PRIVATE & CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Solicitors & International Counsel
One Finsbury Square London EC2A 1AE United Kingdom
Telephone: +44 (0)20 7496 8200 Facsimile: +44 (0)20 7496 8201 www.calderwoodharkness.com
C&H Matter No. 1017-00008
15 April 2024
Information Commissioner's Office Enforcement Division Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
By Email and First Class Post
Reference: ICO/ENF/2023/LTR-11084
Re: Response to Informal Inquiry dated 22 December 2023 — Server-Side Tracking Pixels and Cookie Consent Compliance on aureliusnews.co.uk and shopaurelia.co.uk
Our Client: Aurelius Global Media Group PLC (Companies House No. 08741562)
Dear Sir or Madam,
1. Introduction and Purpose of Letter
Calderwood & Harkness LLP ("C&H" or "we") writes on behalf of our client, Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated in England and Wales under Companies House number 08741562, with its registered office at 140 Threadneedle Row, London EC2R 8AH. This letter constitutes AGMG's formal and comprehensive response to the informal inquiry letter issued by the Information Commissioner's Office (the "ICO" or the "Commissioner") on 22 December 2023, bearing reference ICO/ENF/2023/LTR-11084 (the "Inquiry").
As the Commissioner is aware, the Inquiry concerned the use of server-side tracking pixels on two UK-facing websites operated by AGMG — namely aureliusnews.co.uk and shopaurelia.co.uk — and raised questions regarding the adequacy of consent mechanisms deployed on those properties for the purposes of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), as well as the requirements for freely given, specific, informed, and unambiguous consent under the UK General Data Protection Regulation ("UK GDPR") as supplemented by the Data Protection Act 2018 ("DPA 2018").
The responsible partner for this engagement is Rachel Bernstein, Partner in C&H's Privacy & Data Security Practice. The engagement team also includes Kevin Ostrowski (Partner), Priscilla Wynn (Senior Associate), and Alan Burke (Associate). The engagement was formally opened and the engagement letter executed on 12 January 2024.
AGMG has treated the Commissioner's Inquiry with the utmost seriousness and has undertaken a comprehensive, pan-European remediation programme that extends well beyond the two UK properties identified in the Inquiry. The remediation programme has been completed in its entirety and full compliance with PECR Regulation 6 and the UK GDPR has been achieved across all of AGMG's UK and European digital properties. The details of the investigation, findings, and remediation actions are set out at length in this letter.
On the basis of the comprehensive remediation described herein, and the supporting evidence enclosed with this submission, AGMG respectfully requests that the Commissioner close Inquiry ICO/ENF/2023/LTR-11084 and confirm that no further enforcement action will be taken.
2. Background to AGMG and Its UK Digital Properties
By way of background, AGMG is a UK-headquartered public media, entertainment streaming, and e-commerce conglomerate listed on the Main Market of the London Stock Exchange under the ticker symbol LSE: AGMG. As of January 2024, AGMG's market capitalisation was approximately £3.8 billion. AGMG's annual revenue for the financial year ended 31 December 2023 was approximately £1.42 billion, of which approximately £612 million (approximately 43%) was generated from digital advertising and e-commerce operations serving audiences within the European Union and European Economic Area. The Group employs approximately 6,200 staff across its European offices.
AGMG operates a diversified portfolio of digital properties serving audiences across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. In total, AGMG operates 14 European-facing websites and 3 mobile applications (available on both iOS and Android platforms), serving approximately 87 million monthly active users across all EU/EEA properties as measured by the Group's first-party analytics in Q4 2023. The Group's digital properties span news and media publishing, entertainment and video streaming, and e-commerce.
The two websites that are the subject of the Commissioner's Inquiry are:
• aureliusnews.co.uk — a UK-focused digital news and media platform offering editorially curated news content, opinion, analysis, and multimedia features to approximately 18.5 million monthly active UK users; and
• shopaurelia.co.uk — a UK-focused e-commerce platform offering consumer goods across fashion, lifestyle, electronics, and home categories to approximately 6.2 million monthly active UK users.
Both websites are operated directly by AGMG as the data controller and are served from infrastructure located within the United Kingdom and the European Economic Area.
The following individuals hold key governance and management roles within AGMG relevant to this Inquiry:
Ms Fontaine-Li, as Group Data Protection Officer, is based in AGMG's London headquarters and has been closely involved in the remediation programme described in this letter. Mr Redworth, as Group General Counsel, has provided executive oversight of the engagement with C&H and the regulatory response process.
3. Summary of the ICO Inquiry
On 22 December 2023, the ICO issued informal inquiry letter reference ICO/ENF/2023/LTR-11084, addressed to AGMG at its registered office. The Inquiry raised three principal areas of concern, which we summarise as follows:
(a) The deployment of server-side tracking pixels on aureliusnews.co.uk and shopaurelia.co.uk that were identified as transmitting personal data — including, in particular, IP addresses, device fingerprints, and browsing history — to third-party advertising technology ("adtech") vendors. The Commissioner expressed concern that such transmissions were occurring without a valid legal basis under PECR or the UK GDPR.
(b) The adequacy of PECR Regulation 6 compliant consent for analytics cookies deployed on those two UK properties. The Commissioner noted that information received by the ICO suggested that certain non-essential cookies were being set on users' terminal equipment prior to any affirmative consent being obtained from the user.
