1. Definition: What is Digital Consent Architecture?

It is the technical + legal system that captures, stores, proves, and propagates user consent across devices and vendors.

Legal definition:

Under EU GDPR Art 4(11), consent must be a "freely given, specific, informed and unambiguous indication of the user's wishes, given via a clear affirmative act." In India, DPDP Act 2023 mandates consent be "free, specific, informed, unconditional and unambiguous with a clear affirmative action".

This translates to 7 technical pillars:

1. Granularity: Each purpose needs its own consent - analytics, personalization, advertising cannot be bundled
2. Prior: No scripts firing before consent - ePrivacy Art 5(3)
3. Provable: Record of who consented, when, what text version, how - Art 7(1) accountability
4. Withdrawable: As easy to withdraw as to give - 1 click
5. Propagatable: Consent signal must travel downstream to all processors - TC String, GPP
6. Respectful: No dark patterns - pre-ticked boxes prohibited
7. Age-gated: Verifiable parental consent for <16 (<18 in India DPDP)

2. Architecture Models in 2026

Model A - IAB TCF 2.2 / GPP (AdTech Standard)
Publisher -> CMP banner -> creates TC String (e.g., CPX...) -> stored in cookie + localStorage -> shared via OpenRTB to 1000+ vendors. Vendor reads purpose 1-10.

Model B - Consent Management Platform + Preference Center (Enterprise)
OneTrust / Cookiebot / Usercentrics -> Central consent lake -> APIs to website, app, CRM, CDP. Implements Google Consent Mode v2 (4 signals: ad_storage, analytics_storage, ad_user_data, ad_personalization).

Model C - Data Empowerment & Protection Architecture (India DPDP) - Consent Manager Model
Unique to India: User -> Consent Manager (licensed entity like CAMS, Protean) -> Data Fiduciary. User manages all consents in one dashboard, not per website. Revocation propagates automatically.

Model D - Blockchain Consent (Healthcare/IOT)
Immutable ledger for consent receipts - provides automated patient consent as required by GDPR while allowing data deletion via off-chain pointer.

3. Landmark Case Laws That Built Consent Architecture

A. Planet49 (C-673/17) CJEU - 1 Oct 2019 - The Foundation

Facts: Online lottery with pre-ticked checkbox: "I agree to tracking for advertising, refusal required additional effort."

Held:

• The court held that consent was not given freely. Pre-ticked boxes do not constitute valid consent under EU law.
• Consent must be active opt-in.
• Tracking cookies + device fingerprinting = same consent standard.

Architecture impact: Banned pre-ticked, bundled consent. Every modern CMP now starts unticked, requires affirmative action. This case is why GDPR Recital 32 explicitly says checkbox must start unticked.

Designing Consent Under India's DPDP Act: Why UX is now legal compliance - Court observed platform contained consent flow where interface had pre-selected option allowing tracking and refusal required additional effort.

B. IAB Europe TCF - Belgian DPA + CJEU C-604/22 - 7 March 2024 - Most Important Consent Case in AdTech

Timeline: Belgian DPA fined IAB Europe 2022 saying TCF violates GDPR. IAB appealed to Market Court Brussels, which referred to CJEU.

CJEU Held (C-604/22):

TC String = Personal Data: The court has ruled that so-called TC-String is to be classified as personal data when combined with identifying information such as IP address.

The CJEU held that a string used to inform advertisers of a user's consent preferences is personal data and IAB Europe - entity providing framework - controller under GDPR.

IAB Europe = Joint Controller: IAB Europe can be considered a joint controller under Article 4(7) for creation and use of TC strings within framework. It plays decisive role in setting purposes and means, despite not directly collecting data. Responsibility limited to initial recording.

TCF invalid if no legal basis: TCF presumed legitimate interest for advertising - Belgian court said invalid.

Architecture impact:

• Every website using TCF 2.0-2.2 must re-consent under TCF 2.2 v2.3+ that adds legitimate interest disclosure, vendor stack transparency.
• IAB Europe had to implement Action Plan: Limit purposes, require publishers to be controllers, ban dark patterns, add Global Privacy Platform.
• Google now requires TCF 2.2 for EEA + UK publishers.

C. Orange Romania (C-61/19) - 11 Nov 2020 - Proof of Consent

Orange Romania, telecom company, was fined for having failed to demonstrate that service user had given valid consent to storing of identity documents.

Court: Consent is not valid if contract copy includes pre-ticked consent and burden of proof is on controller (Art 7(1)). You must prove HOW consent was obtained - timestamp, version, action.

Architecture: Created consent receipt requirement. Modern CMP stores consent proof vault: user agent, IP (hashed), banner version, time, affirmative click log.

D. Meta Platforms and Others (C-252/21) - Bundeskartellamt - 4 July 2023 - Forced Consent Invalid

German competition authority said Meta abused dominance by forcing users to consent to cross-site tracking to use Facebook/ Instagram.

CJEU: When undertaking has dominant position, consent cannot be freely given if no alternative. Contract necessity cannot be used for advertising personalization.

Impact: Meta forced to introduce "Pay or OK" model in EU Nov 2023. DMA Art 5(2) now requires gatekeepers to offer equivalent less-personalized alternative without consent.

E. Elkjop / Elkjøp Nordic - NOK 20M fine - Norway - 2023 - Loyalty Consent Architecture Failure

It cannot be referred to Norwegian Privacy Appeals Board because it was adopted as cross-border case. Three of four violations involve tools standard in marketing stack: loyalty club consent architecture, Customer Match for audience targeting, and Offline Conversions.

Company merged loyalty consent with marketing consent, no granularity, no separate legal basis for Customer Match upload to Google. Fine NOK 20M.

Architecture lesson: Loyalty program consent != advertising consent. Must separate.

F. India - Emerging

No Supreme Court DPDP case yet, but principle from Puttaswamy (2017) privacy as fundamental right, and Planet49 logic applied by MeitY. DPDP Rules 2025 require Consent Manager architecture - first country to mandate centralized consent dashboard.

4. Compliant Architecture Blueprint 2026

Front-end:

• Layer 1: No pre-ticked, 3 buttons - Accept All / Reject All / Manage (equal prominence, same clicks)
• Layer 2: Purpose toggles - Strictly Necessary [always on], Functionality, Analytics, Marketing, Personalization - each OFF by default
• No cookie wall - Access cannot be conditional on consent unless offering paid alternative (EDPB 2023)

Back-end:

Code

User Click -> CMP generates Consent Receipt (ISO 29184) {  id, timestamp, banner_version, purposes[], vendors[],   proof: clickstream_hash, user_agent} -> Store in Consent Lake (7 year retention)-> Fire Consent Mode signals: 

3 lines hidden

Governance:

• Recordkeeping under Art 30
• DPIA if large-scale tracking
• Consent Manager integration for India
• Quarterly audit for dark patterns - EDPB Dark Patterns Guidelines 2023

The shift: From 2018 "Do we have consent?" to 2026 "Can we PROVE consent architecture is valid, granular, prior, and propagatable?"