Consent is carrying more weight than it can bear
Individual agreement was designed to authorise a specific use of specific information. It is now the legal basis for inferences nobody could have anticipated about groups nobody joined.
Consent does useful work in a narrow set of circumstances: where a person understands what is being asked, has a genuine alternative, and the consequences are contained. Data protection has extended it far beyond all three conditions and then treated the resulting formality as though it discharged the underlying obligation.
Consider what a person is actually agreeing to. Not a use, but a category of use. Not of information they provided, but of information inferred from it. Not about themselves specifically, but about a statistical population they were assigned to by a model they cannot see. And not once, but for as long as the inference remains commercially useful.
Nobody meaningfully agrees to a conclusion that did not exist when they clicked.
Three failures that consent cannot fix
- Inference. Obligations attach to collection, while value is created by derivation. A system that collects nothing and infers everything is well positioned under most current law.
- Group interests. An inference about a category affects everyone in it, including people who never interacted with the system. No individual can consent on their behalf, and no individual can refuse for them.
- Asymmetry of alternatives. Consent presupposes a real option to decline. Where a service has become a condition of employment, education or civic participation, declining is not a choice being offered.
What would work better
We think the productive direction is to stop asking individuals to authorise things they cannot evaluate, and instead to constrain what may be done regardless of authorisation. Purpose limitation with genuine force. Obligations that attach to inference rather than collection. Accountability placed on the party deriving value rather than the party holding the record. And categories of inference that are simply not permitted, consent or no consent.
This is less flattering to individual autonomy than the consent model, and more protective of it in practice. The appearance of choice has become a substitute for the substance of protection.
