The Consent Trap
Wednesday 4 November 2026, 16:42. Slack DM from James Okafor lands: "Operation Pulse Back launching Monday. Legal said LIA is fine — just reminding existing customers. Can you sign the form?"
Attached: a one-paragraph "LIA" document (seven lines). A screenshot of the redesigned cookie banner with a prominent blue "Accept All" button and a small grey underlined "Manage preferences" link. A Braze campaign plan targeting 310,000 lapsed users.
Also in the thread: a slide deck titled "Voxly Partnership — Data-Append Boost" promising an 18% lift in re-engagement via enrichment from a health-lifestyle broker.
James has four months' tenure at Cerulith. He is great at his job. He does not know Recital 47 is a GDPR statement, not an ePrivacy one. He thinks "analytics cookies" fall under the strictly-necessary carve-out — they do not, under ePrivacy Art 5(3) as clarified by EDPB 2/2023 and CNIL guidance. Fran is on the CC. €2.5M of Q4 revenue depends on this campaign. Launch is Monday.
- Distinguish GDPR Art 6 from ePrivacy Dir Art 13 — and apply both correctly to electronic marketing.
- Apply EU cookie guidance (CNIL + EDPB) and EDPB deceptive-pattern rules to a real banner design.
- Diagnose third-party data-append risk and apply Art 14 transparency.
The Slack DM
The attached LIA is seven lines long. It says: Legitimate interest: re-engagement of lapsed existing customers. Necessity: alternative methods not available. Balancing: minimal intrusion, users can unsubscribe.
You know what's missing. Recital 47 lives under GDPR. ePrivacy Dir Art 13 (Ireland SI 336/2011) lives alongside GDPR for electronic-channel consent. Both need answering before Monday.
Operation Pulse Back — LIA
Four rows. Pick the correct answer per row. The output shapes what the LIA can and cannot defend on Monday.
The Lawful Basis Question
You've called James. He's cheerful. You've explained the two-layer issue — GDPR basis + ePrivacy consent — twice. He's still not quite seeing it.
Question: What lawful basis do you apply for the re-engagement email and SMS?
The Segmentation
ePrivacy Dir Art 13 (Ireland SI 336/2011) permits "soft opt-in" for email and SMS marketing where: (a) recipient's details obtained in the course of a sale or negotiations for a sale, (b) the marketing is for similar products, and (c) an opt-out was offered at collection and in each subsequent message.
Art 6(1)(f) legitimate interests plus Recital 47 gives the GDPR basis; the ePrivacy Directive is the separate electronic-channel consent layer.
Under Art 83(5) GDPR, the tier ceiling is €20M / 4% turnover. National ePrivacy fines align with GDPR via Member State implementing law. Non-compliance sits squarely in the 4% tier.
- Two layers matter: GDPR basis + ePrivacy consent. Only the paired analysis is defensible.
- Google €50M (CNIL) is the baseline EU precedent for transparency and consent failures in marketing.
- Google CNIL €50M explicitly criticises opaque lawful-basis reasoning.
The Slow Version
Defensible — the LIA work adds evidence, but the same soft-opt-in segmentation is still required. Cost: 3-day analysis slip. Launch moves to Wednesday.
- Not wrong. Just slower than needed.
- Same commercial outcome as choice-a with 3 days lost.
The Send
Recital 47 is a GDPR recital; it does NOT override ePrivacy Dir Art 13 (Ireland SI 336/2011). The ePrivacy Directive sits alongside GDPR, not under it — each Member State implements via national law (Ireland: SI 336/2011).
Sending to 310k where 216k are not within ePrivacy Art 13 soft opt-in is a direct ePrivacy breach, subject to Art 83(5) GDPR €20M ceiling.
- Recital-47-only reasoning is the textbook growth-marketing mistake.
- EU supervisory authorities have prosecuted this pattern through national ePrivacy implementations for over a decade.
The Banner
You walk into the marketing stand-up. Lena has pulled the A/B test dashboard for the banner redesign.
Variant B (current proposal): Prominent blue "Accept All" primary button. Grey underlined "Manage preferences" secondary link. No Reject-All at layer 1. Pre-ticked sub-toggles behind the "Manage" drawer.
Conversion: Variant B up 34% on accept rate.
Variant B — Mark Each Element
Seven elements. For each, mark "dark pattern" or "legitimate." ICO and EDPB references unlock as you go.
The Banner Brief
Lena has pulled up her design system. James is standing next to her. Fran is watching remotely. You have three options.
Question: What banner brief do you give Lena?
The Rebuild
ICO 2019 cookie guidance — updated in the 2023 "reject all" campaign — requires equal prominence at layer 1 and no pre-ticked non-essential boxes.