(c) Whether the consent mechanisms deployed on aureliusnews.co.uk and shopaurelia.co.uk — in particular, the design and functionality of the cookie consent banners — met the requirements for freely given, specific, informed, and unambiguous consent as set out in the UK GDPR (Articles 4(11), 6(1)(a), and 7) and as interpreted in the Commissioner's published guidance.
We note for the Commissioner's information that the Inquiry arose in parallel with, but independently of, a complaint filed with the Commission Nationale de l'Informatique et des Libertés ("CNIL") by Digitale Rechte Europa e.V., a Berlin-based digital rights advocacy organisation, under CNIL reference PLT-2023-FR-04821, filed on 8 November 2023. That complaint concerned AGMG's French-language entertainment streaming platform, aurelius-stream.fr, and resulted in CNIL formal notice MED-2023-097, dated 14 December 2023. The coordination between AGMG's response to the CNIL proceedings and the present Inquiry is addressed further in Section 10 below. The two proceedings concern different AGMG digital properties in different jurisdictions, but the underlying remediation programme undertaken by AGMG was pan-European in scope and addressed all 14 European websites and 3 mobile applications simultaneously.
AGMG acknowledges that the maximum fine exposure under the UK GDPR, as applied by the DPA 2018, for infringements of the kind identified in the Inquiry is up to £17.5 million or 4% of total annual worldwide turnover, whichever is higher. AGMG has treated the Inquiry with commensurate gravity and has devoted substantial resources to ensuring full and sustained compliance.
4. Scope of the Remediation Programme
Upon receipt of the ICO's Inquiry on 27 December 2023, AGMG's Group General Counsel, Mr Redworth, and Group DPO, Ms Fontaine-Li, convened an internal assessment meeting on 3 January 2024. Following that assessment, AGMG took the decision to retain external legal counsel and to commission a full-scope technical audit and remediation programme that would encompass not only the two UK properties identified in the Inquiry but all of AGMG's European digital estate.
Retention of Calderwood & Harkness LLP. On 12 January 2024, AGMG formally engaged C&H pursuant to a written engagement letter to provide legal advice and strategic direction in connection with both the ICO Inquiry and the CNIL proceedings, and to oversee a comprehensive GDPR and PECR remediation programme across all 14 European websites and 3 mobile applications. The decision to extend the scope of the remediation beyond the two UK properties was taken proactively by AGMG in order to ensure a consistent and robust compliance posture across the Group's entire European digital footprint.
Retention of Thistlewood Consulting Ltd. In addition, AGMG retained Thistlewood Consulting Ltd ("Thistlewood"), a specialist cybersecurity and data governance consulting firm with offices at 9 Worship Street, London EC2A 2BF, to perform the technical cookie audit, including automated and manual scanning, cookie tagging and classification, and comprehensive data-flow mapping across all 14 European websites and 3 mobile applications. Thistlewood's engagement was undertaken under C&H's direction and supervision and is subject to common-interest privilege. The Thistlewood engagement was led by Marcus Drayford, Principal Consultant, and the agreed fixed fee for the technical audit and data-flow mapping workstream was £145,000.
The remediation programme encompassed seven discrete but interrelated workstreams, each of which is described in detail in the sections that follow:
1. Consent mechanism redesign — redesign and redeployment of cookie consent banners on all 14 European websites and consent flows on all 3 mobile applications to ensure full PECR and UK GDPR compliance;
2. Server-side pixel remediation — identification, review, and remediation (removal or consent-gating) of all non-compliant server-side tracking pixels across all properties;
3. DPA renegotiation with non-compliant vendors — execution or renegotiation of data processing agreements with all adtech vendors that were receiving AGMG user personal data without compliant contractual arrangements in place;
4. Vendor audit rights — ensuring all vendor contracts include audit and inspection rights as required by Article 28(3)(h) of the UK GDPR;
5. DPIA updates — updating the Data Protection Impact Assessment for AGMG's programmatic advertising processing activities to reflect the remediated data flows and risk profile;
6. Records of Processing Activities (ROPA) updates — updating AGMG's Article 30 records to reflect all remediated processing activities, corrected legal bases, and new vendor relationships; and
7. Regulatory responses — preparation and submission of comprehensive compliance responses to both the CNIL (in respect of formal notice MED-2023-097) and the ICO (in respect of the present Inquiry).
The timeline for completion of each workstream is set out in the relevant sections below. We confirm that all seven workstreams have been completed as of the date of this letter.
5. Technical Cookie Audit Findings — UK Properties
5.1 Audit Methodology and Period
The technical cookie audit was conducted by Thistlewood Consulting over a period of approximately four weeks, commencing on 22 January 2024 and concluding on 16 February 2024. The audit methodology comprised the following elements:
(a) Automated scanning — Thistlewood deployed proprietary automated scanning tools to crawl all 14 European websites, cataloguing every cookie, pixel, tag, and similar tracking technology set on or accessed from users' terminal equipment upon page load and during subsequent user interactions. Scanning was performed across multiple simulated user journeys, browser configurations, and geographic access points (including UK, French, German, Dutch, Spanish, and Italian IP addresses) to capture the full range of cookies and tracking technologies deployed.
(b) Manual verification — In addition to automated scanning, Thistlewood's consultants conducted manual testing of each website's consent banner to verify the behaviour of non-essential cookies and server-side pixels before and after user consent interactions, including acceptance, rejection, granular selection, and withdrawal of consent.
(c) Data-flow mapping — Thistlewood mapped all outbound data flows from each website and application to identify the recipients of personal data transmitted via cookies, server-side pixels, and other tracking technologies, and to classify each recipient by jurisdiction, contractual relationship, and processing purpose.
