The Real Problem Isn't Technical – It's Intentional
Last week, I wrote <a href="https://www.linkedin.com/pulse/defence-eprivacy-directive-53-privacys-last-stand-christiansen-iruie/">in defense of ePrivacy Directive Article 5(3)</a> - the only EU legal provision that protects users before tracking begins. The response was clear: privacy professionals understand its value, but many businesses either don’t - or worse - actively ignore it.
This week, I want to go deeper. Because tracking before consent isn't just an oversight. It's a feature of the current digital advertising model. And the industry's favorite tools – including Google Tag Manager and Consent Mode 2.0 – are being used to simulate compliance, not enforce it.
<h2>What ePrivacy Directive 5(3) Actually Says</h2>
Before we go further, let’s be clear: Article 5(3) is not about cookies. It’s about any access to or storage of information on a user’s device, whether or not personal data is involved. This includes:
<ul>
<li aria-level="1">Loading third-party scripts</li>
<li aria-level="1">Embedding beacons or SDKs</li>
<li aria-level="1">Collecting telemetry or device signals</li>
<li aria-level="1">Executing fingerprinting code</li>
</ul>
Unless it's strictly necessary for the service requested (e.g., login, shopping cart), it requires prior informed consent. GDPR applies after. ePrivacy Directive 5(3) comes first.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/what-eprivacy-directive-53-actually-says.png" alt="what eprivacy directive 53 actually says" width="1536" height="1024" />
<h2>What Happens on Most Websites Today?</h2>
Breaking it down, here’s what actually happens the moment a user lands on a typical website:
<ol>
<li aria-level="1">Google Tag Manager (GTM) loads immediately, often in the header.</li>
<li aria-level="1">GTM injects other scripts: Google Analytics, Facebook Pixel, LinkedIn Insight Tag, Hubspot, Hotjar, etc.</li>
<li aria-level="1">Some sites use Google Consent Mode 2.0 - which claims to defer data collection until consent is given.</li>
<li aria-level="1">But GTM has already loaded. Third-party domains have already been contacted. Scripts have run. Devices have been accessed.</li>
</ol>
Consent hasn't even been asked for yet.
This is not compliant with the ePrivacy Directive Article 5(3).
It’s tracking before consent. Plain and simple.
<h3>Consent Mode ≠ Consent</h3>
Let’s debunk the Consent Mode 2.0 myth.
“Consent Mode lets you run all your tags in a compliant way, while respecting user choice.”
That sounds nice. But here’s what actually happens:
<ul>
<li aria-level="1">GTM loads as a first-party script (from www.googletagmanager.com).</li>
<li aria-level="1">Tags like gtag.js, ads/ga-audiences, or collect?v=... are conditionally fired, but scripts and domains are still initialized.</li>
<li aria-level="1">Even in “denied” mode, telemetry and anonymized signals can be collected – and linked later.</li>
<li aria-level="1">Worse, many websites configure Consent Mode to 'assume consent' until it’s explicitly denied.</li>
</ul>
It’s not a bug. It’s a dark pattern wrapped in a compliance-friendly wrapper.
<h3>Enter: Cookie Consent as a Service (CCaaS) – The Theatre of Compliance</h3>
Now let’s address the other half of the illusion: Cookie Consent banners – often provided by Consent Management Platforms (CMPs) like OneTrust, Cookiebot, CookieInformation, TrustArc, and similar vendors.
These services position themselves as compliance tools. But in most implementations, they are part of the consent theatre. Here's why:
<h4>1. Scripts Already Load Before Consent Is Given</h4>
Most CMPs do not block GTM or other tracking scripts by default. Instead, they load with the site, and merely signal preferences after third-party access has already occurred. This violates ePrivacy Directive 5(3).
<h4>2. Visual Consent ≠ Technical Enforcement</h4>
The banner might ask for your permission to use analytics or marketing cookies. But unless script loading is gated, that data is already being collected, or the tracker has already "touched" your device - even if just to generate a fingerprint or store a default ID.
<h4>3. “Essential” Categories Are Misused</h4>
Most CMPs allow website owners to mark trackers as "essential" - avoiding consent entirely. This loophole is abused heavily. Tag managers, CDNs, and analytics frameworks are regularly misclassified to bypass user consent.
<h4>4. Most CMPs Are Not Transparent</h4>
CMPs rarely disclose what scripts are running at what point in the lifecycle. Users assume that saying “no” blocks tracking. But unless the site implements strict pre-consent gating, it doesn’t. And CMPs don’t verify or audit that logic - because it’s not in their business interest.
<h4>5. Consent Is Required for All Tracking Technologies – Not Just Cookies</h4>
Too many implementations treat cookie consent as synonymous with privacy compliance - but tracking is not limited to cookies. Beacons, fingerprinting scripts, local storage, telemetry APIs, and session replay tools can all access or store data on a device.
Under the ePrivacy Directive Article 5(3), all tracking technologies require prior informed consent unless they are strictly necessary. CMPs and Consent Mode flows that focus only on cookie categories ignore the broader scope of what the law actually covers.
“If your site blocks cookies but still allows fingerprinting scripts or session data access, you're not compliant - you're just cookie-washing surveillance.”
<h4>6. Many Cookie Consent Services Are Trackers Themselves</h4>
Ironically, many Consent Management Platforms (CMPs) and Cookie Consent as a Service (CCaaS) providers operate as third-party services - and embed their own pixel trackers or scripts into websites. This means:
<ul>
<li aria-level="1">Their domains are contacted on first load (before any user action).</li>
<li aria-level="1">They often drop their own cookies or collect telemetry (device type, locale, IP, etc.) to “optimize” or “audit” consent interactions.</li>
<li aria-level="1">This constitutes third-party access to the user’s device without consent - exactly what they claim to protect against.</li>
</ul>
When your CMP vendor requires a call to their external domain and executes JavaScript before consent, they become part of the violation - not part of the solution.
“You can’t outsource consent to a service that tracks users before they give it.”
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/the-real-problem-isnt-technical-its-intentional.png" alt="the real problem isnt technical its intentional" width="1536" height="1024" />
<h3>It’s All Connected: CMPs + Consent Mode = A Pretend Consent Loop</h3>
Here's how the architecture works in reality:
<ul>
<li aria-level="1">GTM is preloaded, acting as the vehicle for third-party access.</li>
<li aria-level="1">A CMP (CCaaS) visually asks the user for consent.</li>
<li aria-level="1">Google Consent Mode receives the user's choice after the fact, and adjusts data labeling - but does not retroactively stop what has already happened.</li>
<li aria-level="1">Meanwhile, first-party and third-party servers have already seen device requests, and in many cases, set up tracking identifiers, cookies, or other session elements.</li>
</ul>
This is not privacy by design. It's tracking by default, consent by UX overlay.
And because it's standardized across large platforms, it's scalable non-compliance. Millions of websites are complicit, and most users are unaware.
<h3>This Is By Design – Not Accident</h3>
Why is it so widespread?
Because this design keeps the data flowing.
<ul>
<li aria-level="1">Advertisers want to capture behavior from the first second.</li>
<li aria-level="1">Personalization engines want to log device signals and interaction history.</li>
<li aria-level="1">CDPs and data brokers want identifiers, even if they start "pseudonymous."</li>
</ul>
In this ecosystem, real prior consent is a threat. It delays tracking, shrinks datasets, and cuts off third-party access.
That’s why most CMPs are built to preserve tracking, not prevent it.
<h3>Enforcement Failure: Why It Persists</h3>
We already have the law. But we don’t have the enforcement.
Most Data Protection Authorities (DPAs) lack the technical infrastructure to perform deep inspections of what scripts do at runtime. They see cookies, not what JavaScript does. They review the consent text, not whether access occurred before it was given.
Until we automate technical audits and enforce real-time violations, the current model will persist.
That’s why regulatory enforcement must evolve. And that’s where Privacy Monitoring solutions come in.
<h3>We Need First-Party Alternatives, Not Third-Party Excuses</h3>
At AesirX, we’ve built an entirely first-party consent, analytics, and tag management system – compliant by design with both GDPR and ePrivacy Directive 5(3):
<ul>
<li aria-level="1">No third-party access until consent is granted.</li>
<li aria-level="1">No pre-consent tracking or device access.</li>
<li aria-level="1">Fully transparent, auditable, and open-source.</li>
<li aria-level="1">Prevents GTM from loading until after Consent is given.</li>
</ul>
We don't need to "balance" user rights with tracking profits. We need to design systems that respect rights by default.
If We Don’t Enforce 5(3), Consent Dies in Practice
We’re not in a post-cookie world. We’re in a pre-consent tracking world. And unless we defend Article 5(3), we will lose the only legal shield that blocks tracking at the door.
GDPR starts after the data flows.
The ePrivacy Directive is the only thing that can stop it before it begins.
Repealing 5(3) won’t simplify compliance. It will legalize surveillance at the infrastructure level.
And that’s not innovation.
That’s surrender.
<h3>It’s Time to Stop Pretending</h3>
To those who call Article 5(3) outdated:
It’s not outdated. It’s inconvenient for those whose business depends on ignoring consent.
To those building digital products:
Build them privacy-first, not privacy-later. Your users deserve consent that’s real, not retroactive.
To regulators:
Don’t just review banners. Inspect the scripts. Audit what happens before consent is ever given. That’s where the real violations start.
And to the industry at large:
Cookie Consent banners won’t save you from non-compliance. If GTM or any third-party tracker loads before consent, you’re already in violation – no matter how pretty your UX is.
If tracking happens before I say yes, I was never given a choice at all.
Ronni K. Gothard Christiansen Technical Compliance Engineer &amp; CEO @ AesirX
<hr />
<h3>Take the First Step Toward Real Compliance</h3>
If you’re using WordPress and want to ensure your site truly respects privacy – before consent is given – we’ve built a first-party Consent Management Platform that does exactly that.
It’s easy to install, doesn’t rely on third-party trackers, and helps you comply with both GDPR and ePrivacy Directive 5(3) from the first page load.
Try it free for 14 days and see the difference real consent makes:&nbsp;<a href="https://aesirx.io/solutions/consent-management-platform">https://aesirx.io/solutions/consent-management-platform</a>