EDPB 03/2022 taxonomises deceptive patterns that invalidate consent. CJEU Planet49 — pre-ticked boxes are not valid consent. Settled law since 2019.
- Art 7 — freely given consent requires genuine choice. Friction asymmetry invalidates.
- There is no EU-wide "low-risk" cookie exemption. The ePrivacy Art 5(3) strictly-necessary carve-out does NOT cover behavioural-ad cookies.
The Compromise
Better than Variant B. Not compliant. Irish DPC / EDPB guidance uses the word "equivalent" — visual hierarchy suggesting Accept is primary fails equivalence.
Likely to pass a cursory DPC inspection but fail a complaint-triggered review.
- Half-fix. Invites a targeted complaint.
- DPC's "reject all" campaign specifically pushed on sites that offered "reject non-essential" as a secondary action.
The Strictly-Necessary Stretch
The ePrivacy Art 5(3) strictly-necessary carve-out covers only cookies essential to the service the user explicitly requested. It does NOT cover Pulse's actual cookie stack: behavioural-ad pixels (Meta, Google), third-party marketing tags, cross-site tracking.
Banner ships. First complaint arrives within 14 days. DPC investigation notice within 45 days.
- Misreading a specific-named exemption as a broad licence.
- The dark-pattern taxonomy in EDPB 03/2022 is the DPC's reference document.
The Voxly Pitch
Matt pitches: Voxly has self-declared fitness data on 42M UK consumers, collected via an SDK in 400+ fitness-tracker apps.
You ask where the consent sits. Matt says: "The app T&Cs authorise partner enrichment for health and wellness purposes. Standard across the industry."
You ask for a sample consent flow from one of the apps. Matt sends a pre-tick cookie-banner-tier consent page. The word "Voxly" does not appear. The word "partner enrichment" does, in paragraph 14.
You have seen this pattern before. It's the TikTok and Amazon fact pattern in a different skin.
The Enrichment Decision
€2.5M campaign revenue. 18% lift promised by Voxly. $180k contract. Cerulith's first use of a third-party data broker.
Three options. One closes the door cleanly. One tries to hold Voxly's hand while using the data. One pretends the problem isn't there.
Question: How do you handle the Voxly append?
The Refusal
Art 14 applies when data is obtained from a source other than the data subject. Relying on the third-party's consent is not a substitute for Cerulith's own transparency duties.
Amazon €746M is the controlling precedent for enrichment-based personalisation without clear lawful basis.
- Art 14 source-notification duties cannot be outsourced.
- Refusing the append short-term protects a decade-long first-party data advantage.
The Notification Path
Legally tenable — Art 14 notification within the month is the correct path if the append proceeds.
Commercial cost: the required notice (specifying Voxly as the source, data categories, purposes, rights, retention) is substantial. Opt-out uptake is expected 15–25% in health-adjacent contexts. Campaign lift from enrichment likely halves.
- Compliant. Costly. Often not commercially worth it — the correct answer is frequently choice-a.
- The notification itself generates regulatory goodwill.
The Silent Append
Art 14 is non-delegable. Voxly's consent warranty does not discharge Cerulith's duty.
Amazon €746M fact pattern. Google CNIL €50M transparency-breach pattern.
- Non-delegable duties cannot be outsourced.
- This decision becomes the third major transfer-and-transparency exhibit in Module 6.
Computing Defensibility…
Summing the three decision impacts.
The Q4 That Shipped
Soft opt-in segmentation. Compliant banner. Voxly declined.
The Q4 That Landed
Partial mitigations. Desk-review flag. Banner rebuilt Feb 2027.
The Q4 That Became An Exhibit
ePrivacy 4% tier fine. Voxly unwind. Three M6 exhibits.
What M5 Teaches
- Recital 47 ≠ ePrivacy Dir Art 13 (Ireland SI 336/2011). GDPR basis and ePrivacy consent are two separate layers.
- Cookie banners must offer equal prominence at layer 1 — no pre-ticked, no friction asymmetry.
- EDPB 03/2022 dark-pattern taxonomy is the DPC's reference document.
- Art 14 source-notification duties are non-delegable. Third-party consent warranties do not discharge them.
- No EU equivalent — full consent required is narrow — read it against your specific cookie stack.
Next module: Two months from now, on the morning of 19 January 2027, Máire Ní Bhriain will step out of a black cab at Cerulith's Dublin 2 entrance with a bound evidence binder. Everything you've done this year will be in that binder.
5 Questions
Five questions on Art 6/7/14, Recital 47, ePrivacy Dir Art 13 and Art 5(3), EDPB dark patterns, and Amazon / Google / Planet49 precedents.
Module 5 Complete
Defensibility score: — / 9
Quiz: —
Outcome: —
Your result has been recorded. Module 6 unlocked: The Room.