The Consent Trap
Wednesday 4 November 2026, 16:42. Slack DM from James Okafor: "Operation Pulse Back launching Monday. Legal said LIA is fine, just reminding existing customers. Sign the form?"
Attached: a seven-line "LIA". A screenshot of the redesigned cookie banner with a big blue "Accept All" and a small grey "Manage preferences" link. A Braze plan targeting 310,000 lapsed users. Plus a deck titled "Voxly Partnership — Data-Append Boost": 18% re-engagement lift via enrichment from a health-lifestyle broker.
James is four months in. He's great at his job. He doesn't know Recital 47 is GDPR, not ePrivacy, and he thinks "analytics cookies" are strictly necessary. They aren't, under ePrivacy Art 5(3) per EDPB 2/2023 and CNIL. Fran is CC'd. €2.5M of Q4 hangs on this. Launch is Monday.
- Distinguish GDPR Art 6 from ePrivacy Dir Art 13 — and apply both correctly to electronic marketing.
- Apply EU cookie guidance (CNIL + EDPB) and EDPB deceptive-pattern rules to a real banner design.
- Diagnose third-party data-append risk and apply Art 14 transparency.
The Slack DM
The attached LIA is seven lines long. It says: Legitimate interest: re-engagement of lapsed existing customers. Necessity: alternative methods not available. Balancing: minimal intrusion, users can unsubscribe.
You know what's missing. Recital 47 lives under GDPR. ePrivacy Dir Art 13 (Ireland SI 336/2011) lives alongside GDPR for electronic-channel consent. Both need answering before Monday.
Operation Pulse Back — LIA
Four rows. Pick the correct answer per row. The output shapes what the LIA can and cannot defend on Monday.
The Lawful Basis Question
You've called James. He's cheerful. You've explained the two-layer issue — GDPR basis + ePrivacy consent — twice. He's still not quite seeing it.
Question: What lawful basis do you apply for the re-engagement email and SMS?
The Segmentation
ePrivacy Dir Art 13 (Ireland SI 336/2011) permits "soft opt-in" for email and SMS where (a) details came from a sale or sale negotiation, (b) the marketing is for similar products, and (c) opt-out was offered at collection and every message since.
Art 6(1)(f) plus Recital 47 is the GDPR basis. ePrivacy is the separate electronic-channel layer. Art 83(5) ceiling: €20M / 4% turnover, and ePrivacy fines align via national law.
- Two layers: GDPR basis + ePrivacy consent. Only the paired analysis holds.
- Google €50M (CNIL) is the baseline EU precedent and explicitly criticises opaque lawful-basis reasoning.
The Slow Version
Defensible — the LIA work adds evidence, but the same soft-opt-in segmentation is still required. Cost: 3-day analysis slip. Launch moves to Wednesday.
- Not wrong. Just slower than needed.
- Same commercial outcome as choice-a with 3 days lost.
The Send
Recital 47 is a GDPR recital; it does NOT override ePrivacy Dir Art 13 (Ireland SI 336/2011). The ePrivacy Directive sits alongside GDPR, not under it — each Member State implements via national law (Ireland: SI 336/2011).
Sending to 310k where 216k are not within ePrivacy Art 13 soft opt-in is a direct ePrivacy breach, subject to Art 83(5) GDPR €20M ceiling.
- Recital-47-only reasoning is the textbook growth-marketing mistake.
- EU supervisory authorities have prosecuted this pattern through national ePrivacy implementations for over a decade.
The Banner
You walk into the marketing stand-up. Lena has pulled the A/B test dashboard for the banner redesign.
Variant B (current proposal): Prominent blue "Accept All" primary button. Grey underlined "Manage preferences" secondary link. No Reject-All at layer 1. Pre-ticked sub-toggles behind the "Manage" drawer.
Conversion: Variant B up 34% on accept rate.
Variant B — Mark Each Element
Seven elements. For each, mark "dark pattern" or "legitimate." ICO and EDPB references unlock as you go.
The Banner Brief
Lena has pulled up her design system. James is standing next to her. Fran is watching remotely. You have three options.
Question: What banner brief do you give Lena?
The Rebuild
ICO 2019 cookie guidance — updated in the 2023 "reject all" campaign — requires equal prominence at layer 1 and no pre-ticked non-essential boxes.
EDPB 03/2022 taxonomises deceptive patterns that invalidate consent. CJEU Planet49 — pre-ticked boxes are not valid consent. Settled law since 2019.
- Art 7 — freely given consent requires genuine choice. Friction asymmetry invalidates.