The cookie audit report was delivered to AGMG on 20 February 2024. The data-flow mapping was completed and delivered on 28 February 2024. Both deliverables were prepared under C&H's direction and are subject to common-interest privilege. The findings relevant to aureliusnews.co.uk and shopaurelia.co.uk are summarised below.
5.2 Overall Cookie Inventory
Across all 14 European websites, the technical audit identified a total of 312 unique cookies deployed by or on behalf of AGMG. These cookies were classified by function into the following categories: strictly necessary, performance and analytics, functional, targeting and advertising, and social media.
Of the 312 unique cookies identified, 74 cookies (23.7%) were found to be firing before any user consent interaction was recorded — that is, they were set on the user's terminal equipment upon initial page load, prior to the user interacting with the cookie consent banner in any way.
Of those 74 pre-consent cookies:
• 38 cookies were classified as strictly necessary within the meaning of the PECR Regulation 6(4) exception — being cookies that were strictly necessary for the provision of an information society service explicitly requested by the user (for example, session management cookies, load-balancing cookies, and authentication state cookies). These cookies were legitimately deployed without prior consent.
• 36 cookies were classified as non-essential — comprising performance and analytics cookies, targeting and advertising cookies, and social media integration cookies. These 36 cookies were deployed on users' terminal equipment without valid legal basis, as they did not qualify for the Regulation 6(4) exception and were set prior to any affirmative consent being recorded.
The finding that 36 non-essential cookies were firing prior to consent across AGMG's European estate was a significant compliance deficiency and formed a core element of the remediation programme.
5.3 Server-Side Tracking Pixels on UK Sites
The audit identified 19 unique server-side tracking pixels deployed across all AGMG European properties. Server-side tracking pixels differ from conventional client-side cookies in that they are initiated and processed on the server side, meaning that personal data is transmitted from AGMG's servers directly to third-party vendor servers without the involvement of the user's browser in setting a cookie. However, such pixels nonetheless involve the processing of personal data originating from the user's terminal equipment and are therefore subject to PECR and UK GDPR requirements.
Of the 19 server-side tracking pixels identified:
• 12 pixels were found to be transmitting personal data — specifically including IP addresses, device fingerprints (comprising browser type, operating system, screen resolution, and installed plugins), and browsing history (comprising page URLs visited, referrer URLs, and timestamps) — to third-party adtech vendors without valid, affirmative consent having been obtained from the relevant users. These 12 pixels were firing on page load, irrespective of whether the user had interacted with the consent banner, and the consent management platform was not configured to gate their operation on consent.
• 7 pixels were found to be compliant — either because they were strictly necessary for the delivery of the requested service, or because they were properly gated on consent through the CMP configuration.
Both aureliusnews.co.uk and shopaurelia.co.uk were among the AGMG properties deploying non-compliant server-side tracking pixels. Specifically, aureliusnews.co.uk was deploying 5 of the 12 non-compliant pixels, and shopaurelia.co.uk was deploying 4 of the 12 non-compliant pixels (with certain pixels common to both sites).
Personal data transmitted via these non-compliant pixels was received by third-party adtech vendors including, in particular:
• Pendleton AdTech Solutions Ltd — an Irish-incorporated programmatic advertising company with its registered office at 22 Grand Canal Dock, Block 4, Dublin D02 HW94, Ireland (CRO No. 614823); and
• VoltGraph Analytics GmbH — a German-incorporated audience analytics company with its registered office at Große Elbstraße 44, 22767 Hamburg, Germany (HRB 159742),
among other vendors identified in the data-flow mapping.
5.4 Third-Party Vendors Receiving Data Without Consent
The data-flow mapping exercise identified a total of 23 adtech vendors processing AGMG user personal data across all European properties, either as data processors (acting on AGMG's documented instructions) or, in certain cases, as independent controllers or joint controllers.
Of those 23 vendors, 9 vendors (39.1%) were found to be receiving personal data from AGMG's digital properties without valid consent having been obtained from users. This was a consequence of both the pre-consent firing of non-essential cookies and server-side tracking pixels, and the dark pattern design deficiencies described in Section 5.5 below, which rendered any ostensible consent invalid.
Of the 9 non-compliant vendors, 7 vendors — including Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH — were found to be improperly relying on "legitimate interest" as their declared legal basis under the IAB Transparency and Consent Framework (TCF) for processing purposes that, under ICO and CNIL guidance, require consent. Specifically, these vendors had registered their purposes under TCF Purpose IDs 1 (Store and/or access information on a device), 3 (Create profiles for personalised advertising), and 4 (Use profiles to select personalised advertising) as legitimate interest purposes, rather than as consent purposes. This is inconsistent with the Commissioner's published guidance, which confirms that the storage of information on, or access to information stored in, a user's terminal equipment for advertising purposes requires PECR Regulation 6(2) consent, and that legitimate interest is not an available legal basis for such processing.
5.5 Dark Pattern Findings (UK Sites)
In addition to the technical findings concerning pre-consent cookie firing and server-side pixel behaviour, the audit identified a number of dark pattern design elements in the cookie consent banners deployed on AGMG's websites that undermined the validity of any consent that was ostensibly obtained. These findings applied across the European estate and were present on both aureliusnews.co.uk and shopaurelia.co.uk. The specific dark pattern elements identified were as follows:
(a) Pre-ticked consent boxes. On 6 of 14 European websites, including both UK sites, the cookie consent banner presented users with pre-ticked checkboxes for non-essential cookie categories (including "Analytics" and "Advertising" categories). Pre-ticked boxes do not constitute a valid expression of consent, as they represent an opt-out rather than an opt-in model.
