The permission that would not otherwise exist
A seal does one thing that goodwill alone cannot do: it turns an intention into an object. Before the matrix comes down, a person’s willingness is a private state that no third party can inspect. After it lifts, there is a thing in the world that a stranger can examine, and something has changed about what other people may now do.
Consent has the same structure, and the analytical interest lies exactly there. It is not a feeling, a preference, or a state of comfort. It is a normative operator that transfers a permission which would not otherwise exist. Without it, a surgeon who cuts commits an assault; with it, the same physical act is treatment. Daniel Solove states the general form of the point in the privacy context: consent performs an enormous amount of work, because activities that would otherwise be illegitimate are made legitimate by it [10]. That is a great deal of weight to place on one act, and it explains why so much institutional machinery has accumulated around the instant of striking.
It also explains the characteristic failure. Technologies do not usually break consent by abolishing it. They break it by preserving the ritual — the button, the box, the recorded assent — while quietly removing one or more of the conditions that made the ritual do any work. The interesting question is not whether people click. It is which condition has gone missing, and whether anything else could carry the load instead.
Four conditions, and what each is for
Four conditions are conventionally required for a consent to transfer a permission, and each answers a different way the transfer can fail.
Informedness. The person must know, at least in outline, what they are agreeing to. The Belmont Report treats this as the first of three elements and lists the standard disclosures: the research procedure, its purposes, risks and anticipated benefits, alternatives where therapy is involved, and an explicit statement that the subject may ask questions and withdraw at any time [2]. Belmont is careful, however, to say that a list of items does not by itself answer the question of what standard should govern how much information is enough — a point the document leaves genuinely open rather than resolving.
Comprehension and capacity. Disclosure is not understanding. Belmont adds comprehension as a separate element and notes that the manner and context of conveyance matter as much as the content, since information presented in a disorganised or rapid fashion, with too little time for consideration, can defeat an informed choice even when nothing was withheld [2]. Capacity is the related question of whether this particular person, in this particular condition, can perform the act at all. The Nuremberg Code names it first: the person must have legal capacity, and must have sufficient knowledge and comprehension to make an understanding and enlightened decision [1].
Voluntariness. The agreement must not be extracted. Belmont draws the distinction that most later law inherits: coercion is an overt threat of harm intentionally presented to obtain compliance, while undue influence works through an excessive, unwarranted, inappropriate or improper reward. It then concedes something rarely quoted — that a continuum of influencing factors exists, and it is impossible to state precisely where justifiable persuasion ends and undue influence begins [2]. The boundary is admitted to be indeterminate at the point of its first authoritative statement.
Specificity. The permission must be about something. This is the condition most often forgotten, because it is invisible when things go well. A seal is struck for a particular instrument; it does not authorise every future document that might be laid beneath it. In data protection the requirement is explicit: the General Data Protection Regulation defines consent as a freely given, specific, informed and unambiguous indication of the data subject’s wishes, given by a statement or a clear affirmative action [5].
How the institution was built
The modern doctrine is roughly eighty years old and was assembled incrementally, mostly by bodies writing rules after the fact. Treated as institutional history rather than as a sequence of scandals, the sequence is legible.
The Nuremberg Code of 1947 emerged from a war crimes tribunal’s judgment and opens with an absolute: the voluntary consent of the human subject is essential, which requires legal capacity, the ability to exercise free power of choice without force, fraud, deceit, duress, overreaching or other constraint, and sufficient knowledge of the nature, duration and purpose of the experiment, its methods, its hazards, and the effects on health that may follow [1]. It is a professional code with no enforcement machinery of its own, and its practical importance was that later instruments could point at it.
The World Medical Association’s Declaration of Helsinki, first adopted in 1964 and revised most recently in 2024, made the principle a standing obligation of the profession rather than a verdict about particular defendants. It now extends explicitly to research using identifiable human material or data, and requires free and informed consent for the collection, processing, storage and foreseeable secondary use of biological material and identifiable or re-identifiable data [3]. That phrase — foreseeable secondary use — is where the scaling problem first enters the text.
The Belmont Report, published in the United States Federal Register in April 1979, was the product of a national commission created by statute, and its function was different again: it supplied the analytical vocabulary — respect for persons, beneficence, justice — that regulators could then operationalise [2]. The operational layer is the Common Rule. Its consent provision, 45 CFR 46.116, requires that consent begin with a concise and focused presentation of the key information most likely to help a prospective subject understand why one might or might not want to participate, and forbids exculpatory language through which a subject appears to waive legal rights or release the investigator from liability for negligence [4].
