# Consent and data-sharing trails across a franchise and marketplace network
A customer buys running shoes from a "local" sporting goods store. That store is a franchisee. The transaction actually runs through a marketplace platform (think a listing fulfilled via a third-party seller account). Loyalty points post to a program co-branded by the franchisor and a bank. Four entities now hold a piece of that customer's data: the franchisee, the franchisor, the marketplace, and the loyalty partner. When the customer later emails "please delete my data," which of the four actually does it? In practice: often none of them, because each assumes someone else owns the request.
This is the accountability gap this lesson is built to help you spot.
Consent, in data protection terms, is a legally valid basis for collecting or using personal data, usually meaning the person clearly agreed to a specific use. It sits alongside other legal bases like "contract necessity" or "legitimate interest."
The problem: consent is captured once, at one touchpoint, but personal data usually flows through several independent legal entities afterward.
Each hop can be legitimate. The failure happens when consent scope doesn't travel *with* the data. A customer who agreed to "receive offers from Store X" did not necessarily agree to "have purchase history shared with Bank Y's loyalty engine."
United States: no single federal privacy law. Instead, a patchwork:
Europe: the General Data Protection Regulation (GDPR), enforced by national Data Protection Authorities (DPAs, e.g. France's CNIL, Ireland's DPC). Key concepts:
The EU's Digital Markets Act (DMA) and marketplace-specific obligations under the Digital Services Act (DSA) also now push large marketplaces to be more transparent about seller data practices, relevant when a franchisee sells via a big platform.
1. The "consent laundering" pattern. A franchisee collects an email at checkout for a receipt. The franchisor's CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → (customer relationship managementcustomer relationship managementCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → system) later enrolls that email into a national loyalty program with marketing consent nobody explicitly gave. Under GDPR this is a purpose-limitation violation; under CCPA/CPRA it can be an undisclosed "sharing" issue.
2. The "marketplace shield" pattern. A franchisee sells through a marketplace and assumes the marketplace's privacy policy covers everything. It usually doesn't. Marketplaces typically restrict what data (name, address, order history) they release to third-party sellers precisely to prevent sellers from building their own unauthorized customer databases. A franchisee that scrapes or exports marketplace order data into its own loyalty CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → without a valid basis is exposed, and importantly, so is the franchisor if it instructed that behavior.
3. The "silent joint controller" pattern. Franchisor and franchisee jointly decide loyalty program mechanics (a hallmark of joint control under GDPR Article 26), but only the franchisor's privacy notice is customer-facing. If there's a breach, regulators can, and have, held both liable, even though the customer only ever saw one brand.
For a governance review of a franchise/marketplace/loyalty chain, walk the data like a forensic trail:
1. Map the touchpoints. List every entity that touches the data: POS system, franchisor CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →, marketplace order feed, loyalty partner, any ad-tech pixel on the checkout page.
2. Match each touchpoint to a consent record. Was consent captured at that specific point, for that specific purpose? A generic "I agree to terms" checkbox rarely satisfies GDPR's requirement for specific, informed, freely given consent.
3. Check contracts, not just policies. Is there a Data Processing Agreement between franchisor and franchisee? Between franchisor and loyalty partner? Absence of a DPA is a common audit finding.
4. Test the deletion/opt-out path end to end. Submit a real request (in a sandbox or test account) and time how long it takes to propagate to all four systems. GDPR generally requires a response within one month; CCPA/CPRA generally requires action within 45 days (extendable once). If the loyalty partner's database still has the record after that, you have a live compliance gap, not a theoretical one.
5. Check retention limits. Data kept "just in case" past its stated purpose is a common regulator target, e.g. the CNIL and UK ICO have both fined retailers for over-retention.
A simple internal check script (pseudocode, illustrative only):
for each customer_id flagged "deletion_requested":
check franchisee_pos_db.status(customer_id)
check franchisor_crm.status(customer_id)
check loyalty_partner_feed.status(customer_id)
check marketplace_export_cache.status(customer_id)
flag if any status != "deleted"This is the kind of trail an internal auditor or a DPA investigator will reconstruct after a breach, mapping not just *what* data moved, but *who authorized* each hop.
Vérification des acquis
1. In the franchise/marketplace scenario, why does a customer's 'delete my data' request often go unfulfilled by any party?
2. Under GDPR terminology as used in the lesson, what defines a 'controller'?
3. Why can consent captured at a single touchpoint fail to cover the full data journey in a franchise/marketplace network?
4. Select ALL correct answers about the entities involved in the running shoes example.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about why consent and data-sharing trails break down across franchise and marketplace networks.
Sélectionnez toutes les réponses correctes.
Say a franchisee's POS vendor suffers a breach exposing 50,000 loyalty member records, including purchase history synced from the marketplace. Who's accountable?
Regulators generally look at *who decided the purpose and means* of processing, not who happened to store the server. This is why due diligence on franchise agreements (who owns the loyalty database, who can be sued) matters as much as the technical security review.
For a readable primer on these controller/processor distinctions, the UK ICO's guidance on controllers and processors is a solid free resource, and translates reasonably well to how EU regulators think.
GDPR Explained in Simple Terms