Tracking before consent is a feature of the current digital advertising model. ePrivacy 5(3) is the last protection users have before tracking begins

Tracking Before Consent: It’s the Business Model

Tracking Before Consent: It’s Not Just a Bug. It’s the Business Model

Blog Aesirx

Article 5(3) of the ePrivacy Directive protects users before device access, but it’s being deliberately undermined by the digital advertising industry.

The Only Law That Stops Tracking Before It Starts
There’s a growing push to dismantle Article 5(3) of the ePrivacy Directive - the so-called “cookie law.” Critics argue it’s outdated, redundant because of the GDPR, and a burden to digital business.
That argument misses the mark entirely.
Article 5(3) is the only EU legal provision that restricts the technical act of tracking – before any data is stored, accessed, or classified. It applies to all device access, not just cookies. That includes scripts, pixels, SDKs, and beacons, regardless of whether they store personal data. The GDPR only applies after data becomes “personal.” By then, the damage is done.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
“If we lose ePrivacy 5(3), we lose the only legal control users have before tracking begins. GDPR doesn’t replace it. It follows after.” - Ronni K. Gothard Christiansen
</div>
<h2>What’s really happening in practice?</h2>
Modern tracking often avoids cookies entirely. Server-side tag managers, fingerprinting, and telemetry data collection are embedded on first page load. Consent Mode 2.0, as deployed on most large websites, still loads the full GTM framework by default - analytics, ads, and even third-party beacons.
Consent is delayed, but data is already flowing. Few websites defer loading until after consent, even though it’s possible. This isn’t a technical limitation. It’s a design choice - one made to preserve marketing data at the cost of user rights.
And under GDPR alone, it’s hard to stop. Most of this data isn't “personal” at the moment of capture. Profiling happens later, in backend systems and ad networks. The GDPR kicks in downstream. Article 5(3) is the only regulation that stops access upfront.
<h2>So why the push to kill it?</h2>
Because 5(3) gets in the way. It forces businesses to ask for consent before loading surveillance tech. It reduces default data capture, breaks dark pattern consent flows, and limits third-party tracking. It’s a legal roadblock to surveillance capitalism.
Repealing or weakening 5(3) won’t help consumers. It will simply make it easier for BigTech and ad brokers to extract more behavioral data by default.
Let’s be honest about the trade-offs:
<ul>
<li aria-level="1">Privacy isn't the problem. Non-compliance is.</li>
<li aria-level="1">Poor implementation of consent banners isn’t a reason to remove consent requirements.</li>
<li aria-level="1">Consent Mode that collects data before consent is not compliance. It’s privacy theatre.</li>
</ul>
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/where_eprivacy-5-3-and-gdpr-actually-apply.png" alt="where eprivacy 5 3 and gdpr actually apply" width="1536" height="953" />
<h3>We don’t need fewer rules. We need better enforcement.</h3>
Instead of dismantling 5(3), we should be scanning websites, auditing scripts, and enforcing technical compliance. We should stop loading third-party trackers until after informed consent. And we should move toward first-party solutions that respect user rights by design.
At <a href="https://aesirx.io" target="_blank" rel="noopener">AesirX</a>, we’ve built a full <a href="https://www.aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">first-party alternative to adtech dependency</a>. Consent, <a href="https://www.aesirx.io/solutions/analytics" target="_blank" rel="noopener">analytics</a>, and tagging - all privacy-first and fully GDPR + ePrivacy-compliant.
<h3>We’re not in a “post-cookie” world. We’re in a pre-consent tracking world.</h3>
If we abandon Article 5(3), there’s nothing left to protect users before they’re tracked.
That’s not privacy. That’s surrender.
Ronni K. Gothard Christiansen, AesirX.io
If you are in doubt if your website or e-commerce solution is loading beacons and other tracking technologies before consent is given you can check it in our <a href="https://aesirx.io/services/privacy-scanner">free privacy scanner</a>.

