A typical mobile pipeline looks like this: the app process starts, the analytics SDK wakes, events land in a local disk queue, a worker flushes to HTTPS, a collector writes to object storage, a job loads a warehouse, a BI tool counts rows. Consent-aware design inserts a gate at the first durable step, not at the last dashboard.
If app_open is already on disk before the CMP returns, you are processing personal data on a hope. Even “anonymous” payloads often carry advertising identifiers, vendor IDs, or coarse location that a Thai controller would struggle to call anonymous under PDPA. The studio inventory exercise exists because this pattern is common, not rare.
Three mechanical changes
Gate before enqueue. The wrapper asks: is there a recorded basis for this event class? If not, the event does not enter the durable queue. In-memory diagnostics without identifiers may still exist for crash quality; they die with the process.
A dead-letter for revoke. When a user withdraws, in-flight batches and warehouse rows need a path that is not “leave them for completeness.” Completeness is not a lawful purpose. A dead-letter or purge job with an SLA is part of the pipeline, not a legal afterthought.
Reports that may be empty. Downstream jobs should not impute opted-out people back into funnels. Publish an “instrumented sessions” series next to MAU so leadership can see the gap. Pretending the gap is measurement error is how last-click models quietly rebuild identity.
What does not count
Server-side stitching that ignores a CMP reject, fingerprinting as a “quality signal,” and vendor defaults that retain advertising identifiers for 26 months are not consent-aware variants. They are the old pipeline with a new slide.
In Consent Architecture, week nine is spent on warehouse honesty. The homework is ugly on purpose: a dashboard with a hole. Fellows who try to fill the hole with modelled users fail the critique. That failure is the lesson.
Further reading in this journal: deny-by-default layers and attribution after opt-out.