GDPR consent engine

Design a consent and permissions management service that governs how a large platform (120M users, hundreds of internal services) may process personal data under GDPR/CCPA. Every data access must be checkable against the user's current consent (marketing, analytics, third-party sharing, each with purpose and legal basis), consent changes must propagate within seconds, and you must produce an auditable record proving lawful basis for any processing. Also support data-subject rights, export and right-to-erasure, across all downstream stores. Constraints: 500K consent checks/s, consent state must be strongly consistent at the point of decision. Cover the consent model, enforcement point, propagation, and erasure.