Why repealing ePrivacy 5(3) would gut the only EU law that blocks tracking before consent. GDPR isn’t enough. Users need real protection – at the start.

In Defence of ePrivacy Directive 5(3): The Last Stand

In Defence of ePrivacy Directive 5(3): Privacy’s Last Stand

ePrivacy 5(3) is the only EU law that blocks tracking before consent. Without it, users are exposed before GDPR applies. Don’t scrap real privacy protection.

AesirX Consent Management Platform (CMP) for WordPress v1.7.0 introduces a powerful set of updates designed for site admins, developers, and agencies who need greater flexibility in managing privacy compliance – whether locally or across multiple regions.
This release focuses on enhanced configuration capabilities – allowing you to define and automate consent behavior based on time zone, browser language, and legal jurisdiction, all from within your CMP dashboard.
With full support for both opt-in and opt-out models and new handling of Global Privacy Control (GPC) signals, your site can now apply consent requirements dynamically with no custom coding or third-party scripts needed.
Whether you’re maintaining GDPR compliance in the EU, supporting CPRA requirements in California, or delivering localized consent experiences for a multilingual audience, AesirX CMP v1.7.0 gives you the tools to do it all, reliably and at scale.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update?
Read: <a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v-1-6-0-configurable-consent-logic-and-more-languages" target="_blank" rel="noopener">AesirX CMP for WordPress v1.6.0: Configurable Consent Logic and More Languages</a>
</div>
<h2>What’s New in v1.7.0?</h2>
<h3>Regional Handling – Language and Time Zone-Based Enforcement Settings</h3>
<a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.7.0" target="_blank" rel="noopener">AesirX CMP Version 1.7.0</a> introduces enhanced regional configuration capabilities, allowing your consent setup to automatically adjust based on the user’s location and legal environment. This includes:
Time zone detection to apply region-specific consent behavior
AesirX Consent Management Platform can now detect the user's time zone and apply the appropriate consent logic automatically – whether opt-in (e.g. GDPR regions) or opt-out (e.g. California).
→&nbsp;Benefit: You don’t need to hard-code regional rules. The system dynamically aligns with local laws, reducing configuration time and lowering your compliance risk.
<h4>Language configuration to present modals and choices in the user’s native language</h4>
Modals, buttons, and privacy choices are displayed in the user’s browser language or country-specific setting.
→&nbsp;Benefit:&nbsp;This ensures users understand what they’re consenting to – meeting legal requirements for informed consent and improving trust by providing a more transparent, localized experience.
&nbsp;<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-language-configuration-and-time-zone-aware-consent.png" alt="aesirx cmp language configuration and time zone aware consent" width="1876" height="1328" />
AesirX CMP: Language configuration and Time Zone-Aware Consent
<h3>8 More Languages Now Supported (Total 25)</h3>
To support an even broader audience, this release adds eight new languages:
Languages added:
<ul>
<li aria-level="1">Finnish (FI)</li>
<li aria-level="1">Romanian (RO)</li>
<li aria-level="1">Hungarian (HU)</li>
<li aria-level="1">Indonesian (ID)</li>
<li aria-level="1">Hebrew (HE)</li>
<li aria-level="1">Czech (CS)</li>
<li aria-level="1">Greek (EL)</li>
<li aria-level="1">Malay (MS)</li>
</ul>
<h4>Why this matters:</h4>
Under privacy laws like the GDPR and the ePrivacy Directive, valid consent requires that users clearly understand what they are agreeing to. That includes presenting consent information in a language the user understands. By supporting 25 languages (with more to come), <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">AesirX CMP</a> helps businesses meet this requirement – delivering localized consent dialogs that improve comprehension, reduce legal risk, and support valid user consent across jurisdictions.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-multi-language-cmp.png" alt="aesirx cmp multi language cmp" width="1876" height="1328" />
<h2>Upcoming Features</h2>
After v1.7.0’s release, our roadmap continues with key enhancements:
<ul>
<li aria-level="1">Advanced Consent Analytics:&nbsp;Gain deeper insight into consent behavior with extended compliance logging and reporting capabilities.</li>
</ul>
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know:
Read: <a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener">California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations.</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
➡ Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.7.0" target="_blank" rel="noopener">AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.7.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via GitHub.
<hr />
Sources:
<a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679">Eur-LEX: General Data Protection Regulation</a>

AesirX CMP for WordPress v1.7.0: Smarter Regional Compliance with Enhanced Configuration Capabilities

Press Release Aesirx

AesirX CMP for WordPress v1.7.0 adds time zone-aware consent logic, time zone detection, and 25 languages for smarter, more flexible privacy compliance.