- There is no EU-wide "low-risk" cookie exemption. The ePrivacy Art 5(3) strictly-necessary carve-out does NOT cover behavioural-ad cookies.
The Compromise
Better than Variant B. Not compliant. Irish DPC / EDPB guidance uses the word "equivalent" — visual hierarchy suggesting Accept is primary fails equivalence.
Likely to pass a cursory DPC inspection but fail a complaint-triggered review.
- Half-fix. Invites a targeted complaint.
- DPC's "reject all" campaign specifically pushed on sites that offered "reject non-essential" as a secondary action.
The Strictly-Necessary Stretch
The ePrivacy Art 5(3) strictly-necessary carve-out covers only cookies essential to the service the user explicitly requested. It does NOT cover Pulse's actual cookie stack: behavioural-ad pixels (Meta, Google), third-party marketing tags, cross-site tracking.
Banner ships. First complaint arrives within 14 days. DPC investigation notice within 45 days.
- Misreading a specific-named exemption as a broad licence.
- The dark-pattern taxonomy in EDPB 03/2022 is the DPC's reference document.
The Voxly Pitch
Matt pitches: Voxly has self-declared fitness data on 42M UK consumers, collected via an SDK in 400+ fitness-tracker apps.
You ask where the consent sits. Matt says: "The app T&Cs authorise partner enrichment for health and wellness purposes. Standard across the industry."
You ask for a sample consent flow from one of the apps. Matt sends a pre-tick cookie-banner-tier consent page. The word "Voxly" does not appear. The word "partner enrichment" does, in paragraph 14.
You have seen this pattern before. It's the TikTok and Amazon fact pattern in a different skin.
The Enrichment Decision
€2.5M campaign revenue. 18% lift promised by Voxly. $180k contract. Cerulith's first use of a third-party data broker.
Three options. One closes the door cleanly. One tries to hold Voxly's hand while using the data. One pretends the problem isn't there.
Question: How do you handle the Voxly append?
The Refusal
Art 14 applies when data is obtained from a source other than the data subject. Relying on the third-party's consent is not a substitute for Cerulith's own transparency duties.
Amazon €746M is the controlling precedent for enrichment-based personalisation without clear lawful basis.
- Art 14 source-notification duties cannot be outsourced.
- Refusing the append short-term protects a decade-long first-party data advantage.
The Notification Path
Legally tenable — Art 14 notification within the month is the correct path if the append proceeds.
Commercial cost: the required notice (specifying Voxly as the source, data categories, purposes, rights, retention) is substantial. Opt-out uptake is expected 15–25% in health-adjacent contexts. Campaign lift from enrichment likely halves.
- Compliant. Costly. Often not commercially worth it — the correct answer is frequently choice-a.
- The notification itself generates regulatory goodwill.
The Silent Append
Art 14 is non-delegable. Voxly's consent warranty does not discharge Cerulith's duty.
Amazon €746M fact pattern. Google CNIL €50M transparency-breach pattern.
- Non-delegable duties cannot be outsourced.
- This decision becomes the third major transfer-and-transparency exhibit in Module 6.
Computing Defensibility…
Summing the three decision impacts.
The Q4 That Shipped
Soft opt-in segmentation. Compliant banner. Voxly declined.
The Q4 That Landed
Partial mitigations. Desk-review flag. Banner rebuilt Feb 2027.
The Q4 That Became An Exhibit
ePrivacy 4% tier fine. Voxly unwind. Three M6 exhibits.
What M5 Teaches
- Recital 47 ≠ ePrivacy Dir Art 13 (Ireland SI 336/2011). GDPR basis and ePrivacy consent are two separate layers.
- Cookie banners must offer equal prominence at layer 1 — no pre-ticked, no friction asymmetry.
- EDPB 03/2022 dark-pattern taxonomy is the DPC's reference document.
- Art 14 source-notification duties are non-delegable. Third-party consent warranties do not discharge them.
- No EU equivalent — full consent required is narrow — read it against your specific cookie stack.
Next module: Two months from now, on the morning of 19 January 2027, Máire Ní Bhriain will step out of a black cab at Cerulith's Dublin 2 entrance with a bound evidence binder. Everything you've done this year will be in that binder.
5 Questions
Five questions on Art 6/7/14, Recital 47, ePrivacy Dir Art 13 and Art 5(3), EDPB dark patterns, and Amazon / Google / Planet49 precedents.
Module 5 Complete
Defensibility score: — / 9
Quiz: —
Outcome: —
Your result has been recorded. Module 6 unlocked: The Room.