Consent that follows the person: what privacy teams are missing

TL;DR: Modern privacy enforcement fails when consent is tied to browsers, verified through extra steps, or left without durable downstream proof, according to Ketch’s analysis, because regulators care whether consumer intent is honored end to end. The architectural break is now between request capture and verifiable enforcement, not between privacy policy and user interface.

Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “What Transcend can’t do and why that becomes your problem”.

Key questions

Q: What breaks when opt-outs are browser-bound instead of person-bound?

A: Browser-bound opt-outs break when the same person returns through another device, browser, or session and the original choice no longer follows them.

Q: Why do post-submission verification steps create privacy compliance risk?

A: Because once a valid opt-out exists, extra friction can delay enforcement or cause abandonment before the request is completed.

Q: How do security teams know consent governance is actually working?

A: They should look for evidence that banner choices, tag behaviour, and audit records all align across every relevant flow.

Practitioner guidance

• Implement person-level consent storage Store opt-outs and consent decisions against the individual, not only against a browser, session, or device identifier, so the same choice can follow the person across contexts.
• Remove post-submission verification for valid opt-outs Eliminate email confirmation, redirects, or other extra steps once a valid opt-out has been submitted, because those steps create abandonment and delay in regulated workflows.
• Test cross-device enforcement paths Run the same consumer journey on two browsers and two devices, then confirm the opt-out persists and changes downstream processing in each path without manual intervention.

Bottom line: Privacy programmes fail when they treat consent as a local event instead of a person-level control that survives across devices, browsers, and downstream systems.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →