Design consent management for a publisher with advertising, analytics and personalisation across web and apps.

What consent must be

Specific, informed, freely given, and as easy to withdraw as to give. Each of those is an architectural requirement rather than a legal footnote: specific means per purpose rather than a single toggle; withdrawal being as easy means the same number of interactions, which rules out a one-click accept and a five-screen reject.

The architecture

• Consent recorded per purpose, per subject, with a timestamp and the version of the notice shown. Proving consent later requires knowing exactly what the person was shown, which means notice versions are retained artefacts.
• A consent state service the platform consults before any processing that depends on consent, rather than each surface holding its own copy.
• Propagation to every downstream system, including third parties, since consent withdrawn in the app must stop processing in the analytics platform and the advertising stack. This is where most implementations fail — consent is captured well and propagated poorly.
• Consent checked at processing time, not only at collection time, because it can be withdrawn between the two.
• An audit trail of every consent state change, retained for as long as the processing it authorised is relevant.

The technical complications

Cross-device and cross-surface identity. The same person consents on the web and appears in the app; if they are not linked, consent is inconsistent, and if they are linked, the linking is itself processing that requires a basis.

Defaults and pre-ticked boxes are not consent, so the technical default must be "no processing" and the system must function with everything declined — which is a real engineering requirement, not a hypothetical.

The measure of a working implementation

Withdrawal propagating everywhere within a stated time, evidenced. Most systems can capture consent; the ones that survive scrutiny can demonstrate that withdrawal actually stopped the processing.