Read across, the trajectory is from a moral assertion to an evidentiary artefact. Each instrument makes consent more inspectable, and each therefore also makes it more forgeable in the ordinary institutional sense: a signed form can satisfy an auditor while the underlying conditions have quietly failed.
The seal can only be struck once
The structural difficulty is that a permission granted at one moment must cover uses that will be invented later. In research this is the broad-consent debate, and it is unresolved by design rather than by neglect.
The 2018 Common Rule made broad consent an explicit legal category. Where identifiable private information or biospecimens are to be stored for unspecified future research, 46.116(d) requires a general description of the types of research that may be conducted, a statement of the period for which the material may be stored — a period the regulation acknowledges could be indefinite — and, unless subjects will be told about particular studies, a statement that they will not be informed of the details of any specific research that might be conducted [4]. That last clause is remarkable: the regulation requires the researcher to disclose, in advance, that the subject will not be informed.
Whether such a permission is genuinely informed is contested. Mark Sheehan argues that it can be, and that the objection misidentifies what kind of decision is being made. On his account the distinction between specific, broad and blanket consent is not a distinction between kinds of consent but between kinds of choice; a donor giving broad consent is making a second-order decision to delegate first-order decisions, and the information relevant to that delegation concerns governance arrangements and institutional values rather than the details of studies not yet designed. He offers the analogy of autonomously authorising a colleague to order one’s meal without having seen the menu, and concedes candidly that the line between broad and open consent is probably impossible to draw [18]. Critics, whose position he summarises, hold that the absence of specific information about particular uses means such consent cannot be fully autonomous.
Both positions are defensible and neither has won. What can be said neutrally is that the two sides disagree about the object of the choice, not about the facts, and that this is why the dispute has proved durable.
The same tension appears in data protection with a different vocabulary. The GDPR permits data subjects to consent to certain areas of scientific research where this is consistent with recognised ethical standards, an accommodation set out in Recital 33 [5]. The European Data Protection Board’s 2020 guidelines, adopted on 4 May 2020, treat the specificity requirement as a defence against exactly the risk that accommodation creates. Specific consent combined with purpose limitation, the Board writes, functions as a safeguard against the gradual widening or blurring of purposes after a data subject has agreed to the initial collection — a phenomenon it names function creep [6]. Naming the failure mode is not the same as preventing it, and the guidelines do not claim otherwise.
Notice-and-choice and its measured record
Outside medicine, the dominant implementation of consent is notice-and-choice: publish a policy, obtain assent, treat the assent as the permission. The empirical record on this model is unusually well developed, and it is worth separating what has been measured from what is inferred.
McDonald and Cranor estimated the time cost directly. Using the privacy policies of the seventy-five most visited websites and an assumed reading rate of 250 words per minute, they arrived at an average of about ten minutes to read one policy; a separate online study of 212 participants asked to skim policies and answer comprehension questions produced median skim times of roughly eighteen to twenty-six minutes per policy. Scaling by a conservative lower bound of 119 unique sites visited annually, they reported a point estimate on the order of 200 to 250 hours per person per year to read the policies of the sites visited once each, and a national opportunity cost on the order of 781 billion dollars [8]. These are modelled estimates built on stated assumptions about reading speed, site counts and the valuation of time, not observations of behaviour, and the authors present them as such.
Behaviour has been measured separately. Obar and Oeldorf-Hirsch ran an experimental survey in which participants joined a fictitious social network. In their study of undergraduates, 74 percent selected a clickwrap that skipped the privacy policy entirely; among those who did open the policies, average reading time was 73 seconds for the privacy policy and 51 seconds for the terms of service, against estimated required reading times of roughly 29 to 32 minutes and 15 to 17 minutes respectively. Ninety-seven percent agreed to the privacy policy and 93 percent to the terms, and 98 percent missed planted clauses providing for data sharing with a national intelligence agency and data brokers and for assignment of a first-born child as payment. A later replication with 500 adults aged fifty and over found 77.6 percent choosing the clickwrap, average reading times near 70 and 81 seconds, and 91.4 percent and 83.4 percent acceptance rates, the latter including a clause assigning a kidney in exchange for service [9].
