Consent to collect personal information has become the quiet assumption holding modern customer experience together. It’s captured at sign-up, reaffirmed in preference centers, referenced in policies, and then expected to travel seamlessly as customers move from web to app, from chatbot to contact center, from marketing journey to support escalation. In reality, it rarely does so cleanly as enterprises believe.
Across omnichannel environments, consent fragments as soon as customer data crosses system boundaries.
What starts out as a lawful, well-documented interaction can slowly degrade into a patchwork of partial permissions, duplicated records and orphaned data, creating privacy risk that quietly accumulates until a complaint or a regulator inquiry exposes it.
That is evident in data out of California’s California Privacy Protection Agency (CPPA), which, up to September 2025, had received 8,265 consumer complaints since launching a portal on its website in July 2023.
The rate of complaints has climbed from around 150 each a month to close to 150 per week, Michael Macko, Head of Enforcement at the CCPA, said at the agency’s annual meeting. More than half of the complaints involve the right to delete data, 44 percent relate to collection use and sharing of personal information, and 37 percent involve the right to limit data collection.
Where are companies going wrong?
Why Consent Is Breaking Down as Customer Journeys Get More Complex
Most large enterprises didn’t design their customer journeys unified systems. Omnichannel customer experience grew organically from accumulated tools. Marketing platforms, CRMs, contact center systems, analytics tools, and AI layers were all connected to optimize experience and efficiency rather than consistent privacy enforcement.
Consent is usually collected from customers at one or two defined moments, at account creation, newsletter opt-in, or cookie pop ups. From there, enterprises expect it to apply downstream.
But that assumption doesn’t necessarily align with customer expectations. As George Korizis, PwC US Principal, Customer & Enterprise Strategy, told CX Today:
“Capturing consent isn't the hard part. Governing it across a live, evolving ecosystem is.”
“The first blind spot: consent stays static while the experience keeps changing”.
“A customer opts in for one thing, and six months later their data is powering a use case no one re-checked permission for.”
Each handoff introduces risk. Different vendors store consent in different formats. Some treat it as a binary flag, others as metadata, others as free-text notes. When integrations fail or workflows change, consent often stops being enforced in areas that teams no longer monitor closely. That leads to consent drift, Korizis said.
“Consent drift happens when permission is treated as a one-time event instead of a living part of the customer relationship. The organizations that get this right build consent into how the experience evolves; they revisit it every time a new channel, partner, or data use is introduced. The ones that don't just keep layering new capabilities onto old permissions. That's how you end up with compliance debt. And unlike financial debt, the customer doesn't send a statement before they leave.”
This matters more now because customer journeys have become longer, more conversational, and more data-dense. Voice recordings, transcripts, quality assurance notes, and AI-generated summaries multiply the amount of personal data that is tied to a single interaction.
Traditional consent models were designed for a simpler era of data use, when information was collected for a specific purpose and handled by clearly defined systems or people.