(b) Asymmetric button design. On all 14 European websites, the "Accept All" button was rendered in a visually prominent colour (typically a high-contrast green or blue) and larger font size, while the "Manage Preferences" or "Settings" button was rendered in a subdued colour (grey or light text on a light background) and smaller font size. This asymmetric design steered users towards acceptance and did not present a genuine, balanced choice.
(c) Absence of "Reject All" option. On 11 of 14 European websites, including both UK sites, there was no "Reject All" button on the initial consent banner layer. Users who wished to decline non-essential cookies were required to navigate to a secondary "Manage Preferences" screen, locate individual toggles, deselect pre-ticked categories, and then confirm their selection — a process significantly more burdensome than simply pressing "Accept All".
(d) Multi-click consent withdrawal. On 8 of 14 European websites, including aureliusnews.co.uk, the process of withdrawing previously given consent required 4 or more clicks from any page on the site. The consent withdrawal mechanism was accessible only via the privacy policy footer link, which led to a separate page, from which the user had to navigate to the cookie settings panel, locate the relevant toggles, adjust them, and confirm the changes. This did not meet the requirement that it be as easy to withdraw consent as to give it.
These design elements, individually and in combination, did not meet the standard for freely given, specific, informed, and unambiguous consent under Articles 4(11), 6(1)(a), and 7 of the UK GDPR. They also failed to satisfy the requirements of PECR Regulation 6(2), which requires that consent be obtained before non-essential cookies are stored on or accessed from users' terminal equipment.
5.6 Consent Management Platform
AGMG deploys the "ConsentShield" consent management platform ("CMP"), which is provided by Brightleaf Consent Technologies Inc., a company incorporated in the United States with its principal place of business at 2200 Market Street, Suite 800, Philadelphia, PA 19103. Brightleaf Consent Technologies maintains an EU establishment through its subsidiary, Brightleaf Consent Technologies EU B.V., registered at Herengracht 520, 1017 CC Amsterdam, the Netherlands (Kamer van Koophandel No. 81294503). The ConsentShield CMP is IAB TCF 2.2 certified and is used by a significant number of major European publishers and digital platforms. AGMG's annual licence fee for the ConsentShield CMP is €385,000. The CEO of Brightleaf is Martin Jessup, and the VP EMEA responsible for the AGMG account is Katarina van Hoorn.
It is important to note that the ConsentShield CMP itself is technically capable of fully compliant operation. The compliance deficiencies identified in the audit arose not from any inherent limitation in the CMP's functionality but from the manner in which the CMP had been configured by AGMG's in-house engineering team. Specifically, the CMP had been configured to permit non-essential cookies and server-side tracking pixels to fire before the consent signal was recorded and processed, and the banner design parameters (button colour, size, placement, and default toggle states) had been set in a manner that produced the dark pattern elements described above. The remediation actions described in Section 7 below included a comprehensive reconfiguration of the ConsentShield CMP.
6. Legal Analysis — PECR Regulation 6 and UK GDPR Compliance
6.1 PECR Regulation 6 — Storage of and Access to Information
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") transposes Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) into UK law. Regulation 6(1) provides that a person shall not store or gain access to information stored in the terminal equipment of a subscriber or user unless the requirements of Regulation 6(2) are met.
Regulation 6(2) sets out two cumulative requirements:
(a) the subscriber or user of that terminal equipment is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
(b) the subscriber or user of that terminal equipment has given their consent.
The consent referred to in Regulation 6(2)(b) is to be interpreted in accordance with the UK GDPR, meaning that it must be freely given, specific, informed, and constitute an unambiguous indication of the data subject's wishes by means of a statement or a clear affirmative action (Article 4(11) UK GDPR).
The sole exception is provided by Regulation 6(4), which permits the storage of, or access to, information in the user's terminal equipment where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user. This exception applies, for example, to session cookies, authentication cookies, and load-balancing cookies that are technically essential for the website to function as requested. It does not extend to analytics cookies, advertising or targeting cookies, or social media integration cookies.
In the present case, the findings of the technical cookie audit establish the following:
(i) 36 non-essential cookies were deploying on users' terminal equipment across AGMG's European properties — including on aureliusnews.co.uk and shopaurelia.co.uk — before any affirmative consent was obtained from the user. These cookies were performance, analytics, targeting, and advertising cookies that did not qualify for the Regulation 6(4) strictly necessary exception. Their deployment without prior consent constituted a breach of PECR Regulation 6.
(ii) 12 server-side tracking pixels transmitted personal data (including IP addresses, device fingerprints, and browsing history) from AGMG's servers to third-party adtech vendors without valid consent. While the server-side pixel mechanism differs technically from conventional client-side cookie placement, it nonetheless involves the access to information stored in, or generated by, the user's terminal equipment and its onward transmission to third parties for advertising and analytics purposes. To the extent that the operation of such pixels involves the storage of or access to information in the user's terminal equipment, they fall within the scope of Regulation 6 and require Regulation 6(2) consent. Even where the applicability of Regulation 6 to a particular server-side pixel might be debated on technical grounds, the processing of the personal data transmitted via such pixels requires a valid legal basis under the UK GDPR, which in the circumstances (processing for advertising and analytics purposes) is consent.
