly programme steering committee meetings and has direct reporting access to the Board of Directors through the Audit and Risk Committee on the progress of the remediation. AGMG's Chief Technology Officer, Mr Leander Voss, is personally overseeing the technical implementation workstreams and has committed dedicated engineering resources to the programme.
Fifth, and importantly, AGMG is not treating this remediation as a one-time exercise. AGMG is developing and implementing a long-term compliance governance framework designed to prevent the recurrence of the types of deficiencies identified in the Formal Notice. This framework includes, among other measures:
•  Quarterly automated cookie scans of all European digital properties, conducted by Thistlewood Consulting or an equivalent specialist provider, with results reported to the Group DPO;
•  Annual reviews of all Data Processing Agreements with adtech and data processing vendors, to ensure continued compliance with Article 28 GDPR and applicable guidance;
•  Biannual refreshes of Data Protection Impact Assessments for all high-risk processing activities, with any material changes to processing triggering an ad hoc DPIA review;
•  Quarterly CMP configuration audits to verify that the consent management platform is correctly configured and that consent signals are being accurately propagated to all vendor tags and pixels;
•  Mandatory privacy training for all members of AGMG's digital media, product, and engineering teams, to be conducted annually and upon onboarding of new team members, covering GDPR consent requirements, ePrivacy obligations, dark pattern avoidance, and vendor management best practices; and
•  Establishment of a Privacy Engineering function within AGMG's technology division, responsible for embedding privacy-by-design and privacy-by-default principles into the development lifecycle of all digital products and features.
AGMG is confident that these measures, taken together, will establish a robust and sustainable compliance infrastructure that goes well beyond the minimum requirements of the applicable legal framework and reflects AGMG's genuine commitment to respecting the privacy and data protection rights of its users.
7. Conclusion and Request
In light of the substantial remediation progress already achieved, as detailed in Section 4 above, and the comprehensive, group-wide scope of the remediation programme voluntarily undertaken by AGMG — extending well beyond the single website identified in the complaint to encompass all fourteen (14) European websites and three (3) mobile applications — AGMG respectfully requests that the Commission grant a thirty (30) day extension of the compliance deadline established in the Formal Notice, from 14 March 2024 to 14 April 2024.
AGMG commits to submitting a full and detailed compliance response to the Commission, accompanied by comprehensive supporting evidence as described in Section 5 above, no later than 12 April 2024.
AGMG remains entirely at the Commission's disposal for any questions, requests for clarification, or requests for additional information that the Commission may have in connection with this matter or the remediation programme. Should the Commission wish to discuss any aspect of this letter or the remediation programme, the undersigned is available at the Commission's convenience.
AGMG respectfully requests that the Commission acknowledge receipt of this letter and confirm its decision regarding the requested extension at its earliest convenience. Any such acknowledgment or confirmation may be directed to the undersigned at the contact details provided in Section 1 above.
We thank the Commission for its consideration of this request and for its continued dedication to the protection of the fundamental rights and freedoms of data subjects.
Yours faithfully,
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security Practice Calderwood & Harkness LLP One Finsbury Square, London EC2A 1AE, United Kingdom
On behalf of Aurelius Global Media Group PLC
cc:
Sanjay Redworth, Group General Counsel & Company Secretary, Aurelius Global Media Group PLC, 140 Threadneedle Row, London EC2R 8AH, United Kingdom
Margaux Fontaine-Li, Group Data Protection Officer, Aurelius Global Media Group PLC, 140 Threadneedle Row, London EC2R 8AH, United Kingdom
Enclosures:
Annex 1: Power of Attorney — Aurelius Global Media Group PLC authorising Calderwood & Harkness LLP to act on its behalf before the Commission nationale de l'informatique et des libertés (CNIL) in connection with Formal Notice MED-2023-097 and Complaint PLT-2023-FR-04821 (executed under seal by Sanjay Redworth, Group General Counsel & Company Secretary, on behalf of the Board of Directors of Aurelius Global Media Group PLC, dated 12 January 2024).
Annex 2: Summary Timeline of Remediation Milestones (consolidated table setting out all completed and remaining milestones from Sections 4 and 5 of this letter, with completion status and responsible workstream lead).
ANNEX 2
SUMMARY TIMELINE OF REMEDIATION MILESTONES
Aurelius Global Media Group PLC — Formal Notice MED-2023-097
End of Annex 2
Workstream | Target Completion Date
Remediated cookie banners deployed across all 14 European websites | 22 March 2024
Updated mobile application consent flows deployed across all 3 applications | 29 March 2024
Server-side tracking pixel remediation completed across all properties | 2 April 2024
Execution of revised Data Processing Agreement with Pendleton AdTech Solutions Ltd (including SCCs and TIA) | 5 April 2024
Execution of revised Data Processing Agreement with VoltGraph Analytics GmbH (including SCCs and TIA) | 8 April 2024
Execution of remaining 7 vendor DPAs (with SCCs and Transfer Impact Assessments where required for extra-EEA transfers) | 10 April 2024
Updated Data Protection Impact Assessments finalised and approved | 10 April 2024
Updated Records of Processing Activities completed | 10 April 2024
Submission of comprehensive CNIL compliance response with full supporting evidence | 12 April 2024
No. | Milestone | Date | Status
1 | Retention of Calderwood & Harkness LLP and Thistlewood Consulting Ltd | 12 January 2024 | Completed
2 | First joint working session — scope, methodology, and timeline agreed | 15 January 2024 | Completed
3 | Comprehensive technical cookie audit commenced | 22 January 2024 | Completed
4 | Server-side tracking pixel assessment commenced | 22 January 2024 | Completed
5 | Adtech vendor data flow mapping commenced | 5 February 2024 | Completed
6 | Technical cookie audit completed — 312 cookies identified, 36 non-compliant | 16 February 2024 | Completed
7 | Cookie audit report delivered to AGMG management | 20 February 2024 | Completed
8 | Server-side tracking pixel assessment completed — 19 pixels identified, 12 non-compliant | 23 February 2024 | Completed
9 | Adtech vendor data flow mapping completed — 23 vendors, 9 deficient DPAs | 28 February 2024 | Completed
10 | GDPR gap analysis memorandum delivered to AGMG management | 4 March 2024 | Completed
11 | Submission of extension request to CNIL | 11 March 2024 | Completed
12 | Remediated cookie banners deployed across all 14 European websites | 22 March 2024 | In Progress
13 | Updated mobile application consent flows deployed across all 3 applications | 29 March 2024 | In Progress
14 | Server-side tracking pixel remediation completed across all properties | 2 April 2024 | In Progress
15 | Execution of revised DPA with Pendleton AdTech Solutions Ltd | 5 April 2024 | In Progress
16 | Execution of revised DPA with VoltGraph Analytics GmbH | 8 April 2024 | In Progress
17 | Execution of remaining 7 vendor DPAs (with SCCs and TIAs where applicable) | 10 April 2024 | In Progress
18 | Updated DPIAs finalised and approved | 10 April 2024 | In Progress
19 | Updated Records of Processing Activities completed | 10 April 2024 | In Progress
20 | Submission of comprehensive CNIL compliance response with full supporting evidence | 12 April 2024 | Pending

CONFIDENTIAL — REGULATORY CORRESPONDENCE

CALDERWOOD & HARKNESS LLP

ANNEX 2

SUMMARY TIMELINE OF REMEDIATION MILESTONES

Record

Parties

Dates

Amounts