1. Why It Happens

1. Siloed legal bases: Web collects on Art.6(1)(a) consent, CRM runs on legitimate interest, store runs on contract. Art.7 requires you cannot swap bases.
2. Granularity failure: Consent on channel A for marketing email + analytics bundled, channel B asks only for analytics. EDPB Guidelines 05/2020 says consent must be granular per purpose and per controller.
3. Withdrawal asymmetry: User withdraws on app, but cookie banner on web still shows consent. Art.7(3) says withdrawal must be as easy as giving and effective everywhere.

2. Legal Standard - What Valid Cross-Channel Consent Must Be

From GDPR Art.4(11), Art.7 and ePrivacy Art.5(3):

• Freely given: No detriment if you refuse on one channel - C-61/19
• Specific: Separate tick for each purpose - cannot bundle sale + cookies - Planet49 AG opinion
• Informed and Unambiguous: Active behaviour - pre-ticked = invalid
• Provable: Controller must be able to demonstrate consent across channels - Art.7(1)
• Synchronized: If consent is withdrawn on one channel, processing on all channels relying on same consent becomes unlawful - C-129/21 Proximus

EDPB: If you collected under old law and it doesn't meet GDPR standard, you must refresh consent. You cannot switch from consent to legitimate interest later - Recital 171.

3. Key Case Law

A. Foundation Cases - Invalid Consent Mechanism

C-673/17 Planet49 GmbH - 1 Oct 2019 - Germany
Planet49 had lottery: checkbox 1 - participate [must tick], checkbox 2 - install cookies [pre-ticked].
CJEU: Pre-ticked boxes do NOT constitute valid consent. Consent for participation and consent for cookies are two different processing activities, cannot be bundled through single click.

C-61/19 Orange Romania - 11 Nov 2020
Orange inserted clause in mobile contracts: "I have been informed and consent to storage of ID copy". Box pre-ticked by dealer.
CJEU: Controller must prove active behaviour. Contract clause does not prove consent. If refusing requires filling extra form, freedom is unduly affected, consent not freely given. Led to AEPD's biggest fines in Spain for similar pattern.

C-40/17 Fashion ID - 29 July 2019
Website embedding Facebook Like button. CJEU: Website operator is joint controller with Facebook for collection and transmission. So consent obtained on website channel does NOT cover Facebook's downstream use unless both inform jointly. Classic cross-channel inconsistency between publisher and ad network.

B. Cross-Channel Withdrawal & Propagation - The Core for Your Question

C-129/21 Proximus (Public electronic directories) - 27 Oct 2022 - This is THE cross-channel case
Belgian telco Proximus got consent to publish number in its directory, then shared it with other directory providers. Subscriber withdrew consent with Proximus.

CJEU:

1. Publication is only lawful if express consent given to operator OR to that provider - Art.6(1)(a)
2. Withdrawal is exercise of Art.17 Right to Erasure
3. Art.5(2), Art.24, Art.19 GDPR obliges controller who received withdrawal to inform other controllers by appropriate technical and organisational measures that consent was withdrawn.

If user withdraws on channel A, you must propagate to channel B, C, D. Failure = unlawful processing on all channels.

This is now enforced in Spain under LOPDGDD Art.12.

C-252/21 Meta Platforms v Bundeskartellamt - 4 July 2023
Meta collected data cross-channel: Facebook + Instagram + WhatsApp + off- Facebook via Pixel, and merged for ads without separate consent.
CJEU: Cross-channel aggregation for personalised ads cannot rely on contract or legitimate interest. Requires freely given consent per purpose, and dominance creates power imbalance - consent not free. Must offer equivalent service without cross-channel tracking.

C-604/22 IAB Europe TCF + Brussels Court of Appeal 14 May 2025 - Case 2022/AR/292
TCF string used by 80% of EU sites to store cross-channel ad consent for Real-Time Bidding.
Belgian DPA 2022: €250k fine. CJEU 7 March 2024: TC String = personal data, IAB Europe = joint controller.
Brussels Market Court May 2025 upheld: TCF violates GDPR - lack of transparency, no legal basis, purpose bundling across hundreds of vendors. Google, Amazon, Microsoft, X tracking-based ads using TCF has no legal basis.

This kills the excuse "we had consent on CMP channel".

C. Spanish Enforcement - AEPD

PS/00226/2020 - CaixaBank €2,100,000
Bank obtained consent in branch contract for all processing - marketing, profiling, cross-sell. Also pre-ticked boxes in online banking.
AEPD: Merged consent and contract bases - violation Art.7(4) - conditionality. Two fines: €2M for Art.6 infringement + €100k for pre-ticked boxes. Perfect example of offline contract vs online channel inconsistency.

PS/00089/2021 - Orange España €150,000 -> €90,000
After complaints, investigation found bulk commercial SMS/emails sent without adequate consent because consent collected on web channel not verifiable and not synchronized with CRM opt-out list. Breach Art.6 and 7.

PS/00421/2020
Financial entity fined €5,000 for sending commercial communications after user opted-out on another channel - breach of Spanish LSSI Art.21 (transposes ePrivacy).

CNIL SAN-2021-023 Google LLC €150M + SAN-2021-024 Facebook €60M
Refusing cookies as difficult as accepting - asymmetric design = not freely given. Cross-channel: accept on YouTube = consent applied to Google Search without new choice.

4. Legal Framework to Fix Inconsistency in Spain

Under Spain LSSI Art.21 + LOPDGDD:

1. Single Consent ID: Must have unified preference center keyed to identity (email/phone), not device. Withdrawal must update all systems within 24h - AEPD guidance.
2. No Dark Patterns: Accept all / Reject all must be same layer, same clicks - EDPB 03/2022 on deceptive design.
3. Granular logging: For each channel, log timestamp, text shown, purposes ticked - Art.7(1) accountability.
4. Propagation protocol: As per Proximus C-129/21, if consent source is directory A, you must notify B, C via API. For marketing, if CRM is source of truth, website CMP must query CRM before firing tags.

If you have inconsistency today:

• The strictest state wins: if user said NO on ANY channel for that purpose, you must treat as NO everywhere.
• You cannot re-ask for consent on other channel to override NO unless you prove 6-month gap and new context - EDPB says repeated requests after refusal makes consent not free.