An insurance platform must record and honour consent across many purposes and channels. What must the architecture provide?

What it must provide

• Consent recorded per purpose, not globally. Marketing, analytics, sharing with a partner, automated decision-making and the core service are different purposes, and a single consent flag cannot express which were granted.
• A record of what was presented and when, since a consent's validity depends on what the person was actually shown — and the wording changes, so the version presented must be stored with the record.
• Withdrawal as easy as granting, which is a regulatory requirement in most regimes and a product design question.
• Enforcement at the point of use, not merely at the point of collection. The system that sends marketing must check consent at send time, since it may have been withdrawn since collection — and a batch built yesterday against yesterday's consent is a violation.
• Propagation to processors, since a withdrawal must reach the third parties who received the data.

The architectural implication that is usually missed

Every downstream use must be able to check. That means consent is a service consulted at use time rather than a field copied into a dataset — because a copy is stale the moment it is made, and a marketing platform holding a copied consent flag will act on it after withdrawal.

And an analytics dataset built from records whose consent has been withdrawn must exclude them, which requires the consent state to be joinable at query time rather than baked in.

The lawful-basis distinction

Consent is one lawful basis among several, and it is frequently the wrong one. Processing necessary to deliver the contracted service does not require consent, and asking for it creates a right of withdrawal that would break the service.

Choosing the basis correctly per purpose is a legal determination with a large architectural consequence — because a purpose based on consent needs the whole enforcement machinery and one based on contract does not.

The insurance-specific complication

Health data carries a stricter regime, and it arrives through unstructured claim documents that contain whatever the claimant included. Consent for its processing must be specific, and the extraction pipeline must be able to identify and treat it accordingly — which is a document-processing problem with its own error rate, not a field-level classification.