AesirX CMP for WordPress v1.7.0

Each week, more businesses implement “cookie banners” thinking they’ve done what’s required for privacy compliance. But there’s a growing misunderstanding in the industry - one that creates real legal risk:
Consent banners alone do not make your website compliant.
Why? Because it's not just about cookies. It’s about all tracking technologies.
That includes:
<ul>
<li aria-level="1">Beacons</li>
<li aria-level="1">Pixels</li>
<li aria-level="1">JavaScript-based tracking</li>
<li aria-level="1">SDKs</li>
<li aria-level="1">Server-side tracking</li>
<li aria-level="1">Tag management systems (TMS)</li>
</ul>
Every one of these methods can collect personal data, and many are activated before a user has given valid consent.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/consent-banners-alone-do-not-make-your-website-compliant.png" alt="consent banners alone do not make your website compliant" width="2400" height="1260" />
<h2>The Legal Foundation: ePrivacy Directive and National Laws</h2>
Article 5(3) of the ePrivacy Directive (as implemented in national laws like the UK's PECR, Norway’s Ekomloven, Vietnam's PDPL and other countries with clear consent requirements) requires that storing or accessing information on a user’s device may only take place with the user’s prior consent, unless it's strictly necessary for the service the user has requested.
Consent under both the ePrivacy Directive and GDPR must be:
<ul>
<li aria-level="1">Freely given</li>
<li aria-level="1">Specific</li>
<li aria-level="1">Informed</li>
<li aria-level="1">Unambiguous</li>
</ul>
This means any tracking technology - whether it places a cookie or not - cannot be activated before consent has been obtained.
And yet, server-side tagging and tag management systems like Google Tag Manager are regularly implemented in a way that pre-loads third-party trackers or sends data to external vendors before the user has had the opportunity to understand or agree to that processing.
If the user isn’t aware, and hasn’t agreed to the full scope of tracking, consent is invalid.
<h2>Server-Side Tagging and Google Tag Manager: Compliance Concerns</h2>
Server-side tracking and tag management systems are often presented as privacy-preserving alternatives. But the reality is more nuanced:
These solutions still process and route personal data - often to third parties such as Google, Facebook, or other advertising networks.
In many cases, data is collected and transmitted regardless of user consent, simply because scripts are embedded server-side or controlled from a centralized tag manager. Without proper control and enforcement mechanisms, these tools can become invisible vectors of non-compliant tracking.
One key example is Google Tag Manager (GTM). When GTM is loaded, it immediately results in the transfer of the user's IP address and potentially exposes the entire DOM and Data Layer to Google. This constitutes personal data processing under both the ePrivacy Directive (ePD) and GDPR as well as other legal foundations.
“As such, GTM cannot be legally loaded before consent is obtained - because it enables the access and transfer of data not strictly necessary for delivering the service the user requested.”
It’s also worth emphasizing:
“Moving GTM (or any tracking logic) to a first-party environment does not eliminate the requirement for consent.”
Under Article 5(3) of the ePrivacy Directive (PECR, Ekomloven, PDPL, etc.), any collection or access to information from a user’s device - first-party or third-party - that is not strictly technically necessary, requires prior consent. This includes analytics, personalization, marketing, and performance tracking.
Using these tools does not bypass the need for explicit, informed, prior consent. If tracking or data transmission happens before that, it is a clear breach of the ePrivacy Directive.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Read more:
<a href="https://www.linkedin.com/pulse/your-cookie-banner-lying-you-ronni-k-gothard-christiansen-etcie/" target="_blank" rel="noopener">Your Cookie Banner is Lying to You</a>
</div>
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/bonnier-news-ab-fined-13-million-sek-by-the-swedish-authorities.png" alt="bonnier news ab fined 13 million sek by the swedish authorities" width="2400" height="1260" />
<h2>Real-World Enforcement: Bonnier AB Case</h2>
This is not theoretical - regulators are now enforcing this aggressively.
In November 2023, Bonnier News AB was fined 13 million SEK by the Swedish Authority for Privacy Protection (IMY) and <a href="https://www.linkedin.com/pulse/full-analysis-imy-case-against-bonnier-news-ab-moment-christiansen-8xiqc/">ruled by Forvaltningsretten</a> in Stockholm February 2025. Why?
<ul>
<li aria-level="1">They collected consent for the use of cookies for certain purposes.</li>
<li aria-level="1">But once data was collected, it was shared with multiple third parties.</li>
<li aria-level="1">That data was used for additional purposes beyond those explicitly consented to.</li>
</ul>
The IMY made it clear: consent must match the actual processing. If consent is obtained for one purpose and data is later shared or reused for others, it is a violation of GDPR and ePrivacy.
This case highlights the growing risk of mismatched consent - something that’s especially common when using tag managers, complex marketing stacks, or third-party tracking solutions.
<h2>Enforcement is Scaling: Automated Monitoring is Here</h2>
The regulatory landscape is rapidly shifting:
<ul>
<li aria-level="1">The UK ICO has started <a href="https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-takes-action-to-tackle-cookie-compliance-across-the-uk-s-top-1-000-websites/">systematically monitoring the top 1,000 websites</a> in the country.</li>
<li aria-level="1">The Dutch DPA is doing the same for the <a href="https://www.linkedin.com/posts/ronnikc_ap-waarschuwt-50-organisaties-om-misleidende-activity-7317867442410532864-jy75?utm_source=share&amp;utm_medium=member_desktop&amp;rcm=ACoAAAGAuZQBE5WKyUehmu2_z0IQ9ReAwrh9NRY">top 10,000 websites in the Netherlands</a>.</li>
<li aria-level="1">Other DPAs are expected to follow suit, adopting automated, ongoing scanning of public websites.</li>
</ul>
This is significant. Unlike the GDPR, where compliance is often assessed via internal documentation and process audits, ePrivacy Directive compliance is technical - and binary:
You are either compliant, or you are not.
<ul>
<li aria-level="1">Tracking occurs before consent? You're in breach.</li>
<li aria-level="1">Data is shared without the proper legal basis? You're in breach.</li>
<li aria-level="1">Your consent banner doesn’t reflect actual tracking behavior? You're in breach.</li>
</ul>
There is no in-between.
<h2>Continuous Monitoring Is Now Essential</h2>
At AesirX, we anticipated this shift and built our <a href="https://aesirx.io/services/privacy-monitoring/why-privacy-monitoring">Privacy Monitoring Service</a> accordingly.
We provide:
<ul>
<li aria-level="1">Continuous scanning of your website to identify unauthorized trackers</li>
<li aria-level="1">Detection of server-side and tag-managed tracking that bypasses consent</li>
<li aria-level="1">Real-time alerts when new technologies are embedded that may put you at risk</li>
</ul>
Your website is constantly changing - marketing teams deploy new tools, developers push updates, vendors introduce tracking scripts via integrations. Without continuous oversight, your site can become non-compliant overnight.
Privacy is not a one-time project. It’s an ongoing responsibility.
<h2>Key Takeaways for Compliance</h2>
<ul>
<li aria-level="1">If your compliance strategy starts and ends with a cookie banner, it’s insufficient.</li>
<li aria-level="1">If your server-side tagging or tag manager loads third-party scripts before consent, it’s unlawful.</li>
<li aria-level="1">If your actual data processing exceeds the scope of what users consented to, it's a violation.</li>
</ul>
Today’s regulatory landscape demands transparency, technical accuracy, and continuous monitoring.
That’s not just best practice - it’s now a requirement.
If you want to discuss how AesirX can help keep your site compliant as technology changes, <a href="https://aesirx.io/contact" target="_blank" rel="noopener">feel free to connect</a>.
Ronni K. Gothard Christiansen Technical Compliance Engineer &amp; CEO, AesirX.io

Consent banners alone don’t make your site compliant. It’s not just cookies – unmanaged tracking tech puts your business at legal risk.

No, It's Not Just Cookies – It's All Tracking Technologies

It’s not just cookies – tracking tech like pixels, beacons, and GTM also need consent under GDPR and ePrivacy Directive. Regulators are now enforcing this.

