3. Consent, collection, and the limits of agreement

Core

Almost everything in privacy rests on one small sentence: I agree. Terms of service, cookie banners, the box you tick, the screen you tap to drive off the lot — all of it is load-bearing, and all of it assumes you made a real choice.

This week we test that assumption and watch it come apart from two directions. Consider what “consent” has to mean to be worth anything — that you understood it, that you could have refused, that it still describes what’s happening to your data now — and then hold that against how it actually works:

• The app — you didn’t read it, and if you had, you could not have understood it.
• The car — you didn’t know there was an agreement at all; surveillance came bundled inside a thing you bought.
• Both — you agreed once, to one purpose, and the data has been flowing to others ever since.

Consent is a snapshot. Data flow is a river. That gap is the subject of the night. By the end you should distrust “I agree” as a solution to anything — which matters, because nearly every harm in the rest of this course involves something you nominally agreed to. And there’s a second reason it matters: there are laws built to fix exactly what you just watched break — and knowing what they promise lets you measure the distance between the promise and the room you’re sitting in.

Two philosophies split the world. Europe’s GDPR treats your data as an extension of you: processing is forbidden by default and permitted only on a specific legal basis, and where that basis is consent, the consent must be “freely given, specific, informed, and unambiguous.” It is opt-in, rights-based, and it applies across the whole economy. The United States has no such law. It regulates in patches — health here, finance there, children somewhere else — and defaults to opt-out: the collection is allowed; the most you usually get is the right to ask them to stop. California’s CCPA/CPRA is the furthest the US has gone, and it is still a consumer-protection statute, not a declaration that the data is yours.

Now do the thing this course does. Hold GDPR’s standard — freely given, specific, informed, unambiguous — against the cookie banner you clicked this morning, or the agreement you never read. The standard is crystal clear. The practice violates it nearly universally. That gap is the point, and it is not because the law is stupid: it is because the ethical problem outruns the instrument built to contain it. From here on, every harm we study carries a second question alongside the lenses and the lifecycle: which law would touch this — and exactly where does it fail?