Design Privacy Consent Management

Medium45 min
1 / 30
understanding•7 min read

Problem Statement and Consent Management Mission

Problem Statement and Consent Management Mission — privacy consent management system design interview section.

Problem Statement and Consent Management Mission

Design a Consent Management Platform (CMP) like OneTrust/TrustArc/Cookiebot: capture, store, prove, and enforce privacy choices across web, mobile, and server-side tags—not a marketing preference center alone.

  • Separate legal consent from product settings; marketing email opt-out is not GDPR Article 6 consent.
  • Support granular purposes (analytics, ads, personalization) with versioned policy text hashes.
  • Every decision needs a tamper-evident audit trail for regulators and enterprise customers.

Mechanism

Publishers embed a lightweight tag; CMP resolves jurisdiction, renders lawful basis, persists granular consent strings (IAB TCF v2.2 / GPP), and propagates decisions to ad-tech and analytics within seconds.

Failure drills

If geo-IP misclassifies EU visitors, default to strict opt-in and log geo_fallback=strict. If consent string write succeeds but Kafka lag exceeds 30s, block personalized ad calls at edge—never fire tags on stale consent. If subject re-identifies across devices without link graph, treat as separate subjects until explicit login merge. If regulator requests proof export and Merkle root mismatches, freeze marketing activation for that tenant.

Cost and capacity

SignalTarget
Banner loads/day420M
Purposes tracked12K
DSAR/month85K
Proof retention7y
javaOne Dark Pro
1public record ConsentSignal(String subjectId, String purposeId, String legalBasis, boolean granted, long epochMs) {}
2// mission
pythonOne Dark Pro
1def enforce_purpose(signal: dict, requested: str) -> bool:
2    return requested in signal.get("granted_purposes", []) and not signal.get("withdrawn")
3# mission
typescriptOne Dark Pro
1export interface ConsentRecord { id: string; subjectId: string; purposeId: string; granted: boolean; jurisdiction: string; proofHash: string; }
2// mission

Why interviewers care

Privacy Consent Management interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and Consent Management Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

  • •Problem Statement and Consent Management Mission
  • •Metrics: Banner loads/day, Purposes tracked, DSAR/month, Proof retention
  • •Publishers embed a lightweight tag; CMP resolves jurisdiction, renders l
Interview tip
When discussing mission, cite measurable SLAs and regulator-facing artifacts—not vendor slogans.
Avoid
Equating marketing unsubscribes with ad/analytics consent or deleting withdrawal history.

Section Rescue Kit

Buzzwords to use:

TC stringProof manifest

Safe statements:

  • "For Problem Statement and Consent Management Mission, I separate policy versioning from immutable consent events."
  • "Withdrawals propagate to edge enforcement before partner webhooks complete."
  • "Geo uncertainty defaults to strict opt-in, not maximum tracking."
Design Privacy Consent Management - System Design | WinJob | WinJob