We’re excited to announce the release of <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.6.0">AesirX Consent Management Platform (CMP) for WordPress v1.6.0</a> – delivering even more flexibility and usability to support global compliance.
This update introduces configurable consent logic for opt-in/opt-out control, giving site administrators the ability to align tracking behavior with jurisdictional requirements – whether operating under GDPR in Europe or CCPA in California. It also adds eight new languages, helping more users understand and manage consent in their native language.
As regulations continue to evolve across GDPR, ePrivacy Directive, CCPA/CPRA, and more, AesirX CMP stays ahead – giving you the tools to comply without compromising user trust or data transparency.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update?
Read:<a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v1-5-0-consent-logging-and-more-customizable-user-control" target="_blank" rel="noopener"> AesirX CMP for WordPress v1.5.0: Consent Logging and More Customizable User Control</a>
</div>
<h2>What’s New in v1.6.0?</h2>
<h3>Configurable Consent Logic: Opt-In / Opt-Out Control</h3>
This version introduces Configurable Consent Logic, giving site owners and legal teams control over how consent is handled based on jurisdictional requirements. Whether you operate in Europe, California, or globally, your site can now be configured to comply with local laws and user expectations.
How it works:
⮕&nbsp;Choose between opt-in and opt-out models directly within the CMP dashboard.
⮕&nbsp;Opt-in is required under GDPR and the ePrivacy Directive (EU), meaning no tracking until consent is explicitly given.
⮕&nbsp;Opt-out is permitted under laws like California’s CCPA/CPRA, where tracking may occur until users actively opt out.
⮕&nbsp;Easily switch logic based on your legal, regional, or operational needs.
Why this matters:
Consent obligations vary across legal frameworks. In the EU, the GDPR and ePrivacy Directive require an opt-in model, where no tracking occurs until a user explicitly consents.
In the U.S., California’s CPRA (California Privacy Protection Agency) follows an opt-out model, allowing data collection by default – but requiring businesses to provide a clear opt-out mechanism.
Under CPRA, businesses must honor:
– Manual opt-out actions (e.g. clicking a “Do Not Sell or Share My Personal Information” link or opt-ing out directly), and
– Automated opt-out preference signals like Global Privacy Control (GPC) – which must be processed without adding friction or requiring extra steps from the user.
This makes consent logic configuration a compliance-critical feature. With AesirX CMP, you can:
<ol>
<li aria-level="1">Choose between opt-in or opt-out modes based on jurisdiction.</li>
<li aria-level="1">Support CPRA requirements by aligning site behavior with opt-out obligations.</li>
<li aria-level="1">Get ready for advanced features that will enable automatic regional logic and GPC-based behavior in future releases.</li>
</ol>
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/AesirX_CMP_for_WordPress_v1-6-0_-_Graphic_1.png" alt="AesirX CMP: Configurable Consent Logic: Opt-In / Opt-Out Control" width="938" height="664" />
AesirX CMP: Configurable Consent Logic: Opt-In / Opt-Out Control
<h3>8 More Languages Added</h3>
AesirX CMP v1.6.0 continues our commitment to accessibility and global usability by adding support for eight more languages – making it easier for users across the world to make informed consent decisions in their native tongue.
Languages added:
⮕&nbsp;Portuguese (PT)
⮕&nbsp;Italian (IT)
⮕&nbsp;Japanese (JA)
⮕&nbsp;Polish (PL)
⮕&nbsp;Turkish (TR)
⮕&nbsp;Arabic (AR)
⮕&nbsp;Thai (TH)
⮕&nbsp;Korean (KO)
Why this matters:
Localized interfaces improve user trust and legal clarity. With each new language, your website’s compliance setup becomes more inclusive and effective. We're on track to support over 25 languages in total by the end of the month.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/AesirX_CMP_for_WordPress_v1-6-0_-_Graphic_2.png" alt="AesirX CMP for WordPress v1 6 0 Graphic 2" width="1876" height="1328" />
AesirX CMP: Languages available
<h2>Upcoming Features</h2>
After v1.6.0’s release, our roadmap continues with key enhancements:
<ul>
<li aria-level="1">Regional Handling - Multi-Language and Time Zone-Aware Consent Logic</li>
</ul>
We're extending our configurable consent logic to support region-aware consent behavior.
Coming soon:
<ul>
<li aria-level="1">Time zone-based settings to adjust opt-in/opt-out logic based on user location.</li>
<li aria-level="1">Regional integration of Global Privacy Control (GPC).</li>
<li aria-level="1">Multi-language handling per country and region to reflect local preferences.</li>
</ul>
This update will further localize the CMP experience, offering precision control over consent rules by geography.
<ul>
<li aria-level="1">Advanced Consent Analytics</li>
</ul>
Gain deeper insight into consent behavior with extended compliance logging and reporting capabilities.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know: 
Read:&nbsp;<a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener">California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations.</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.6.0">AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io"></a><a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.6.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via <a href="https://github.com/aesirxio">GitHub</a>.
<hr />
Sources:
<a href="https://www.uniconsent.com/blog/ccpa-opt-out-preference-signal">CCPA: What is Opt-Out Preference Signal (OOPS)</a>
<a href="https://www.reuters.com/legal/legalindustry/privacy-tug-of-war-states-grappling-with-divergent-consent-standards-2025-03-27">The privacy tug-of-war: States grappling with divergent consent standards</a>
<a href="https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB3048">AB-3048 California Consumer Privacy Act of 2018: opt-out preference signal</a>

AesirX CMP for WordPress v1.6.0 enables opt-in/opt-out consent logic to meet GDPR, ePrivacy, CCPA, and local laws.

AesirX CMP 1.6.0: Custom Consent for GDPR & CCPA

The new AesirX CMP 1.6.0 release supports more languages and flexible consent logic tailored to global legal frameworks.

AesirX CMP 1.6.0: More Languages & Legal Models

AesirX CMP for WordPress v1.6.0: Configurable Consent Logic and More Languages

AesirX CMP for WordPress v1.6.0 with configurable opt-in/opt-out consent logic – giving full control to align with GDPR, ePD, CCPA, and regional legal models.

