The Consent Trap
Wednesday 4 November 2026, 16:42. Slack DM from James Okafor lands: "Operation Pulse Back launching Monday. Legal said LIA is fine — just reminding existing customers. Can you sign the form?"
Attached: a one-paragraph "LIA" document (seven lines). A screenshot of the redesigned cookie banner with a prominent blue "Accept All" button and a small grey underlined "Manage preferences" link. A Braze campaign plan targeting 310,000 lapsed users.
Also in the thread: a slide deck titled "Voxly Partnership — Data-Append Boost" promising an 18% lift in re-engagement via enrichment from a health-lifestyle broker.
James has four months' tenure at Cerulith. He is great at his job. He does not know Recital 47 is a GDPR statement, not a PECR one. He thinks DUAA 2025 exempts "analytics cookies" broadly — it does not. Fran is on the CC. £2.1M of Q4 revenue depends on this campaign. Launch is Monday.
- Distinguish GDPR Art 6 from PECR/ePrivacy — and apply both correctly to electronic marketing.
- Apply ICO cookie guidance and EDPB deceptive-pattern rules to a real banner design.
- Diagnose third-party data-append risk and apply Art 14 transparency.
The Slack DM
The attached LIA is seven lines long. It says: Legitimate interest: re-engagement of lapsed existing customers. Necessity: alternative methods not available. Balancing: minimal intrusion, users can unsubscribe.
You know what's missing. Recital 47 lives under GDPR. PECR Regulation 22 lives alongside GDPR for electronic-channel consent. Both need answering before Monday.
Operation Pulse Back — LIA
Four rows. Pick the correct answer per row. The output shapes what the LIA can and cannot defend on Monday.
The Lawful Basis Question
You've called James. He's cheerful. You've explained the two-layer issue — GDPR basis + PECR consent — twice. He's still not quite seeing it.
Question: What lawful basis do you apply for the re-engagement email and SMS?
The Segmentation
PECR Regulation 22 permits "soft opt-in" for email and SMS marketing where: (a) recipient's details obtained in the course of a sale or negotiations for a sale, (b) the marketing is for similar products, and (c) an opt-out was offered at collection and in each subsequent message.
Art 6(1)(f) legitimate interests plus Recital 47 gives the GDPR basis; PECR is the separate electronic-channel consent layer.
Under DUAA 2025, the PECR cap is now £17.5M / 4% turnover — aligned with GDPR. Non-compliance is materially more expensive than in 2024.
- Two layers matter: GDPR basis + PECR consent. Only the paired analysis is defensible.
- TikTok £12.7M includes direct-marketing adjacent patterns.
- Google CNIL €50M explicitly criticises opaque lawful-basis reasoning.
The Slow Version
Defensible — the LIA work adds evidence, but the same soft-opt-in segmentation is still required. Cost: 3-day analysis slip. Launch moves to Wednesday.
- Not wrong. Just slower than needed.
- Same commercial outcome as choice-a with 3 days lost.
The Send
Recital 47 is a GDPR recital; it does NOT override PECR Regulation 22. PECR is the implementation of the ePrivacy Directive in UK law and sits alongside GDPR, not under it.
Sending to 310k where 216k are not within PECR soft-opt-in is a direct PECR breach, subject to DUAA's new £17.5M ceiling.
- Recital-47-only reasoning is the textbook growth-marketing mistake.
- ICO has prosecuted this pattern through PECR for over a decade.
The Banner
You walk into the marketing stand-up. Lena has pulled the A/B test dashboard for the banner redesign.
Variant B (current proposal): Prominent blue "Accept All" primary button. Grey underlined "Manage preferences" secondary link. No Reject-All at layer 1. Pre-ticked sub-toggles behind the "Manage" drawer.
Conversion: Variant B up 34% on accept rate.
Variant B — Mark Each Element
Seven elements. For each, mark "dark pattern" or "legitimate." ICO and EDPB references unlock as you go.
The Banner Brief
Lena has pulled up her design system. James is standing next to her. Fran is watching remotely. You have three options.
Question: What banner brief do you give Lena?
The Rebuild
ICO 2019 cookie guidance — updated in the 2023 "reject all" campaign — requires equal prominence at layer 1 and no pre-ticked non-essential boxes.