Solove’s account organises why this happens. He separates cognitive problems — people are insufficiently informed and their decisions are systematically skewed — from three structural problems that persist even if the cognitive ones were solved. The problem of scale is that self-management does not scale to the number of entities collecting data; the problem of aggregation is that individually innocuous disclosures can combine into sensitive conclusions no single decision anticipated; the problem of assessing harm is that consent is sought at collection time, when the harm is remote and the benefit immediate [10]. The structural claim is stronger than the behavioural one and does not depend on it: clearer policies would not fix scale or aggregation.
Regulators have moved against the most obvious voluntariness failures without claiming to have solved the model. Article 7(4) of the GDPR directs that utmost account be taken of whether the performance of a contract is made conditional on consent to processing that is not necessary for that contract [5], and the European Data Protection Board reads this to mean that access to services must not be conditioned on accepting storage of information on a user’s device, so that cookie walls do not produce freely given consent; it also requires granularity, so that a person can consent to some purposes and not others rather than to a bundle, and places the burden of proof on the controller [6]. Whether these rules have changed outcomes at the population level is an empirical question that the guidelines do not answer.
What was never disclosed can still be derived
The condition that digital systems break least visibly is informedness, because inference produces information that was never disclosed by anyone.
Kosinski, Stillwell and Graepel showed the mechanism at scale. Using a dataset of more than 58,000 volunteers who supplied their social-network Likes together with demographic profiles and psychometric test results, a model built on dimensionality reduction followed by regression discriminated between homosexual and heterosexual men in 88 percent of cases, between African American and Caucasian American respondents in 95 percent of cases, and between Democrat and Republican in 85 percent of cases; for the personality trait openness, accuracy approached the test–retest reliability of a standard personality instrument [15]. The inputs were behavioural traces that the participants had disclosed. The outputs were attributes that they had not.
Barocas and Nissenbaum name the resulting problem for consent precisely. Meaningful consent requires knowing what is collected, with whom it is shared, under what constraints and for what purposes, but in complex data ecologies simplicity and clarity unavoidably produce losses of fidelity — the transparency paradox. A notice detailed enough to be accurate is unreadable, and a notice readable enough to be read is inaccurate [13]. Their sharper claim concerns specificity: because data’s value is often not recognised at collection time, and because it is hard to predict how far it will travel or what it will be worth, big data effectively asks for a blank check unless recipients and transmission principles are stated in advance [13]. That is the same condition failure the Common Rule’s broad-consent provision handles by disclosing that no further disclosure will occur.
One strike, many impressions
The fourth breakage is the one that consent, as an individual instrument, cannot address at all: disclosures by one person reveal information about others who were never asked.
Barocas and Nissenbaum call this the tyranny of the minority — the volunteered information of the few can unlock the same information about the many. Their point is deliberately distinct from the claim that individuals choose badly; even a fully informed, perfectly rational chooser produces this effect, because the inference runs from correlations among people rather than from anything the chooser said about themselves [13].
Genomics supplies the cleanest demonstrations, because relatedness makes the coupling physical. Gymrek and colleagues recovered surnames from anonymously released genomes by profiling Y-chromosome short tandem repeats and querying recreational genealogy databases, projecting a success rate of about 12 percent, with a standard deviation of 2 percent, for United States Caucasian males, at a confidence threshold that returned a wrong surname in 5 percent of cases and declined to answer in 83 percent; higher rates, up to about 18 percent, came at the cost of more wrong answers. Because most recovered surnames were rare, combining a surname with age and state narrowed identity to a small number of people [16]. The people identified had not entered the genealogy databases. Their relatives had.
Erlich and colleagues extended the effect. In a preprint version of work later published in Science, they analysed data from 600,000 individuals tested by a consumer genomics service and found that 46 percent of long-range familial searches returned a match sharing at least 100 centimorgans, typically a third cousin or closer, with 10 percent returning a second cousin or closer; their model projected that a database covering roughly two percent of United States Caucasians would yield a third-cousin match for virtually anyone in that group [17]. These figures come from a preprint and should be read as the authors’ own analysis rather than as settled peer-reviewed findings, but the structural point does not depend on the exact percentages: consent given by one relative changes the exposure of relatives who never consented and cannot withdraw.
The proposed replacements, and the objection to each
Four families of alternative are on the table. Each is a serious proposal and each has a serious published objection.
