Consent Architecture

Consent is where privacy programmes most often fail the enforcement test. Collecting it is easy and almost every organisation does it. Making it effective across the estate is the hard part, and it is what an audit examines.

A workable design has four properties. Consent is recorded per purpose, not as a single flag, because permission to send marketing is not permission to share with partners or to profile. It is versioned and timestamped against the exact wording shown, since demonstrating valid consent means showing what the person actually agreed to. Withdrawal is as easy as granting, which is a legal requirement and a common failure. And every consuming system checks at the point of processing rather than filtering at collection.

That last property is the architectural crux. A marketing platform holding a copy of a list that was consent-filtered last month will send to someone who withdrew last week. The durable pattern is a consent service consulted at send time, or consent state propagated as an event that consuming systems subscribe to and act on immediately.

The failure that generates regulatory attention is the gap between the record and the behaviour: a system that faithfully records withdrawal and keeps sending because a downstream copy was never updated. Auditing that end-to-end — withdraw, then verify processing actually stops everywhere — belongs in the test strategy.