AesirX CMP for WordPress v1.6.0

It tells users they’re in control. It tells you you're compliant. But the truth? Most websites relying on third-party cookie banners aren’t even close.
They’re still tracking users before consent. They’re still exposed to legal risk. And they’re still treating privacy like a UX problem instead of a technical one.
Because here’s the reality: cookies are only part of the story.
Modern websites track using pixels, fingerprinting, local/session storage, embedded third-party tech, and server-side analytics. Most consent tools don’t even try to stop those. They’re built to look compliant, not be compliant.
<h2>The Dutch Data Protection Authority just made this clear.</h2>
This week, they warned 50 organizations - web shops, media companies, and insurers - to fix their cookie banners or face formal investigations and fines. These are the first 50 from a pool of 10,000 sites being actively monitored by the AP (<a href="https://autoriteitpersoonsgegevens.nl/actueel/ap-waarschuwt-50-organisaties-om-misleidende-cookiebanner">read here</a>).
They’re not guessing anymore. They’re scanning, checking, and demanding technical compliance.
And that’s exactly what we do at AesirX.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
“Technical compliance is binary; either it’s done right or it’s not.” – Ronni K. Gothard Christiansen, Creator of AesirX.io
</div>
<h2>This isn’t hypothetical. It’s happening every day.</h2>
Just last week, I helped a client untangle this exact mess.
They were using a popular third-party cookie banner - it looked clean, ticked all the boxes. But behind the scenes?
⮕&nbsp;14 third-party cookies firing before consent
⮕&nbsp;More than half were wrongly categorized
⮕&nbsp;And here’s the kicker: 23 beacons - pixel trackers, JavaScripts, SDKs - were loading silently, without any opt-in or even opt-out options
No transparency. No user choice. Just hidden tracking - exactly what regulators are looking for.
They thought they were compliant. But the reality? Their setup was a privacy risk waiting to be flagged - and fined.
Most websites aren’t malicious. They’re just relying on tools that don’t actually do the job.
<h2>Using the right tool for the job.</h2>
With AesirX CMP Pro, we’ve built a real privacy layer, not a pretty overlay. No shortcuts. No grey zones. Just tools that actually do what regulators require.
⮕&nbsp;Detects and blocks all tracking technologies (not just cookies)
⮕ Automatically respects GPC (Global Privacy Control) browser signals
⮕ Lets you define opt-in or opt-out logic per region
⮕&nbsp;Offers full consent logging and audit-ready tracking
⮕&nbsp;Already localized for key markets, with 33 languages rolling out in weekly sprints
⮕&nbsp;Transparent, customizable UI for real user control
<a href="https://aesirx.io/blog/press-release/aesirx-cmp-for-wordpress-v1-5-0-consent-logging-and-more-customizable-user-control">AesirX CMP 1.5.0</a> just launched with enhanced consent logging, better modal control, and 8 more languages. AesirX CMP 1.6.0 (coming this week) adds configurable logic for opt-in and opt-out setups. We're not just shipping features - we're building the infrastructure for global, technical compliance.
You can try <a href="https://aesirx.io/solutions/consent-management-platform">AesirX CMP Pro</a> completely free. Just download it from our <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/download/1.5.0/plg_aesirx_consent.zip">GitHub repository</a> and install it in WordPress. It takes minutes to configure - and it works from the first load. No credit card. No lock-in. Just 2 weeks of full access to see what real compliance looks like.
And if you're unsure where your site stands, run a scan with our <a href="https://aesirx.io/services/privacy-scanner">free Privacy Scanner</a>. It checks exactly what regulators are checking - and not just cookies.
Privacy is no longer optional. And now, doing nothing about it isn’t an option either..
Ronni K. Gothard Christiansen Technical Compliance Expert &amp; CEO, AesirX.io
&nbsp;
&nbsp;

Your cookie banner is lying to you

Most cookie banners look compliant but aren’t. AesirX CMP Pro blocks all tracking before consent – for real privacy compliance, not just appearances.

We’re excited to release <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.5.0" target="_blank" rel="noopener">AesirX Consent Management Platform (CMP) for WordPress v1.5.0</a>, continuing our mission to provide a transparent, privacy-first consent experience.
This version introduces a detailed consent logging view for transparency and audits, full text control across consent modal options for brand and legal alignment, a streamlined menu interface that simplifies setup and management, and eight new languages to support global user engagement.
As regulatory expectations grow across GDPR, ePrivacy Directive, CCPA/CPRA and beyond, AesirX CMP strengthens its position as a first-party, privacy-first consent management solution, and continues to evolve with features that support real compliance and informed user choices.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update? 
<a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v-1-4-0-gpc-compliance-now-supported" target="_blank" rel="noopener">Read: AesirX CMP for WordPress v1.4.0: GPC Compliance Now Supported</a>
</div>
<h2>What’s New in v1.5.0?</h2>
<h3>Improved Consent Logging View&nbsp;</h3>
A new backend consent logging view is available for transparency and audit readiness, now showing detailed logs of user consent actions like consent, revocation, and rejection. This not only helps site owners meet compliance requirements, but also reveals where users are choosing not to consent – offering valuable insights for improving how marketing data is collected.
How it works:
⮕&nbsp;Track timestamped records of when users gave consent, revocation, and rejection.
⮕ Explore visual consent trends over time with built-in charts and graphs for daily, weekly, or monthly breakdowns.
⮕&nbsp;Data is stored securely in the CMP database, and reports can be generated directly from the interface to support compliance efforts.
Why this matters:
Most CMPs lack meaningful visibility into how users interact with consent options. <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">AesirX Consent Management Platform</a> offers clear, structured insights into consent behavior – supporting both regulatory compliance, including audit readiness, and data strategy improvements.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-improved-consent-logging.png" alt="aesirx cmp improved consent logging" width="1200" height="628" />
AesirX CMP: Improved Consent Logging
<h3>Customizable Consent Modal: Full Text Control and Granular Consent&nbsp;</h3>
The Consent Modal Management view has been enhanced to give administrators full control over the consent experience. AesirX CMP now allows all modal text – across consent, detail, and reject views – to be customized directly within the platform, making it easy to align with your brand voice, legal requirements, and data strategy.
How it works:
⮕ Edit predefined text for Consent, Detail, and Reject views, including headings, descriptions, and benefits.
⮕ Customize messaging for options like “Reject”, “Consent”, and “Decentralized Consent”, including explanations of what each means.
⮕ Preview and reset individual sections, making it easy to test and adjust your modal content as needed.
Why this matters:
Most consent banners are rigid and generic. AesirX CMP lets you communicate transparently with users – explaining their choices, encouraging informed and fully compliant consent, and supporting advanced models like Decentralized Consent with privacy and rewards. Full text customization ensures that your consent modal reflects your specific data practices and values – improving clarity, trust, and user engagement.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-customize-reject-and-detail-text.png" alt="aesirx cmp customize reject and detail text" width="1200" height="628" />
AesirX CMP: Customize Reject and Detail Text
<h3>Simplified Configuration with New Menu and Views</h3>
To make setup easier, v1.5.0 introduces a reorganized admin structure with better navigation and access to key CMP features.
Updates include:
⮕ Streamlined top-level and sub-menu items for quicker configuration.
⮕&nbsp;Dedicated views for managing Consent Shield settings, reviewing detailed Consent Logs, and customizing text within the Consent Modal.
Why this matters:
Managing consent shouldn’t be complicated. These updates simplify backend workflows and reduce time spent on configuration and updates.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-new-menu-configuration.png" alt="aesirx cmp new menu configuration" width="1200" height="628" />
AesirX CMP: New Menu Configuration
&nbsp;
<h3>8 New Languages Now Supported</h3>
<a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.5.0" target="_blank" rel="noopener">AesirX CMP v1.5.0 </a>expands its language support to include eight additional translations, helping more users understand and manage consent preferences in their native language.
Languages added:
⮕&nbsp;German (DE)
⮕ Danish (DK)
⮕&nbsp;Spanish (ES)
⮕&nbsp;French (FR)
⮕ Dutch (NL)
⮕&nbsp;Norwegian (NO)
⮕&nbsp;Swedish (SE)
⮕&nbsp;Vietnamese (VI)
Why this matters:
Global compliance requires localized experiences. Multi-language support means that your CMP communicates clearly and legally across jurisdictions. More languages will be added in upcoming releases to reach 25+ by the end of the month.
<h2>Upcoming Features</h2>
After v1.5.0’s release, our roadmap continues with key enhancements:
<ul>
<li aria-level="1">Configurable Consent Logic</li>
</ul>
Set opt-in/opt-out behavior based on your site's specific legal or operational requirements.
<ul>
<li aria-level="1">Regional Handling</li>
</ul>
Enable location-aware consent models with multi-language and time zone support, including region-based GPC compliance.
<ul>
<li aria-level="1">Advanced Consent Analytics</li>
</ul>
Gain deeper insight into consent behavior with extended compliance logging and reporting capabilities.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know:
<a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener">Read California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations.</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
⮕&nbsp;Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases">&nbsp;AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.5.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via GitHub.