Fiduciary duties. Jack Balkin argues that firms holding large quantities of personal data occupy a position analogous to doctors, lawyers and accountants, and should owe duties of care, confidentiality and loyalty — duties he deliberately specifies as narrower than full fiduciary obligations, on the grounds that complete fiduciary status would be unworkable at platform scale [11]. Lina Khan and David Pozen object that the analogy breaks on the question of divided loyalty. Delaware corporate law directs a company’s fiduciary duties to shareholders, and reforms plainly in users’ interests — less addictive design, less advertising, stronger privacy — would threaten platform revenue and therefore shareholder interests; they note that the word Delaware does not appear in Balkin’s writings on the subject, and argue that firms’ persistent failure to adopt such reforms voluntarily suggests their boards do not regard them as value-enhancing on any horizon. Their further concern is that the framework could legitimate platform power while delivering little constraint [12]. Balkin’s defenders reply that limited duties are still duties. The dispute turns on whether a duty that must survive a conflicting statutory duty is worth having, and it has not been resolved.
Purpose limitation and use restriction. The European approach shifts weight off the moment of consent and onto what may subsequently be done. Article 5(1)(b) of the GDPR requires that data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with them, and Article 6(4) makes further processing lawful only where the new purpose is compatible with the original [5]. The Article 29 Working Party’s Opinion 03/2013 sets out the two building blocks — purpose specification and compatible use — and is explicit that compatibility must be assessed case by case against all relevant circumstances rather than by rule [7]. That case-by-case character is both the strength and the objection: it accommodates genuinely beneficial secondary research, and it gives an elastic standard that a determined controller can argue its way through. Purpose limitation also relocates rather than removes the enforcement problem, since someone must detect the incompatible use.
Contextual integrity. Helen Nissenbaum’s proposal is that privacy be understood not as control or secrecy but as the appropriateness of an information flow to the context in which it occurs, judged against that context’s governing norms of distribution [14]; Barocas and Nissenbaum apply it directly to the failures of anonymity and consent [13]. Its advantage is that it evaluates flows rather than moments, which is the right unit for inference and secondary use. Its difficulty is that norms must be identified before they can be enforced, contexts are contested, and a framework anchored in existing expectations can be criticised as conservative when the technology’s whole effect is to create contexts that have no settled norms yet.
Partial self-management with a shift of timing. Solove’s own proposal is to stop asking consent to do everything: retain a right to object in the situations people actually care about, supply substantive default protections elsewhere on the model of food and vehicle safety, and move the law’s focus from the moment of collection to downstream uses, since the implications are frequently unknowable at collection time. He also names the trap in his own solution — the consent dilemma — because regulation that sidesteps consent limits people’s freedom to choose in the name of enhancing their autonomy, and he does not claim a way out [10].
What would settle it
Two things follow from the analysis without needing a forecast. First, all four proposals move authority away from the individual moment of assent and toward standing constraints on institutional conduct; they differ over who holds the constraint and how it is enforced, not over whether the seal alone is enough. Second, none of them addresses the relational problem squarely, because a duty owed to a data subject does not obviously run to the third cousin the subject’s data implicates.
A forecast with a stated horizon, offered as a conditional claim rather than a prediction of what ought to happen: by 2031, in jurisdictions operating a consent-based data protection regime, the share of high-volume consumer data processing that rests on consent as its lawful basis will fall rather than rise, with the displaced volume moving to contract-necessity, legitimate-interests and statutory bases. The assumptions are that granularity and anti-conditionality rules of the kind the European Data Protection Board articulated continue to be enforced [6], that no jurisdiction adopts a general prohibition on secondary use, and that inference-based processing continues to grow faster than disclosure-based processing. The observable indicators are the declared lawful bases in published records of processing and in regulators’ enforcement decisions, and the frequency with which compatibility assessments under Article 6(4) appear in those decisions. The disconfirmation condition is straightforward: if consent’s share holds steady or grows in that period while inference-based processing also grows, the claim that consent is being displaced by the mechanics of inference is wrong, and some other account of the pressure on it is required.
The seal on the bench is a useful object to end with because it separates two things that consent debates persistently merge. A struck seal is evidence that a permission was given. It is not itself the authority, and it cannot travel to instruments the grantor never saw. Almost every failure examined here is a case of an institution treating the artefact as though it were the authority — reading the impression as a general warrant, and laying fresh skins beneath a matrix that was lifted long ago.