(iii) The dark pattern design elements identified in the consent banners — including pre-ticked consent boxes, asymmetric button design, the absence of a "Reject All" option, and multi-click consent withdrawal processes — meant that any consent ostensibly obtained from users was not freely given, not unambiguous, and did not constitute a clear affirmative action. Such consent was therefore invalid for the purposes of both PECR Regulation 6(2)(b) and the UK GDPR.
AGMG acknowledges that the state of affairs prior to remediation was non-compliant with PECR Regulation 6 in the respects set out above.
6.2 UK GDPR — Consent Requirements
Under the UK GDPR, consent is defined at Article 4(11) as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." Where consent is relied upon as the legal basis for processing under Article 6(1)(a), the controller must be able to demonstrate that the data subject has consented (Article 7(1)), and the data subject must have the right to withdraw consent at any time, with withdrawal being as easy as giving consent (Article 7(3)).
The pre-remediation state of AGMG's consent mechanisms on aureliusnews.co.uk and shopaurelia.co.uk failed to meet these requirements in the following respects:
(a) Pre-ticked boxes. The use of pre-ticked consent boxes for non-essential cookie categories does not constitute a clear affirmative action by the data subject. This position is consistent with the judgment of the Court of Justice of the European Union in Planet49 GmbH (Case C-673/17, ECLI:EU:C:2019:801), which, while a CJEU judgment, has been adopted as persuasive authority in the UK and is reflected in the ICO's published guidance on the use of cookies and similar technologies.
(b) Asymmetric button design. The disparity in visual prominence between the "Accept All" button and the "Manage Preferences" or "Settings" button created a nudge effect that steered users towards acceptance. Consent obtained in such circumstances is not freely given, as the design of the interface does not present the user with a genuine and balanced choice.
(c) Multi-click withdrawal. Requiring 4 or more clicks to withdraw consent, compared to a single click to accept all cookies, contravenes the principle in Article 7(3) that it must be as easy to withdraw consent as to give it.
(d) Transparency deficiencies. The cookie consent banners on aureliusnews.co.uk and shopaurelia.co.uk did not provide users with complete and accurate information about the identities of all third-party vendors receiving data via server-side tracking pixels, nor about the specific purposes for which data was transmitted to those vendors. This failed to meet the transparency requirements of UK GDPR Articles 13 and 14 and the "clear and comprehensive information" requirement of PECR Regulation 6(2)(a).
AGMG acknowledges these deficiencies and confirms that all have been fully remediated, as described in Section 7 below.
7. Remediation Actions Completed
7.1 Consent Mechanism Redesign
The redesign and redeployment of cookie consent banners and mobile application consent flows was completed across all AGMG European digital properties within the following timeline:
• All 14 European websites — consent banners redesigned and redeployed by 22 March 2024, including aureliusnews.co.uk and shopaurelia.co.uk; and
• All 3 mobile applications — consent flows updated and redeployed to app stores by 29 March 2024.
The redesign was conducted by AGMG's in-house digital engineering team under the direction and supervision of C&H and in consultation with Thistlewood Consulting. The key changes implemented are as follows:
(a) "Reject All" button with equal visual prominence. A "Reject All" button has been implemented on the first layer of the cookie consent banner on all 14 European websites. The "Reject All" button is rendered with the same size, font weight, colour prominence, and placement as the "Accept All" button, ensuring that users are presented with a symmetric and balanced choice on first interaction with the banner. This addresses the Commissioner's guidance on the design of consent interfaces.
(b) Removal of pre-ticked consent boxes. All pre-ticked consent checkboxes and toggles have been removed across all properties. All consent toggles now default to the "off" (i.e., non-consenting) position, requiring the user to take a clear affirmative action to enable each category of non-essential processing.
(c) Granular purpose-level consent toggles. Users are presented with granular, purpose-level consent toggles that allow them to select individual processing purposes — including "Performance and Analytics", "Targeting and Advertising", "Social Media Integration", and "Functional" — rather than being presented only with an all-or-nothing choice. Each purpose toggle is accompanied by a clear and concise description of the processing activities within that category and a link to the full list of vendors associated with each purpose.
(d) Two-click consent withdrawal. Consent withdrawal is now achievable in no more than 2 clicks from any page on any of the 14 European websites. A persistent, clearly labelled "Cookie Preferences" icon is displayed in the bottom-left corner of every page. One click on this icon opens the consent management panel, and one further click on the "Reject All" or individual toggle buttons completes the withdrawal. This satisfies the Article 7(3) requirement that withdrawal of consent be as easy as giving it.
(e) Consent-gated firing of non-essential technologies. The Brightleaf ConsentShield CMP has been reconfigured so that no non-essential cookies or server-side tracking pixels fire before affirmative consent is recorded via the CMP. The CMP's tag management integration now operates on a strict consent-gated basis, with all non-essential tags blocked by default and released only upon receipt of a valid, granular consent signal from the user.
(f) Updated consent banner copy. The text of the consent banner on all 14 websites has been substantially rewritten in English (and in French, German, Dutch, Spanish, and Italian for the respective local-language properties) to provide clear and comprehensive information about the purposes of cookie use, the identities of all third-party vendors receiving data, the categories of data processed, and the destinations of any international data transfers. The banner text has been drafted in plain, non-technical language and has been reviewed by C&H for compliance with UK GDPR Articles 12, 13, and 14 and PECR Regulation 6(2)(a).
