Consent Was the Receipt, Not the Inspection: Privacy Enforcement Has Quietly Moved From Disclosure to Attestation

A restaurant that nails its recipes to the front door has told you everything and guaranteed nothing. For fifteen years, that was the internet's privacy model: exhaustive disclosure, zero inspection. The regulatory architecture now being assembled on both sides of the Atlantic replaces the recipe card with a health inspector — and, more consequentially, with a named executive who signs the inspection report.

What the Dockets Actually Show

Five separate instruments have converged into a single enforcement posture: California's Delete Act deletion mechanism, which obliges registered data brokers to process consumer deletion requests on a recurring 45-day cycle from 1 August 2026; the California Privacy Protection Agency's automated decision-making technology (ADMT), risk-assessment and cybersecurity-audit regulations, effective 1 January 2026 with ADMT compliance phasing to 1 January 2027; the EU Data Act's Article 3(1) design duty, which bites on connected products placed on the market from 12 September 2026; the European Commission's Digital Omnibus proposal of 19 November 2025, which would amend GDPR rather than repeal it; and an enforcement ledger — Ireland's €530 million TikTok decision, France's €325 million Google penalty, Texas's $1.375 billion settlement with Google — that has stopped treating disclosure defects as clerical. Read together, they move the compliance obligation from what an organisation publishes to what it can prove.

Deletion Becomes a Machine-to-Machine Obligation

The underexamined shift in the Delete Act is not the consumer right; it is the transport layer. Once a centralised mechanism issues deletion instructions at statutory cadence, deletion stops being a ticket handled by a privacy inbox and becomes an idempotent API contract that must succeed across every downstream system that ever received the record. Most enterprise stacks cannot satisfy that. Deletion propagates cleanly through a production Postgres table and dies at the analytics warehouse, the CDP segment export, the ad-platform audience, the twelve-month rolling backup, and the vector index built from support transcripts. The brokers who will fail first are not the recalcitrant ones — recalcitrant actors at least know they are exposed — but the competent ones whose data lineage inventories stop at the boundary of their own VPC. The statutory penalty accrues per request, per day. That arithmetic, not the headline fine, is what will reprice the data-brokerage sector.

Brussels Is Simplifying. That Is Not the Same as Retreating.

The prevailing sell-side reading of the Digital Omnibus — that Europe has blinked and compliance budgets can be trimmed — is a category error. The Omnibus is a legislative proposal in trilogue, not enacted law, and its most contested elements (a legitimate-interest basis for model training, a narrowed definition of personal data for pseudonymised records, a raised breach-notification threshold) are precisely the provisions that supervisory authorities have signalled they will resist. More importantly, the GDPR's floor is constitutional rather than statutory: Article 8 of the Charter and the Court of Justice's jurisprudence constrain how far the legislature may dilute core concepts. Operators who decommission transfer impact assessments or lineage tooling on the strength of a proposal will find that the obligation they cancelled was never solely statutory. Simplification of paperwork is not relaxation of liability, and the two are being conflated in board decks with unusual speed.

Telemetry Is Now a Product Liability Surface

The Data Act's design duty and the Federal Trade Commission's January 2025 order against General Motors point at the same target from opposite directions. The GM order restricted the disclosure of driving-behaviour data to consumer reporting agencies for five years — a remedy aimed at an output, not a breach. The Data Act, by contrast, mandates the input: a connected product placed on the EU market must be built so that its data is accessible by design. Privacy engineering therefore migrates out of the legal department and into the bill of materials, where it competes with unit cost and time-to-market. Firms that treated telemetry as a free by-product of shipping hardware now face a retrofit obligation with a hard placement date, and firmware teams are discovering that access controls retrofitted after certification are markedly more expensive than those specified before it.

The standard the Court of Justice set in Schrems II (C-311/18) was never adequacy of paperwork. Third-country protection must be "essentially equivalent" to that guaranteed within the Union — a test applied to foreign law and practice, not to the elegance of a controller's standard contractual clauses.