AesirX CMP v1.5.0 brings consent logging, UI customization, and multilingual support for better WordPress compliance.

AesirX CMP v1.5.0: Consent Logging for WordPress

Upgrade to AesirX CMP v1.5.0 for enhanced consent logs, customizable text, simplified settings, and 8 new languages.

New in AesirX CMP: More Control & Compliance Tools

AesirX CMP for WordPress v1.5.0: Consent Logging and More Customizable User Control

AesirX CMP for WordPress v1.5.0 adds consent logging, full text customization, simplified settings, and eight new languages for better compliance control.

AesirX CMP for WordPress v1.5.0

<h2>Where Privacy, Verification, and Data Ownership Converge</h2>
Privacy is no longer just a compliance checkbox – it’s the foundation of trust in the digital world. At AesirX, we've pioneered the Decentralized Seamless Compliant Business Model, a <a href="https://aesirx.io/solutions/analytics" target="_blank" rel="noopener" style="color: #1ab394;">privacy-first</a> framework that enables businesses to interact with consumers without processing or storing their personal data.
This approach is not only compliant by design - it’s built for long-term scalability and alignment with global digital identity standards.
The model is made possible by combining:
<ul>
<li aria-level="1">Blockchain-based digital identity (via Concordium and others)</li>
<li aria-level="1">Indirect Zero-Knowledge Proofs (ZKPs)</li>
<li aria-level="1">Decentralized Identifiers (DIDs)</li>
<li aria-level="1">EUDI Wallets and mDL Wallets</li>
<li aria-level="1"><a href="https://shield.aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">AesirX Shield of Privacy (SoP)</a></li>
<li aria-level="1"><a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener" style="color: #1ab394;">AesirX Consent Management Platform (CMP)</a></li>
</ul>
These technologies collectively redefine how personal data is verified and protected online- while remaining frictionless for the user and scalable for organizations.
<h2>Concordium + MitID + Shield of Privacy: Already Live and Proven</h2>
Two years ago, we became the first to integrate indirect Zero-Knowledge Proofs into a working identity and consent architecture - launching the first version of the <a href="https://shield.aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">AesirX Shield of Privacy</a> together with Concordium, a leading Layer 1 blockchain with built-in ID verification.
This milestone was achieved through Denmark’s MitID national eID system, allowing Danish citizens to:
<ul>
<li aria-level="1">Create a Concordium ID and wallet using MitID</li>
<li aria-level="1">Grant granular, revocable <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener" style="color: #1ab394;">consent using the AesirX CMP</a></li>
<li aria-level="1">And perform real-time age and country verification through our Shield of Privacy, without sharing their personal data</li>
</ul>
This working setup enables users to verify they are, for example, over 18 and living in Denmark - without exposing their birthdate or address. The business receives proof, not personal information, and does not become a data processor or controller.
This is not a prototype. It is live. It is operational. And it works.
<h2>Shield of Privacy: Redefining Online Credential Verification</h2>
At the heart of our framework is the AesirX Shield of Privacy, designed to act as a privacy firewall between the user and the digital service. The SoP enables:
<ul>
<li aria-level="1">Verification without exposure</li>
<li aria-level="1">Consent without loss of control</li>
<li aria-level="1">Compliance without risk of overreach</li>
</ul>
While many in the blockchain space still explore Zero-Knowledge Proofs for performance gains, we were the first to deploy indirect ZKPs as a privacy and compliance layer - specifically for protecting digital identities and enabling arms-length, compliant business models.
It gives businesses the ability to engage users in ways that respect privacy, eliminate liability, and build trust.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/shield-of-privacy-redefining-online-credential-verification.png" alt="shield of privacy redefining online credential verification" width="1200" height="628" />
<h2>Decentralized Identity Standards: EUDI Wallets and mDL Wallets</h2>
The global trend is moving in the same direction.
EUDI Wallets, under the European Union’s Digital Identity Framework, and mobile Driving License (mDL) Wallets, emerging globally under ISO standards, will soon allow users to store and present verifiable credentials on their devices.
Through integration with SoP and CMP, these wallets can be used to:
<ul>
<li aria-level="1">Confirm age eligibility</li>
<li aria-level="1">Prove country of residence</li>
<li aria-level="1">Secure access to regulated services</li>
</ul>
Without disclosing unnecessary information.
Without storing personal data in corporate databases.
And without shifting liability to businesses.
Our vision - and active development - ensures that indirect ZKPs and privacy-preserving verifications become standard capabilities of EUDI and mDL Wallets, just as we’ve proven with Concordium and MitID.
<h2>SoP + CMP: The Foundation of Privacy-Native Architecture</h2>
Together, our core privacy technologies create a secure, compliant, and user-controlled identity infrastructure:
<h3>AesirX CMP (Consent Management Platform)</h3>
Our <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener" style="color: #1ab394;">first-party CMP</a> enables direct, transparent consent handling between the website or e-commerce owner and the visitor. Consent is captured at the point of interaction and managed in a compliant, auditable way - without relying on third-party intermediaries.
When&nbsp;<a href="https://shield.aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">decentralized identity</a> is in use, the CMP can also support decentralized consent, where the wallet signs the consent request, delivering cryptographic proof of the user's intent.
Combined with the Shield of Privacy, this model ensures that consent is not only freely given and revocable, but also verifiable and privacy-respecting by design.
<h3>AesirX Shield of Privacy (SoP)</h3>
Verifications happen through indirect ZKPs, meaning businesses never see or store the underlying data. They receive only proof of compliance.
This stack allows any organization to:
<ul>
<li aria-level="1">Deliver regulation-compliant services (GDPR, ePrivacy, etc.)</li>
<li aria-level="1">Offer secure identity and age verification</li>
<li aria-level="1">Eliminate exposure to PII</li>
<li aria-level="1">Build trust through transparency and consent</li>
</ul>
<h2>Built to Scale Across Industries and Jurisdictions</h2>
Our architecture is adaptable across a wide range of sectors:
<ul>
<li aria-level="1">eCommerce: Age or region verification without user profiling</li>
<li aria-level="1">Gaming &amp; Media: Restricted content access with privacy safeguards</li>
<li aria-level="1">Financial Services: KYC light models through verified credentials</li>
<li aria-level="1">Public Sector: Government service access without centralized identity silos</li>
</ul>
What we've demonstrated in Denmark with Concordium + MitID is a working model - designed to scale and align with future identity standards globally.
<h2>The Opportunity for First Movers</h2>
We believe this is the future of digital interaction:
Compliant by design. Privacy-preserving by architecture. And completely user-centric.
We are now inviting forward-thinking organizations and companies - those who want to be first movers in privacy-first digital identity and compliance - to join us.
<h4>If you're exploring:</h4>
<ul>
<li aria-level="1">New ways to meet regulatory requirements</li>
<li aria-level="1">Secure onboarding and identity verification</li>
<li aria-level="1">Integration with EUDI Wallets, mDLs, or Concordium</li>
<li aria-level="1">Decentralized infrastructure and consent with zero data liability</li>
</ul>
We’d like to work with you.
Let’s explore how the Decentralized Seamless Compliant Business Model can be implemented in your organization today.
Ronni K. Gothard Christiansen CEO &amp; Technical Compliance Expert, AesirX.io
<hr />
References:
<ul>
<li aria-level="1"><a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener" style="color: #1ab394;">AesirX. Consent Management Platform</a>.&nbsp;</li>
<li aria-level="1"><a href="https://www.concordium.com" target="_blank" rel="noopener" style="color: #1ab394;">Concordium. Official Website</a>.&nbsp;</li>
<li aria-level="1"><a href="https://www.iso.org/standard/69084.html" target="_blank" rel="noopener" style="color: #1ab394;">International Organization for Standardization. ISO/IEC 18013-5:2021.</a></li>
<li><a href="https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation" target="_blank" rel="noopener" style="color: #1ab394;">European Commission. European Digital Identity (EUID) Regulation.</a>&nbsp;</li>
</ul>

