Skip to content
Drako Podcast

Episode 08 · Data pipeline integration · Australia · United Kingdom · Southeast Asia

The Consent Layer

Data privacy updates landing in Australia, the UK and Singapore in 2026 — and why consent has to be built into the data pipeline, not bolted onto the website.

This episode is scheduled. Audio, transcript and video highlight publish with the episode.

Why this episode, why now

Three of the firm's operating regions change their privacy rules in the same twelve months, and the changes point the same way. In Australia, the first tranche of Privacy Act reform has a hard date: from 10 December 2026 any APP entity whose computer programs use personal information to make, or substantially assist, decisions that could significantly affect someone must say so in its privacy policy, and the OAIC must register the Children's Online Privacy Code by the same day — with a second tranche of reform still to come. In the United Kingdom, the Data (Use and Access) Act 2025 took most of its data-protection provisions into force on 5 February 2026, added a mandatory complaints procedure from 19 June 2026, exempted aggregate-statistics analytics cookies from consent while leaving advertising firmly inside it, and raised PECR fines to the UK GDPR ceiling of £17.5 million or four per cent of global turnover. In Singapore the PDPA's penalty cap now runs to S$1 million or ten per cent of local turnover, the PDPC has moved from warnings to financial penalties, and every private organisation must stop using NRIC numbers for authentication by 31 December 2026.

The platforms moved in the same year. On 15 June 2026 Google changed how advertising data flows out of Google Analytics 4: the Google Signals setting no longer governs Google Ads collection, and the ad_storage consent-mode parameter alone does. A startup whose consent banner and tag configuration were not aligned before that date lost remarketing audiences and attribution quality without a line of code changing. And Chrome, after years of signalling deprecation, kept third-party cookies with user controls — so the cookieless future arrived not as an event but as a slow erosion, which is harder to plan for.

This is not a compliance episode, and Daniel will say on air that nothing in it is legal advice. It is an architecture episode. The Drakopoulos Ventures framework puts data pipeline integration third, after the go-to-market blueprint and the stack, precisely because consent is a property of the pipeline: a consent state has to be captured once, stored somewhere authoritative, and propagated to every tool that reads or writes customer data — the CRM, the email platform, the product analytics, the ad platforms, the warehouse. A banner is the surface. The consent layer is the system. Daniel's early career across agencies and seed-stage startups in London and Singapore, and his firm's work across all three regions since 2017, is exactly the vantage point for a conversation about building one consent model that holds in three jurisdictions at once.