Because you solved collection and skipped propagation. Most consent bugs aren't legal
problems. They're sync problems.
A user clicks reject. Your banner writes it locally. Your tag manager reads it. And
then nothing else in your stack ever hears about it again.
The four flags Google reads
-
ad_storage: may we set advertising cookies -
analytics_storage: may we set measurement cookies -
ad_user_data: may we send user data to Google for ads -
ad_personalization: may we personalise ads
The last two arrived in November 2023. Since March 2024, Customer Match lists used in
the EEA need both set to GRANTED. Miss one and the list just doesn't serve. No warning,
no error.
Setting these is an afternoon's work. Keeping them honest is the part nobody owns.
Where it drifts
Your user changes their mind in the mobile app three weeks later.
Your web container never finds out. Neither does your CRM. Your email tool keeps
sending. The flags in your tag manager are still perfectly valid, and now they're also
wrong.
The bit that actually bites: identity
Here's the design decision that decides whether any of this works.
Consent keyed to a cookie is consent keyed to a browser. Same person on a phone and a
laptop gives you two records, and eventually two different answers.
Key it to a stable user identifier instead, and resolve the anonymous cookie to that
identifier the moment they log in. Otherwise universal consent quietly becomes
per-device consent with extra steps.
Build it as a service
Write once to a central store. Then push, don't poll. Webhooks out to your CRM, ESP,
warehouse and ad platforms.
Watch your propagation window. If your CRM syncs overnight, that's up to 24 hours of
processing you can't defend. Batch is fine for reporting and useless for revocation.
Stamp every write with a timestamp, the purpose, the channel and the rule that applied
at that moment. A year from now that stamp is the only thing standing between you and
"we think so".
And version your banner copy. Proving someone consented is easy. Proving what they were
looking at when they did it is what people forget to build.
The universal consent model
covers how offline and in-app consent joins the same record.
(If you'd rather not build the identity layer, propagation queue and audit log
yourself, Seers AI ships it: https://seers.ai/)
Top comments (0)