EDPB 03/2022 taxonomises deceptive patterns that invalidate consent. CJEU Planet49 — pre-ticked boxes are not valid consent. Settled law since 2019.
The Compromise
Better than Variant B. Not compliant. ICO guidance uses the word "equivalent" — visual hierarchy suggesting Accept is primary fails equivalence.
Likely to pass a cursory ICO inspection but fail a complaint-triggered review.
- Half-fix. Invites a targeted complaint.
- ICO's "reject all" campaign specifically pushed on sites that offered "reject non-essential" as a secondary action.
The DUAA Read
DUAA 2025's low-risk analytics exemption covers limited audience-measurement cookies (first-party, statistical). It does NOT cover Pulse's actual cookie stack: behavioural-ad pixels (Meta, Google), third-party marketing tags, cross-site tracking.
Banner ships. First complaint arrives within 14 days. ICO information notice within 45 days.
- Misreading a specific-named exemption as a broad licence.
- The dark-pattern taxonomy in EDPB 03/2022 is the ICO's reference document.
The Voxly Pitch
Matt pitches: Voxly has self-declared fitness data on 42M UK consumers, collected via an SDK in 400+ fitness-tracker apps.
You ask where the consent sits. Matt says: "The app T&Cs authorise partner enrichment for health and wellness purposes. Standard across the industry."
You ask for a sample consent flow from one of the apps. Matt sends a pre-tick cookie-banner-tier consent page. The word "Voxly" does not appear. The word "partner enrichment" does, in paragraph 14.
You have seen this pattern before. It's the TikTok and Amazon fact pattern in a different skin.
The Enrichment Decision
£2.1M campaign revenue. 18% lift promised by Voxly. $180k contract. Cerulith's first use of a third-party data broker.
Three options. One closes the door cleanly. One tries to hold Voxly's hand while using the data. One pretends the problem isn't there.
Question: How do you handle the Voxly append?
The Refusal
Art 14 applies when data is obtained from a source other than the data subject. Relying on the third-party's consent is not a substitute for Cerulith's own transparency duties.
Amazon €746M is the controlling precedent for enrichment-based personalisation without clear lawful basis.
- Art 14 source-notification duties cannot be outsourced.
- Refusing the append short-term protects a decade-long first-party data advantage.
The Notification Path
Legally tenable — Art 14 notification within the month is the correct path if the append proceeds.
Commercial cost: the required notice (specifying Voxly as the source, data categories, purposes, rights, retention) is substantial. Opt-out uptake is expected 15–25% in health-adjacent contexts. Campaign lift from enrichment likely halves.
- Compliant. Costly. Often not commercially worth it — the correct answer is frequently choice-a.
- The notification itself generates regulatory goodwill.
The Silent Append
Art 14 is non-delegable. Voxly's consent warranty does not discharge Cerulith's duty.
Amazon €746M fact pattern. TikTok £12.7M transparency-breach pattern.
- Non-delegable duties cannot be outsourced.
- This decision becomes the third major transfer-and-transparency exhibit in Module 6.
Computing Defensibility…
Summing the three decision impacts.
The Q4 That Shipped
Soft opt-in segmentation. Compliant banner. Voxly declined.
The Q4 That Landed
Partial mitigations. Desk-review flag. Banner rebuilt Feb 2027.
The Q4 That Became An Exhibit
PECR MPN. Voxly unwind. Three M6 exhibits.
What M5 Teaches
- Recital 47 ≠ PECR Regulation 22. GDPR basis and PECR consent are two separate layers.
- Cookie banners must offer equal prominence at layer 1 — no pre-ticked, no friction asymmetry.
- EDPB 03/2022 dark-pattern taxonomy is the ICO's reference document.
- Art 14 source-notification duties are non-delegable. Third-party consent warranties do not discharge them.
- DUAA's low-risk cookie exemption is narrow — read it against your specific cookie stack.
Next module: Two months from now, on the morning of 19 January 2027, Helena Brandt will step out of a black cab at Cerulith's Bishopsgate entrance with a bound evidence binder. Everything you've done this year will be in that binder.
5 Questions
Five questions on Art 6/7/14, Recital 47, PECR Reg 22/Reg 6, EDPB dark patterns, DUAA PECR reforms.
Module 5 Complete
Defensibility score: — / 9
Quiz: —
Outcome: —
Your result has been recorded. Module 6 unlocked: The Room.