(g) ATT alignment on iOS applications. For the 2 iOS mobile applications within AGMG's European portfolio, the Tidewater Industries App Tracking Transparency ("ATT") prompt has been aligned with UK GDPR consent requirements. The ATT prompt is presented before any tracking commences, and the ATT consent signal is synchronised with the Brightleaf ConsentShield CMP so that tracking is permitted only where the user has provided affirmative consent through both the ATT dialogue and the CMP.
Screenshots of the redesigned cookie banners on aureliusnews.co.uk and shopaurelia.co.uk, demonstrating the compliant layout including symmetric button design, "Reject All" functionality, default-off toggles, and the two-click consent withdrawal mechanism, are enclosed as Enclosure 2.
7.2 Server-Side Pixel Remediation
The server-side pixel remediation was completed on 2 April 2024. All 12 non-compliant server-side tracking pixels that had been transmitting personal data to third-party adtech vendors without valid consent have been addressed as follows:
(a) Removal. Where no legitimate processing purpose existed for a given pixel — or where the commercial relationship with the receiving vendor had been terminated or was not material to AGMG's operations — the pixel was removed entirely from the relevant website's server-side code. A total of 4 pixels were removed under this approach.
(b) Consent-gated reconfiguration. Where a legitimate processing purpose existed and the commercial relationship with the receiving vendor was ongoing and material, the pixel was reconfigured to fire only after valid, affirmative consent is recorded via the Brightleaf ConsentShield CMP's tag management integration. A total of 8 pixels were reconfigured under this approach. The reconfiguration was implemented by AGMG's engineering team and verified by Thistlewood Consulting.
On aureliusnews.co.uk and shopaurelia.co.uk specifically, all server-side tracking pixels now operate on a consent-gated basis. No personal data is transmitted from AGMG's servers to any third-party vendor via a server-side pixel prior to the user providing affirmative consent through the CMP.
Post-remediation verification scans were conducted by Thistlewood Consulting between 3 April 2024 and 8 April 2024. These verification scans confirmed that:
• No non-essential cookies are set on users' terminal equipment prior to affirmative consent on either aureliusnews.co.uk or shopaurelia.co.uk;
• No personal data is transmitted via server-side pixels to any third party prior to user consent on either UK site; and
• The ConsentShield CMP correctly blocks all non-essential tags and pixels in the default (pre-consent) state and releases them only upon receipt of a valid, purpose-specific consent signal.
The technical verification scan reports are enclosed as Enclosure 1.
7.3 Vendor Data Processing Agreements
AGMG has executed or renegotiated Data Processing Agreements ("DPAs") with all 9 previously non-compliant vendors. All DPAs were fully executed by 10 April 2024. The renegotiation process was led by C&H in coordination with AGMG's Legal and Procurement teams. The key DPAs are summarised as follows:
Pendleton AdTech Solutions Ltd
The DPA with Pendleton AdTech Solutions Ltd ("Pendleton") was executed on 5 April 2024. It was signed on behalf of AGMG by Sanjay Redworth, Group General Counsel & Company Secretary, and on behalf of Pendleton by Conor Rafferty, Chief Executive Officer. The negotiation was conducted opposite Aoife Brennan of Dalrymple Kearney & Co., Solicitors, 15 Fitzwilliam Place, Dublin D02 YX28, acting for Pendleton.
The Pendleton DPA incorporates all provisions required by Article 28 of the UK GDPR, including:
• documented processing instructions from AGMG as controller;
• confidentiality obligations binding on all persons authorised to process the personal data;
• appropriate technical and organisational security measures;
• sub-processor approval, notification, and contractual flow-down requirements;
• obligations to assist AGMG in responding to data subject rights requests;
• audit and inspection rights per Article 28(3)(h), permitting AGMG and its appointed auditors or inspectors to conduct on-site and remote audits of Pendleton's processing operations;
• data deletion and/or return obligations upon termination of the agreement;
• cooperation with AGMG in the conduct of Data Protection Impact Assessments.
The Pendleton DPA also incorporates an International Data Transfer Agreement (in the form of the UK Addendum to the EU Standard Contractual Clauses, pursuant to Section 119A of the DPA 2018), together with a Transfer Impact Assessment addressing the data protection laws applicable to Pendleton's US-based sub-processors. This addresses the international transfer safeguard requirements for the transfer of personal data from the UK to processors and sub-processors located in jurisdictions not covered by a UK adequacy decision.
For context, Pendleton processes approximately 4.2 billion ad bid requests per month involving AGMG user data. The annual fees paid by AGMG to Pendleton are approximately €2.8 million, and the revenue-share arrangements under the commercial agreement generate approximately €18.4 million per year for AGMG. The Pendleton relationship is thus commercially significant, and AGMG took the decision to remediate the contractual framework rather than terminate the relationship.
VoltGraph Analytics GmbH
The DPA with VoltGraph Analytics GmbH ("VoltGraph") was executed on 8 April 2024. It was signed on behalf of AGMG by Margaux Fontaine-Li, Group Data Protection Officer, and on behalf of VoltGraph by Dr. Kai-Henrik Möller, Managing Director. The negotiation was conducted opposite Dr. Luisa Feldstein of Feldstein Weber LLP, Bockenheimer Landstraße 24, 60323 Frankfurt am Main, acting for VoltGraph.
The VoltGraph DPA incorporates all Article 28 UK GDPR requirements, including documented processing instructions, confidentiality, security measures, sub-processor controls, data subject rights assistance, and DPIA cooperation. The DPA also includes audit and inspection rights per Article 28(3)(h).
