Consent is a product decision, not a legal formality

The customer layer is a shared context of visits, preferences and feedback. Assembling it technically is not hard. The hard part is different: making sure a person understands what they agreed to and does not regret it a month later.

A checkbox is not consent

Formally a tick satisfies the law. Practically it tells the person nothing: they do not know what will be collected, why, or what will change in their experience. Such consent is legally valid and substantively empty.

Our test is simple: if we would have to explain after the fact why we know something about a person, the consent was badly designed. The moment of asking has to be legible without commentary.

“Consent that has to be explained after it was used was not consent.”

We only ask for what we can act on

The temptation to collect for later is strong: storing data is cheaper than gathering it again. We refused it. The internal rule: if we cannot name a concrete operating action that a data field changes today, the field is not collected.

• There is an action — we collect: visit history changes what a person is offered at their location.
• The action is only planned — we do not collect: the hypothesis is first tested on aggregate data without identification.
• There is no action — we never collect, even if the field “might come in handy”.

What the person gets in return

Consent is an exchange, and the other side of it must be visible. If someone allowed their visits to be linked, they should notice the difference: in speed of service, in not being asked the same thing twice, in an offer that matches what they actually order.

Until that difference is noticeable, we consider that we have not earned an expansion. The constraint is deliberate: it slows the growth of the customer layer and protects against collecting for the sake of collecting.

Withdrawal must be equally simple

The asymmetry between “agree in one tap” and “withdraw by writing to support” is also a product decision — just a dishonest one. We keep both paths at the same level of effort and treat that as part of the standard, not a concession to a regulator.

Our customer layer is in pilot status. That means exactly what it says: it is tested in a limited loop, and we do not publish its coverage before verification.