Consent fails as an autonomy mechanism because the choice and the preference are both unstable

Consent is the mechanism that carries autonomy into data processing. A person weighs what a service will do with their data, agrees, and that agreement makes the processing legitimate. This third of ten units argues that the mechanism fails on both of its inputs. The preference is unstable, because what people want from privacy shifts with how a request is framed. The choice is unstable, because the design of the prompt shapes the answer as much as the person does. The gap between what people say and what they do is usually called the privacy paradox. It is better read as an artefact of measurement than as a fact about careless users. The consequence is narrow. A consent screen can be lawful, record an unambiguous indication of agreement, and still fail to secure autonomy. If that is right, the repair is not clearer wording but the choice architecture, the defaults and the flow of information.

The paradox is a claim about a gap between two different measurements

Norberg, Horne and Horne (2007) set disclosure intentions against disclosure behaviour and found consumers who voice concern about controlling their data nonetheless provide it freely.

Kokolakis (2017) reviews the studies that find the gap and those that contest it. He attributes the divergent results to differences in method, context and conceptualisation, and calls for evidence of actual behaviour rather than self-reported attitudes.

Acquisti, Brandimarte and Loewenstein (2015) organise the evidence under three themes. They are uncertainty about the consequences of disclosure and about one's own preferences, the context-dependence of concern, and the malleability of concern by commercial and governmental interests. If a person is unsure what they prefer, a stated attitude cannot be the standard against which their behaviour is judged.

The preference is unstable, and a sense of control moves it

Brandimarte, Acquisti and Loewenstein (2012) tested the assumption that more control over disclosure makes people more cautious. They found the opposite: increasing perceived control over the release of private information raised participants' willingness to disclose sensitive, identifying information. A control meant to protect a person can leave them more exposed, because the feeling of control substitutes for judging the risk.

Waldman (2020) connects this to the design of the choice: the claim that people do not care about privacy ignores the cognitive biases and design tactics used to induce disclosure, from hyperbolic discounting to overchoice. "People do not care" and "the prompt was built to be accepted" then become rival explanations of the same behaviour.

The choice is not free either, and the law asks for it regardless

Solove (2013) gives the structural objection. Privacy self-management is the regime in which the law hands people rights to weigh the costs and benefits of disclosure themselves, work he argues it cannot do, because the data passes through too many hands and the consequences are too remote to judge.

McDonald and Cranor (2008) put a figure on part of that burden. They calculated the average time to read a policy from the 75 most popular websites at 10 minutes, assuming 250 words per minute, and estimated from 212 participants that the average internet user visits 119 sites a year. On those figures the national opportunity cost of reading policies in the United States is on the order of 781 billion dollars, and time spent comparing policies brings the social cost above the market for online advertising. Their rate is the one a secondary-school leaver reaches, and the jargon of a policy makes even that an underestimate, so the cost falls hardest on a reader with low literacy.

Karegar, Pettersson and Fischer-Hubner (2020) tested it with 80 participants in four groups, some engaging with policy content by drag and drop, swipe or checkbox and some not, measuring attention to consent forms before and after habituation. Drag and drop produced significantly more attention to the data items. The difference disappeared once the forms had been seen repeatedly.

Enforcement tests the design of the refusal, not what the person understood

On 31 December 2021 the French data protection authority fined Google 150 million euros and Facebook Ireland 60 million euros (CNIL 2021). It found that one click accepted all cookies while three clicks on Facebook and five on Google were needed to refuse them. It found that the extra steps discouraged refusal and so affected the freedom of consent, and it ordered a refusal button beside the accept button. The European Data Protection Board (2024) has since read the paid alternative the same way: a fee will in most cases not make consent valid for a large platform.

A lawful screen records agreement, not understanding

Degeling and colleagues (2019) examined the 500 most popular websites in each of the 28 member states of the European Union, 6,579 in total, before and after the General Data Protection Regulation took effect on 25 May 2018. They found 62.1 per cent displaying a cookie consent notice, 16 per cent more than in January 2018, and 84.5 per cent carrying a privacy policy. The Regulation made the web more transparent, and usable mechanisms for consent or refusal were still lacking.