A specific provision of the VoltGraph DPA addresses the deletion of historical server-side pixel data collected without valid consent. VoltGraph has undertaken to delete, within 90 days of execution of the DPA, all personal data received from AGMG's properties via server-side pixels that was collected during the period in which valid consent was not obtained. This obligation covers data relating to approximately 320 million unique user profiles per year that were processed by VoltGraph's audience analytics platform on the basis of data received from AGMG's non-compliant pixels. VoltGraph has further agreed to provide AGMG with written certification of deletion upon completion.
Going forward, the DPA requires that all pixel-based data collection from AGMG's properties operate on a consent-gated basis, integrated with the Brightleaf ConsentShield CMP. The annual contract value of the VoltGraph engagement is approximately €1.15 million.
Remaining 7 Vendor DPAs
DPAs with the remaining 7 non-compliant vendors were all fully executed by 10 April 2024. Each DPA incorporates the full suite of Article 28 UK GDPR requirements, including audit and inspection rights per Article 28(3)(h). The vendors concerned span programmatic advertising, analytics, audience segmentation, and social media integration services, and are incorporated in various jurisdictions including the United Kingdom, Ireland, Germany, the Netherlands, and the United States. Where international data transfers are involved, appropriate transfer mechanisms — including UK International Data Transfer Agreements, Transfer Impact Assessments, and Standard Contractual Clauses — have been implemented.
As a result of the DPA remediation workstream, all 23 adtech vendors processing AGMG user data across the Group's European properties now have fully compliant Data Processing Agreements in place. Prior to the remediation, only 14 of 23 vendors had compliant contractual arrangements. Redacted summaries of the executed DPAs with Pendleton, VoltGraph, and the 7 additional vendors are enclosed as Enclosure 4. Full, unredacted copies of all DPAs are available upon request by the Commissioner.
7.4 Vendor Audit Rights
As noted above, all vendor DPAs now include audit and inspection rights per Article 28(3)(h) of the UK GDPR. These provisions permit AGMG — and any auditors or inspectors appointed by AGMG, including external consultants and regulatory authorities — to conduct audits and inspections of the vendor's processing operations. The audit rights cover both on-site inspections at the vendor's premises and remote audits, and require the vendor to make available all information necessary to demonstrate compliance with its obligations under the DPA and Article 28 of the UK GDPR. AGMG has incorporated vendor audit planning into its ongoing compliance governance framework, described in Section 9 below.
7.5 DPIA Updates
An updated Data Protection Impact Assessment ("DPIA") for AGMG's programmatic advertising processing activities across UK and EU/EEA properties was conducted pursuant to Article 35 of the UK GDPR and delivered on 18 April 2024. The DPIA was prepared by C&H in consultation with AGMG's DPO, Ms Fontaine-Li, and with input from Thistlewood Consulting on the technical aspects of the remediated data flows.
The updated DPIA reflects:
• the remediated data flows following the consent mechanism redesign and server-side pixel remediation;
• the updated DPA framework with all 23 adtech vendors;
• the consent-gated processing model now in operation across all AGMG European properties;
• the international data transfer safeguards now in place;
• the residual risk assessment following remediation, which concludes that the residual risks to the rights and freedoms of data subjects are low, subject to AGMG's continued adherence to the ongoing compliance governance framework described in Section 9; and
• the DPO's sign-off recommendation, in which Ms Fontaine-Li confirms that, following the remediation actions taken, the processing is compliant with the UK GDPR and PECR, and that no prior consultation with the Commissioner under Article 36 is required.
The DPIA executive summary is enclosed as Enclosure 5. The full DPIA is available upon request.
7.6 ROPA Update
AGMG's Records of Processing Activities maintained pursuant to Article 30 of the UK GDPR were updated and delivered on 22 April 2024. The ROPA update reflects all remediated processing activities, corrected legal bases (from purported legitimate interest to consent for all processing involving the storage of or access to information on users' terminal equipment for non-essential purposes), new and renegotiated vendor relationships, updated descriptions of categories of recipients and international data transfers, and revised data retention periods where applicable.
An extract of the updated ROPA covering UK processing activities on aureliusnews.co.uk and shopaurelia.co.uk is enclosed as Enclosure 6.
8. Revenue Considerations and Business Continuity
AGMG wishes to draw the Commissioner's attention to the fact that the decision to pursue comprehensive remediation rather than termination of non-compliant vendor relationships was made with due regard both to data protection compliance and to the Group's obligations to its shareholders and stakeholders. The remediation approach preserved approximately €26.3 million in annual revenue that would have been at risk had the 9 non-compliant vendors been terminated, comprising:
• approximately €18.4 million in annual revenue from Pendleton AdTech Solutions Ltd revenue-share arrangements;
• approximately €4.0 million in annual revenue attributable to VoltGraph Analytics GmbH audience segmentation uplift (through improved ad targeting and yield optimisation enabled by VoltGraph's analytics); and
• approximately €3.9 million in aggregate annual revenue from the remaining 7 non-compliant vendors.
AGMG considers that the remediation approach — achieving full compliance while maintaining commercially valuable vendor relationships — represents the most responsible outcome for data subjects, for AGMG's business, and for the broader digital advertising ecosystem. The remediation ensures that users' rights are respected through robust, consent-gated processing, while avoiding the disruption to business continuity and the destruction of economic value that outright vendor termination would have entailed.
