# Consent architecture for telecom marketing and third-party sharing
A regulator walks into a telco's data protection office and asks for one thing: show me the exact consent record for a customer who received a promotional SMS eighteen months ago, and prove that the same customer never agreed to have their location data sold to an ad-tech broker. If the compliance team has to dig through three disconnected systems and a spreadsheet of opt-outs, the audit is already lost. This lesson teaches you to build consent architecture that survives that moment, not just a lawyer's sign-off before launch.
Telecom operators sit on three categories of sensitive data that most industries never touch simultaneously: call detail records (CDRs, logs of who called whom, when, and for how long), precise network-based location data (triangulated from cell towers, accurate to tens or hundreds of meters), and browsing or app-usage metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). visible at the network layer. This is why telecom-specific rules exist on top of general privacy law.
In the EU, the ePrivacy Directive (2002/58/EC, still in force pending the long-delayed ePrivacy Regulation) governs electronic communications specifically, while the GDPR
The practical consequence: a single customer relationship generates at least three legally distinct consent events, and they cannot share one checkbox.
1. SMS and direct marketing consent. Governed by TCPA in the US and ePrivacy/GDPR in the EU. Requires opt-in (EU) or documented prior express written consent (US, for marketing texts). Must be revocable instantly, and revocation (a customer texting "STOP") must propagate to every downstream marketing system within a defined window, not just the SMS gateway.
2. Ad-tech and third-party data sharing consent. This covers selling or sharing CPNI-derived or behavioral data with data brokers, ad exchanges, or measurement partners. Under GDPR this typically requires explicit consent as the legal basis (Article 6(1)(a)) since "legitimate interest" rarely survives scrutiny for third-party sale. Under the CPNI rules, sharing outside the immediate carrier relationship generally requires opt-in consent, not opt-out. This is the domain where telcos like AT&T and Verizon have faced FCC settlements historically for location data sold to aggregators without adequate consent controls.
3. Network-based advertising (NBA) consent. This is the telco using its own network signals (location, browsing metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition)., app usage) to build ad profiles, either for its own ad products or a joint venture. It is legally distinct from domain 2 because the telco is the data controller acting on its own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.Voir la définition complète →, not exporting it. NBA programs (Verizon's now-retired "Relevant Mail" precedent, or current carrier ad platforms) require separate, granular consent because the data source (network-level metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition).) is more sensitive than typical web cookies.
Why they can't be merged: a customer can rationally accept SMS offers while refusing ad-tech sharing and refusing network-based profiling. A single "I agree to marketing" checkbox conflates three different legal bases, three different revocation paths, and three different audit trails. Regulators including the UK's ICO (Information Commissioner's Office) and Ireland's DPC (Data Protection Commission, lead GDPR regulator for many US tech and telecom EU operations) have penalized bundled consent as invalid under GDPR's requirement that consent be "specific" (Article 4(11)).
A defensible consent management platform (CMP) stores, per customer, per domain, at minimum:
A simplified consent record schemaschemaA schema is the formal blueprint that defines how data is structured, named, typed, and related within a database, file, or message.Voir la définition complète →:
{
"customer_id": "hashed_id_9182",
"consent_domain": "adtech_sharing",
"status": "opted_out",
"legal_basis": "gdpr_art6_1a_consent",
"captured_channel": "web_account_portal",
"consent_text_version": "v3.2_2025-11",
"timestamp": "2026-01-14T09:32:00Z",
"propagated_to": ["crm_system", "adtech_partner_feed", "sms_gateway"],
"propagation_confirmed": true,
"last_sync": "2026-01-14T09:34:12Z"
}The propagation fields matter most in practice. Most consent failures are not bad legal drafting, they are integration failures: a customer opts out in the app, but the nightly batch job to the ad-tech vendor runs on a 24-hour lag, and the vendor serves a targeted ad in that window. Auditors, especially the FTC in enforcement actions, look for the gap between "consent captured" and "consent enforced."
For a practical framework on lawful bases and consent standards, the UK ICO's guidance is one of the clearer public resources: ICO Guide to PECR and consent.
Vérification des acquis
1. Why can't a telecom operator rely on a single consent checkbox to cover marketing SMS, location data sharing, and CDR-based analytics?
2. A regulator asks a telco to prove a customer never consented to having their location data sold to an ad-tech broker. What does this scenario primarily illustrate about consent architecture?
3. In the EU, why must telecom operators satisfy both the ePrivacy Directive and the GDPR rather than just one of them?
4. Select ALL correct answers about why telecom consent is more complex than typical retail consent.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about US regulatory bodies and laws relevant to telecom marketing and data sharing.
Sélectionnez toutes les réponses correctes.
The most common failure mode is not malicious data sale, it is legacy architecture. A telco that grew through mergers (common across US regional carriers and European operators consolidating markets) often inherits three or four separate CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → and billing systems, each with its own idea of "marketing consent." When a new ad-tech partnership launches, engineers wire it to whichever system is easiest to integrate, not the authoritative consent source. The fix is a single consent orchestration layer that every downstream system must query in real time (or near-real time) before acting, rather than each system holding its own cached copy of consent status.
A second failure mode: treating consent as binary rollout of a "consent banner" project rather than an ongoing operational control. Consent architecture needs the same change-management discipline as billing systems: version control, rollback capability, and regression testing when new data uses are added.