The Precedent Is Sarbanes-Oxley, Not GDPR

The instructive analogue is the 2002 American accounting reform, not the 2018 European privacy regulation. Sarbanes-Oxley did not invent financial disclosure; it attached personal, non-delegable attestation to it, and in doing so converted the audit from a vendor procurement exercise into a chief-executive risk. The compliance industry that followed was not primarily a legal industry — it was a controls-testing industry, and it consolidated around firms that could evidence control operation rather than assert control existence. The CPPA's risk-assessment regime reproduces that mechanism almost exactly, including executive sign-off. The lesson from the post-Enron period is uncomfortable for privacy teams: the budget went to whoever owned the evidence pipeline, and the general counsel's office became a consumer of that pipeline rather than its author. Expect the same reallocation, and expect it to inure to internal audit and platform engineering, not to the privacy office.

"Data Residency" Was Never the Control

The most expensive misreading in the current enforcement ledger concerns Ireland's TikTok decision. The €530 million penalty comprised €485 million for the transfer infringement and €45 million for transparency failures, and it turned on remote access to EEA-stored data from China. Storage location was not the violation; the access path was. That collapses the central assumption of a decade of sovereign-cloud procurement — that selecting a Frankfurt or Dublin region discharges Chapter V. It does not, if a support engineer, an on-call SRE, or a model-evaluation contractor can reach the same records from a third country. The corrected control is cryptographic and organisational rather than geographic: customer-held keys, just-in-time access with recorded justification, and support workflows that operate on redacted replicas. Vendors selling region pinning as a transfer solution are selling a control that a regulator has already priced at nearly half a billion euros.

The Case Against the Deletion Maximalists

None of this is unambiguously consumer-welfare-positive, and the advocacy framing should be resisted. Aggressive deletion cadences collide with statutory retention duties under anti-money-laundering and sanctions regimes, and a deletion request is itself an attack surface: without robust identity verification, a universal deletion mechanism becomes a denial-of-service tool against a named individual's records. There is a distributional problem too. Compliance cost is largely fixed, which advantages incumbents holding large first-party datasets over challengers who must license data. Europe's own experience with consent banners illustrates the outcome — measurable friction for users, measurable consolidation among the largest platforms. The honest position is that these instruments will reduce certain harms while entrenching certain firms, and pretending otherwise weakens the case for enforcing them well.

What Operators Should Do Before the Next Filing Cycle

• Trace deletion to the leaves. Instrument a synthetic deletion request end-to-end and time it through warehouses, backups, sub-processors and embeddings. If you cannot produce that trace, you cannot produce the evidence an attestation regime will demand.
• Reclassify remote access as a transfer. Audit every support and engineering path into EEA or California-resident data by origin country, not by storage region. Convert standing access to just-in-time, logged, key-mediated access.
• Freeze the Omnibus assumption. Maintain current GDPR controls until text is adopted and published. Model the simplification as upside in the forecast, never as relief in the control register.
• Gate hardware on Article 3(1). Any connected product with a placement date after 12 September 2026 needs its data-access design signed off before certification, not after.
• Name the signatory now. Identify the executive who will attest, and give that person budget authority over the evidence pipeline. That is the Sarbanes-Oxley lesson, and it is cheaper to learn early.

The Next Two Quarters

Expect the first Delete Act cadence audits to produce a wave of narrow, technical enforcement against mid-sized brokers whose sub-processor graphs outran their lineage tools, and expect at least one large action framed around failure to honour the 45-day cycle rather than around a breach. Expect the ADMT deadline of 1 January 2027 to trigger a procurement rush in model documentation and bias-testing tooling through the first half of the year, with pricing to match. Expect the Omnibus fight to concentrate on the pseudonymisation definition, because that single clause determines whether most European analytics stacks are processing personal data at all. And expect the adequacy question to return to Luxembourg by appeal rather than to rest on the General Court's 2025 dismissal. The direction of travel is settled even where the text is not: the receipt is being replaced by the inspection, and the inspection has a signature line.