TL;DR
A free consent manager deployed in 2018 had stopped meeting the latest requirements of the French data-protection authority (CNIL). On a platform the French control bodies inspect regularly, that was a live risk. I rebuilt it solo, as an engineering task, and six months after full deployment a real CNIL control raised no requirements or problems.
The situation as found
In 2018, as Wengo‘s parent group integrated the General Data Protection Regulation (GDPR), it deployed the most advanced and simplest consent manager then available, QuantCast, because it was free. That rollout is told as its own case study; here it is only background.
I was Associate Director at MyBestPro when the rebuild started, in 2020. The risk was not hypothetical. Wengo leads the marketplace connecting individuals with professionals, in a sector largely tied to fortune-telling and astrology, and the French control bodies inspected it regularly, so a finding would have been held against the company. That is what governance under constraint names.
By then the shortcut had aged into exposure, and nobody had scoped the fix:
- A free tool in production, with no guarantee.
- A market position that made a control likely, not theoretical.
- No budget, no vendor decision, and no owner.
The diagnosis
The symptom presented simply: the consent manager is outdated. The real cause was different. The cheapest option at procurement carried no compliance guarantee; the requirement kept moving, as the CNIL guidance tightened while the free tool did not. The saving was the cost.
Compliance here is also a system, not a document. Wengo runs multiple localized sites in eight languages: FR, ES, IT, NL, DE, PT, EN, and TR. A compliant consent flow had to work across those locales and still not damage audiences in world regions outside the GDPR’s reach.
What was decided, and why
Two answers were live. Patching or tuning the incumbent was rejected: it no longer met the requirements, so a tool change could not change the exposure. Replacing one free tool with another was rejected for the reason the first choice had failed: no guarantee, and no support.
I chose instead a purpose-built European consent-management provider, Consent Manager, selected through a comparison table I built against explicit criteria: versatility, functionality, quality/price ratio, and adaptability to Wengo’s multi-site ecosystem. The data protection officer (DPO) and management backed it; a meeting won the vendor and the budget. I negotiated the license directly with the vendor’s France representative, calibrated to the platform’s needs, with a trial period and extended Early Adopter rights in France. I did this alone, working through the development team and each localized site’s marketing team.
What was actually built or changed
Before replacing anything, I studied the CNIL’s published minimum obligations and the discretion it leaves a site publisher, then made Cookie Policy recommendations to the DPO and management.
The rebuild then ran on four things:
- Documentation and setup. I implemented the adapted JavaScript tag and documented the setup for the development team, with Wengo’s parameters.
- A setup built to maintain. I replicated what could be replicated and versioned the user-consent popups across the web screens, so a change would not undo an earlier fix.
- Translations and deployment. I coordinated each localized site’s marketing team, then replaced QuantCast Choice with Consent Manager across the sites.
- Ongoing tuning. I monitored performance and usage statistics and adjusted over time through the same popup versioning.
What broke, and what was got wrong
The honest friction is the 2018 decision. It was not my choice then, yet its consequence was mine to carry: an inherited shortcut turned real risk.
The operational friction was the surface. One compliant system had to stay coherent across eight locales, each translation coming from a different site’s marketing team, with popups versioned so a change never regressed an earlier fix. On top of that, I had to win a vendor and a budget nobody had scoped before the technical work could start.
The outcome, with its status
The sites reached optimum compliance, balancing European and French obligations against minimizing the impact on audiences, especially in regions outside the GDPR’s reach. Then the proof: a real CNIL control six months after full deployment raised no requirements or problems on the consent-collection method or the Wengo Cookie Policy. That is the scope behind who I am.
Stated with its limit: Wengo kept using Consent Manager throughout my tenure, and it survived my departure because I left a “set it and forget it” maintenance setup and a filmed handover. I do not claim to know how it ran after I left. Keeping a system working after its builder moves on is the promise behind systems that scale.
If this is the shape of your problem, let’s talk.