The Decentralized, Seamless, Compliant Business Model

Verify users without storing their data. AesirX makes privacy-first, compliant interactions possible with its decentralized, compliant model.

Another week, another privacy scandal hidden in plain sight.
A <a href="https://innovation.consumerreports.org/Mixed-Signals-Many-Companies-May-Be-Ignoring-Opt-Out-Requests-Under-State-Privacy-Laws.pdf" target="_blank" rel="noopener" style="color: #1ab394;">new investigation</a> by Consumer Reports reveals that 30% of major brand-name retailers continued to serve targeted ads to consumers even after they sent valid Global Privacy Control (GPC) opt-out signals. Consumers followed the rules, exercised their "right to opt-out" – and were ignored! This is not a bug in the system; it’s the system itself.
But the deeper issue is not just poor compliance. It’s the false promise of opt-out privacy models.
Once your data is shared or sold, it's game over.
You can "opt-out" of future tracking, but there is no meaningful mechanism to claw back the data that’s already been sold, stored, profiled, or traded across a sprawling network of ad tech middlemen and Data Brokers.
The cat is out of the bag, and no "Delete My Data" button will ever fully put it back in.
<h2>The Reality of Opt-Out: A Broken System</h2>
The test in this report only scratched the surface. It focused narrowly on retargeting ads based on third-party cookies.
If the researchers had used more advanced methods (like active-active monitoring) and dug into server-side data sharing or ID matching, the non-compliance rate would not have stopped at 30% - it would likely have skyrocketed.
Because in reality:
<ul>
<li aria-level="1">Most opt-outs only stop the next cookie drop. They do not stop the downstream data trade.</li>
<li aria-level="1">There is no technical rollback of previously shared data. If data was sold yesterday, today's opt-out won't unsell it.</li>
<li aria-level="1">Compliance often focuses only on cookie banners, not the data supply chain. And that's where the real privacy breach happens.</li>
</ul>
<h2>Opt-In Is the Only Way Forward</h2>
The only meaningful way to protect consumers is through a default “No” position – where data collection, sharing, and profiling require clear, explicit, informed consent. Opt-in ensures that the data isn’t collected in the first place unless the user actively chooses to share it. That’s real control.
Anything less is a privacy charade. Opt-out mechanisms create an illusion that users can "take back" control – but it’s an after-the-fact, damage-control fantasy in a surveillance economy that runs on non-revocable, non-transparent data trading.
<h2>We Need to Change the Narrative</h2>
It’s time to stop debating how to enforce opt-out and start demanding opt-in as the default. Because when privacy is designed around revoking access to data after it's already leaked, we are not protecting consumers - we're protecting an outdated, exploitative business model.
If you care about meaningful privacy, the question isn’t "how do we improve opt-outs?" The question is: Why aren't we requiring opt-in everywhere?
Your data shouldn’t be a product unless you choose to sell it.
Ronni K. Gothard Christiansen CEO &amp; Technical Privacy Expert, AesirX.io

Why Opt-Out Fails: The Data Privacy Myth No One Wants to Talk About

Why do opt-out signals often fail? A new investigation exposes the privacy myth at the heart of data tracking – and why the system is built to ignore you

Press and Blogs

POPULAR TOPICS

Tracking Before Consent: It’s Not Just a Bug. It’s the Business Model

In Defence of ePrivacy Directive 5(3): Privacy’s Last Stand

AesirX CMP for WordPress v1.7.0: Smarter Regional Compliance with Enhanced Configuration Capabilities

No, It's Not Just Cookies – It's All Tracking Technologies

AesirX CMP for WordPress v1.6.0: Configurable Consent Logic and More Languages

Your cookie banner is lying to you

AesirX CMP for WordPress v1.5.0: Consent Logging and More Customizable User Control

The Decentralized, Seamless, Compliant Business Model

Why Opt-Out Fails: The Data Privacy Myth No One Wants to Talk About

Join the AesirX Partner Program

Solutions

Resources

Support

Partnership Opportunities