A customer withdrew marketing consent three weeks ago and is still receiving emails. The consent record is correct. Where is the failure?

What the interviewer is testing

Whether you know that consent architecture fails at enforcement rather than at capture.

The failure

A downstream copy. The marketing platform holds an audience list exported when the segment was computed — before the withdrawal. Consent was checked at collection time rather than at processing time, so the platform is acting on a snapshot that is now wrong.

Variants of the same failure: a cached segment, a scheduled campaign whose audience was fixed at creation, a partner who received the list, or a reverse ETL push that runs nightly and does not re-check.

The fix

Check at the point of processing. Either the sending system consults a consent service at send time, or consent state is propagated as an event that every consuming system subscribes to and acts on immediately — removing the individual from every audience within minutes.

The event-driven approach is usually more practical across many tools, and it requires every consumer to implement the subscriber, which is the work.

Suppression lists as a backstop: a global suppression set checked immediately before any send, regardless of which audience the recipient came from. This is the control that catches the copies you did not know about, and it should exist even when the propagation works.

The wider design principle

Consent must be recorded per purpose, versioned and timestamped against the exact wording shown, with withdrawal as easy as granting. But none of that is worth anything without the enforcement path, and audits examine enforcement.

What a strong answer adds

Test it end to end as a standing control: an automated test that withdraws consent for a test identity and verifies that processing actually stops in every downstream system, run continuously. That converts an assumption into evidence, and it is the test that would have caught this three weeks ago.

And a data flow map recording every system that receives personal data, including partners — because the failure is usually in a system nobody remembered was a consumer.

Common weak answers

Fixing the marketing platform's list manually. Concluding the consent service is broken when it is correct.