Utz and colleagues (2019) tested what the notices achieve. They ran three field experiments covering more than 80,000 unique visitors to a German website, and they varied the notice position, the type of choice and the content framing. A binary choice drew more acceptance than a per-category mechanism. Nudging towards a privacy-invasive default raised acceptance. Under a privacy-by-default setting less than 0.1 per cent allowed cookies for all purposes. Small implementation decisions moved the outcome substantially.

Privacy is a flow of information, not a secret

Nissenbaum (2004) supplies the framework that makes the argument explicit. On her account of contextual integrity, privacy is not secrecy but appropriate flow. The test is whether information moves in line with the norms of the context it came from. A violation turns on the actors, the information, the purpose and the conditions rather than on whether the person was asked. A consent screen captures one condition of one flow and cannot represent the rest.

Apthorpe and colleagues (2018) make the claim testable. Using a survey method built from the contextual integrity framework, they measured the acceptability of 3,840 information flows involving smart home devices with 1,731 adults in the United States. Consent was the only condition with positive acceptability across every recipient. A yes-or-no notice leaves advertising, indefinite storage and unrelated flows unaddressed.

Contested question: is the paradox a measurement artefact or a robust behaviour?

One position holds that the paradox is an artefact. Solove (2020) contends that it compares two things that measure different questions: a stated valuation of privacy and a behaviour taken under different constraints. Kokolakis (2017) reaches a compatible conclusion from the review evidence, and Acquisti and colleagues (2015) supply the mechanism.

The opposing position holds that the gap survives good measurement, and Barth and colleagues (2019) designed the test the artefact account demands. They gave technically savvy students enough money to buy a paid application and observed their actual choices. That removed a lack of technical knowledge, privacy awareness and financial resources as explanations. Neither removed the paradoxical behaviour: privacy did not significantly affect the choice, and functionality, design and cost outweighed it.

What would settle it is a design that separates the measurement claim from the behavioural one. Barth and colleagues (2019) observed behaviour and controlled for competence and resources, but their sample was small, from one knowledgeable student population, and confined to a single application choice. The artefact account is also conceptual, turning on whether a stated valuation and an observed act can be compared at all. Until a study asks whether a stated privacy valuation predicts observed behaviour, the weaker conclusion holds. The paradox is not uniform, and its size depends on how preference and behaviour are each measured.

The two sides do not carry equal evidence. The artefact side is a conceptual argument from Solove (2020), supported by the review in Kokolakis (2017). The behavioural side has one field study with a small, technically skilled student sample in Barth and colleagues (2019), and field experiments in Utz and colleagues (2019) where design moved acceptance by more than twenty points. Neither measures the same person twice. The strongest objection to this unit's thesis is that consent is a legal instrument rather than a psychological one, so unstable preference shows that a notice cannot secure autonomy and not that a willing person is unable to give it. While the dispute is open, a designer should make the refusal button the equal of the acceptance button and treat a recorded click as evidence of process, not of understanding.

Where the argument is heading

The direction of travel is from the notice to the flow. The defensible practitioner position is no longer "we obtained consent" but "the flow fits the context, the default is the safe one, and the consent screen is the last step rather than the justification". The fourth unit turns from the prompt to the duties the law names.