9. Ongoing Compliance Governance Framework
To prevent recurrence of the compliance deficiencies identified in the Inquiry and to embed a culture of privacy-by-design across AGMG's digital operations, AGMG has implemented a comprehensive, forward-looking compliance governance framework. The framework was designed by C&H in consultation with AGMG's DPO and CTO, and was formally adopted by AGMG's Board of Directors on 25 April 2024. The key elements of the framework are as follows:
(a) Quarterly automated cookie scans. Thistlewood Consulting has been retained on an ongoing basis to conduct quarterly automated scans of all UK and European digital properties to identify any new or modified cookies, pixels, or tracking technologies and to verify that all non-essential technologies remain consent-gated. Scan results will be reported to the DPO and to C&H.
(b) Annual DPA review and refresh. All vendor DPAs will be reviewed and, where necessary, refreshed on an annual cycle to ensure continued compliance with evolving UK GDPR and PECR requirements and to address any changes in vendor processing activities, sub-processor arrangements, or international data transfer destinations.
(c) Biannual DPIA refreshes. The DPIA for programmatic advertising and audience analytics processing activities will be refreshed on a biannual basis, or more frequently if triggered by a material change in processing activities, technology, or risk profile.
(d) CMP configuration audits. The Brightleaf ConsentShield CMP configuration will be audited on a quarterly basis, coinciding with the automated cookie scans, to ensure that the CMP settings remain compliant and that no configuration changes have been made that would permit non-essential technologies to fire before consent.
(e) Privacy assessment in vendor onboarding. A mandatory privacy and data protection assessment has been integrated into AGMG's vendor onboarding process. No new adtech vendor or data processing relationship may be established without completion of a privacy impact assessment, execution of a compliant DPA, and approval by the DPO.
(f) Training. AGMG has implemented a mandatory training programme for its digital media, engineering, and product development teams covering PECR, UK GDPR, and cookie consent compliance requirements. Training sessions are conducted quarterly and are supplemented by written guidance materials prepared by C&H. Completion of training is tracked and reported to the DPO.
Ms Fontaine-Li, as Group Data Protection Officer, has operational oversight of the ongoing compliance governance framework. She reports directly to Mr Redworth, Group General Counsel, and provides regular updates to the AGMG Board of Directors via the Audit Committee.
10. Coordination with CNIL Proceedings
For the Commissioner's information and in the interest of full transparency, we provide the following update on the related CNIL proceedings:
AGMG submitted its compliance response to the CNIL on 12 April 2024, within the extended compliance deadline of 14 April 2024 that was granted by the CNIL on 18 March 2024. The CNIL response addressed the matters raised in formal notice MED-2023-097 and complaint PLT-2023-FR-04821, which concerned AGMG's French-language entertainment streaming platform, aurelius-stream.fr.
On 29 April 2024, the CNIL issued an acknowledgment of compliance, confirming that no fine would be imposed in respect of formal notice MED-2023-097 and that the CNIL considered the matter closed. A copy of the CNIL's acknowledgment letter (in French, with English courtesy translation) is available upon request.
We wish to emphasise that the remediation programme undertaken by AGMG was pan-European in scope, encompassing all 14 European websites and all 3 mobile applications. Accordingly, the technical, legal, and organisational measures applied to aureliusnews.co.uk and shopaurelia.co.uk are consistent with and identical to the measures applied across all AGMG European properties, including those that were the subject of the CNIL proceedings. AGMG considers that the CNIL's positive compliance determination provides additional assurance that the remediation programme was thorough, effective, and consistent with European data protection standards.
11. Supporting Evidence and Exhibits
In support of this response, AGMG encloses the following supporting materials, each of which is referenced at the appropriate point in the body of this letter:
Enclosure 1: Thistlewood Consulting — Technical Verification Scan Reports for aureliusnews.co.uk and shopaurelia.co.uk, confirming no pre-consent firing of non-essential cookies or server-side tracking pixels following remediation.
Enclosure 2: Screenshots of redesigned cookie consent banners on aureliusnews.co.uk and shopaurelia.co.uk, demonstrating the compliant layout including symmetric "Accept All" / "Reject All" button design, default-off consent toggles, granular purpose-level selection, and two-click consent withdrawal mechanism.
Enclosure 3: Brightleaf ConsentShield CMP configuration logs, demonstrating the consent-gated tag firing configuration and confirming that all non-essential cookies and server-side pixels are blocked in the default (pre-consent) state.
Enclosure 4: Redacted summaries of executed DPAs with Pendleton AdTech Solutions Ltd, VoltGraph Analytics GmbH, and the 7 additional vendors. Full, unredacted copies of all DPAs are available upon request by the Commissioner.
Enclosure 5: Updated DPIA executive summary — Programmatic Advertising Processing Activities, reflecting remediated data flows, updated vendor DPAs, consent-gated processing, international data transfer safeguards, and residual risk assessment.
Enclosure 6: Updated ROPA extract — UK processing activities on aureliusnews.co.uk and shopaurelia.co.uk, reflecting all remediated processing activities, corrected legal bases, and updated vendor and transfer information.
Additional supporting materials, including full unredacted DPAs, the complete DPIA, the full ROPA, CMP audit trail exports, and the Thistlewood Consulting full audit report, are available upon request and can be provided promptly.
12. Request for Closure
On the basis of the comprehensive remediation programme set out in this letter, and the supporting evidence enclosed herewith, AGMG respectfully requests that the Commissioner:
(a) close informal inquiry ICO/ENF/2023/LTR-11084; and