Mobile Consent — End-to-End UX for Privacy at Scale
- Client
- Securiti.ai (acq. by Veeam, $1.73B)
- Role
- Sole Product Designer — Consent
- Timeline
- 2022 — Present
NDA-protected case study
This work is protected under NDA. Request the password via email or LinkedIn.
No password? Email me to request access →
Overview
The challenge
Enterprise clients needed consent capture that worked on mobile — without sacrificing the legal completeness required by GDPR, CCPA, LGPD, the ePrivacy Directive, and more. Securiti supports 70+ jurisdiction templates out of the box, with GCM integration live and IAB integration on the roadmap. The tension: compliance teams need every clause surfaced and tracked, but end users on mobile will abandon anything that feels like a legal wall.
As the sole designer on consent, I owned the entire mobile consent experience — from initial discovery to shipped product.
Context & scale
- $1.73B Securiti acquired by Veeam — this was a core product
- 70+ Jurisdiction templates out of the box — GDPR, CCPA, LGPD, ePrivacy, and more
- US + KSA Enterprise clients — a top US airline and a billion-dollar company in Saudi Arabia
- $300–400K Per year enterprise contract value
My role
Sole product designer for all consent products at Securiti. Full end-to-end ownership of the mobile consent module — discovery, research, wireframes, design system components, high-fidelity screens, and handoff.
Collaborated with compliance and legal stakeholders, my design manager, and engineering. On the consent product, every design decision is mine.
Team
- Product Manager
- Design Manager
- Lead Engineer
- 2× Mobile Developers
- 1× Front-end Engineer
- 3× Back-end Engineers
What I designed for mobile
Research
Key insights
- End users treated dense consent screens as friction, not information — most scrolled past without reading, or abandoned entirely on mobile.
- Enterprise compliance teams needed every consent signal captured and auditable — but couldn't control how their end users experienced the flow.
- Existing mobile consent tools defaulted to one of two failure modes: dark patterns (pre-ticked boxes, hidden reject) or compliance walls (full legal text on a 375px screen).
- Multi-language support wasn't treated as a design problem — it was bolted on, causing overflow, broken layouts, and inconsistent hierarchy across RTL and long-form languages.
Constraints I designed within
- Privacy by design: data minimisation, purpose limitation, consent granularity
- Multi-jurisdiction: GDPR, CCPA, LGPD, ePrivacy Directive, and 70+ jurisdiction frameworks simultaneously
- Enterprise clients: each with custom branding, language, and legal requirements
- Accessibility: WCAG 2.2 AAA compliance achieved across all consent components
Design
01 / Design decision
Progressive disclosure over a single consent wall
A consent wall was never on the table. From the start, the approach was Privacy by Design — which meant the legal framework had to be baked into the UX architecture, not bolted onto it afterwards. The result is a layered system: a minimal banner for first interaction, expanding to a structured preference center only when the user chooses to engage with the detail.
Every required signal is still captured, logged, and auditable across GDPR, CCPA, LGPD, ePrivacy, and 70+ jurisdictions — the compliance obligation is fully met. But the default surface is designed for how mobile users actually behave, not for the worst-case auditor. Legal completeness and a friction-free experience aren't in tension here. That was the design problem.
02 / Design decision
Category-level toggles with clearly locked essentials
SDKs are grouped into meaningful categories — Analytics, Marketing, Functional — with a locked Essential tier that can't be toggled off. But the transparency doesn't stop at the category level. Each category expands to reveal every SDK within it: its purpose, the permissions it requests, and a direct link to its developer URL so users can verify authenticity themselves. No stone left unturned.
This was made possible by Securiti's proprietary mobile scanner, which surfaces every SDK and permission active in an app. An added AI layer identifies unknown SDKs and maps them to the knowledge base — keeping the platform ahead of new data collection methods automatically. The result is consent that's fully transparent, not just legally compliant. Crystal clear by design.
03 / Design decision
Accessibility-first color system for enterprise white-labelling
Every enterprise client deploys the preference center inside their own app — with their own brand colors and typography. A naive solution would let clients pick any color and apply it. But consent UIs carry real accessibility obligations — and we pushed further, achieving WCAG 2.2 AAA compliance across all consent components.
I built a custom color picker into the admin configuration UI that validates contrast ratios in real time — surfacing warnings and blocking combinations that fail AA thresholds before they ever reach end users. Behind the picker, a token layer maps client brand colors to semantic roles across every consent component: buttons, toggles, text, backgrounds, focus states. Clients get full branding control. Accessibility is non-negotiable by design.
Before & after
Final screens
Outcome
The mobile consent module shipped to enterprise clients in the US and KSA — a top US airline and a billion-dollar company in Saudi Arabia. The layered consent approach reduced friction for end users while maintaining the full compliance signal capture required for GDPR, CCPA, LGPD, and ePrivacy audit readiness.
The consent product — including the mobile module I owned — was a core part of the platform in Securiti's $1.73B acquisition by Veeam. Enterprise clients renewed at $300–400K per year contracts, with consent as a primary feature driver.
$1.73B
Securiti acquired by Veeam — consent was a core product
70+
Jurisdiction templates — GDPR, CCPA, LGPD, ePrivacy, and more
Sole designer
End-to-end ownership across every mobile consent touchpoint — banner, preference center, permission flows, and component library