The sources this unit rests on

• Nissenbaum, H. (2004). Privacy as contextual integrity. https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10/ Argues that privacy is the appropriate flow of information, judged by the norms of the context it came from, not the control of secrets. A transfer is a violation on grounds of actors, purpose and conditions.
• Solove, D. J. (2013). Privacy self-management and the consent dilemma. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2171018 Argues that a regime handing people rights to weigh the costs and benefits of disclosure themselves is asked to do work beyond its capabilities, since too many entities process personal data and the consequences are too remote to judge. It is the structural objection to notice and choice.
• McDonald, A. M. and Cranor, L. F. (2008). The cost of reading privacy policies. https://lorrie.cranor.org/pubs/readingPolicyCost-authorDraft.pdf Put the average time to read a policy from the 75 most popular websites at 10 minutes, and estimated a national opportunity cost of reading policies on the order of 781 billion dollars. It prices the time that notice and choice assumes.
• Norberg, P. A., Horne, D. R. and Horne, D. A. (2007). The privacy paradox: personal information disclosure intentions versus behaviours. doi:10.1111/j.1745-6606.2006.00070.x Set disclosure intentions against disclosure behaviour and reported that consumers who voice concern about controlling their data nonetheless provide it freely. It is the original statement of the gap.
• Brandimarte, L., Acquisti, A. and Loewenstein, G. (2012). Misplaced confidences: privacy and the illusion of control. doi:10.1177/1948550612455931 Found that increasing perceived control over the release of private information raised willingness to disclose sensitive, identifying information. It shows the control meant to protect a person can leave them more exposed.
• Acquisti, A., Brandimarte, L. and Loewenstein, G. (2015). Privacy and human behaviour in the age of information. doi:10.1126/science.aaa1465 Reviews behavioural evidence under three themes: uncertainty about the consequences of disclosure and one's own preferences, the context-dependence of concern, and the malleability of concern by commercial and governmental interests. Its first theme is why a single stated preference cannot be the standard.
• Kokolakis, S. (2017). Privacy attitudes and privacy behaviour. doi:10.1016/j.cose.2015.07.002 Reviews the studies that find the attitude-behaviour gap and those that contest it, attributing the divergent results to differences in method, context and conceptualisation. It calls for evidence of actual behaviour rather than self-reported attitudes.
• Apthorpe, N., Shvartzshnaider, Y., Mathur, A. and colleagues (2018). Discovering smart home internet of things privacy norms using contextual integrity. doi:10.1145/3214262 Measured the acceptability of 3,840 information flows from smart home devices with 1,731 adults in the United States. Consent was the only condition with positive acceptability across every recipient, while advertising and indefinite storage were least acceptable.
• Barth, S., de Jong, M. D., Junger, M. and colleagues (2019). Putting the privacy paradox to the test. doi:10.1016/j.tele.2019.03.003 Gave technically savvy students enough money to buy a paid application and observed their actual choices, removing lack of knowledge, awareness and money as explanations. Privacy did not significantly affect the choice, and cost, functionality and design outweighed it.
• Utz, C., Degeling, M., Fahl, S. and colleagues (2019). (Un)informed consent: studying GDPR consent notices in the field. doi:10.1145/3319535.3354212 Ran three field experiments with more than 80,000 unique visitors to a German website, varying notice position, choice type and content framing. A binary choice drew more acceptance than a per-category mechanism, nudging raised it, and under a privacy-by-default setting less than 0.1 per cent allowed cookies for all purposes.
• Degeling, M., Utz, C., Lentzsch, C. and colleagues (2019). We value your privacy ... now take some cookies. doi:10.14722/ndss.2019.23378 Examined the 500 most popular websites in each of the 28 member states, 6,579 in total, before and after the Regulation took effect, finding 84.5 per cent with privacy policies and 62.1 per cent displaying cookie consent notices. Functional consent and refusal mechanisms were still lacking.
• Solove, D. J. (2020). The myth of the privacy paradox. doi:10.2139/ssrn.3536265 Deconstructs and critiques the paradox and the two types of argument made about it, concluding that it rests on comparing a stated valuation of privacy with behaviour taken under different constraints. It is the direct counter-claim that the paradox is a measurement artefact.
• Waldman, A. E. (2020). Cognitive biases, dark patterns, and the privacy paradox. doi:10.1016/j.copsyc.2019.08.025 Argues that the claim that people do not care about privacy ignores the cognitive biases and design tactics used to induce disclosure, naming biases from hyperbolic discounting to overchoice. It connects the instability to the design of the choice itself.
• Karegar, F., Pettersson, J. S. and Fischer-Hubner, S. (2020). The dilemma of user engagement in privacy notices. doi:10.1145/3372296 Ran a controlled experiment with 80 participants in four groups engaging with consent forms by drag and drop, swipe, checkbox or not at all. Drag and drop drew significantly more attention to data items, and the difference disappeared with repeated exposure.
• Commission Nationale de l'Informatique et des Libertes (2021). Deliberations SAN-2021-023 and SAN-2021-024 of 31 December 2021 (cookies). https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil Fined Google 150 million euros and Facebook Ireland 60 million euros for making the refusal of cookies harder than the acceptance, one click to accept against three or five to refuse, and ordered a refusal button beside the accept button. It is the enforcement case where the design of the refusal is tested. The union-wide reading is European Data Protection Board (2024), Opinion 08/2024 on valid consent in consent or pay models implemented by large online platforms, https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-082024-on-valid-consent-in-the-context-of-consent-or_en.