Voluntary, informed agreement to data use or participation; contested between legal basis, ethical ideal, and interface practice.
In clinical routine, informed consent is the documented conversation in which a clinician explains a proposed intervention or data use — including, increasingly, whether AI assists diagnosis or triage — checks the patient's capacity and understanding, and records a voluntary decision in the chart. What counts is not the signature but the exchange: risks, alternatives, and the option to refuse must have been genuinely communicated at an appropriate literacy level, and the consent covers this episode of care, not everything downstream.
Conduct and document a consent conversation that discloses AI involvement where material, verify patient understanding and capacity, and recognize when a new use of patient data exceeds what was agreed.
e.g., a radiology service introducing an AI triage tool must decide whether patients are told: some hospitals treat this as covered by general consent to care, others as requiring specific disclosure before the tool touches a case.
Clinicians disagree whether AI assistance is a material fact requiring specific mention in the consent conversation or an internal decision-support tool covered by general consent to treatment.
OmniGloss seed synthesis, 2026 (machine-drafted, pending expert validation)
T. Pietrzykowski et al. (2021). The reality of informed consent: empirical studies on patient comprehension—systematic review. Trials
For hospital boards and research directors, informed consent is the authorization envelope that determines what an approved data asset may lawfully and ethically be used for. The operative questions are scope and durability: whether consent obtained at care or recruitment covers a proposed secondary use, whether broad consent to a research domain suffices or re-consent is needed, and whether GDPR Article 9(2)(a) explicit consent, or an alternative basis with safeguards, underwrites the project. A use that outruns its consent envelope is a governance failure regardless of scientific merit.
Evaluate whether a proposed data reuse falls within the scope of existing consent, and decide among re-consent, broad-consent reliance, or an alternative legal basis with documented safeguards.
The Royal Free-DeepMind Streams collaboration (ICO finding, 2017) transferred about 1.6 million patient records without patients being adequately informed — a scope failure decision-makers now cite as the canonical negative case.
Research-governance communities split on whether broad consent to a research area is ethically adequate for later, unforeseen uses or whether project-specific re-consent or dynamic consent is required.
Regulation (EU) 2016/679 (GDPR), Art. 9(2)(a): explicit consent as a condition for processing special-category (health) data
S. Zenker et al. (2021). Data protection-compliant broad consent for secondary use of health care data and human biosamples for (bio)medical research: Towards a new German national standard. Journal of biomedical informatics
Rasmus Bjerregaard Mikkelsen et al. (2019). Broad consent for biobanks is best – provided it is also deep. BMC Medical Ethics
For engineers building health-data platforms and clinical AI, informed consent is machine-actionable state attached to every record: which purposes were consented, under which information-sheet version, with what expiry and withdrawal status. Consent is operationalized as metadata that pipelines must check before a record enters a cohort, a training set, or an export, and as propagation logic ensuring withdrawal takes effect downstream — flagged, quarantined, and excluded from future processing. A dataset whose consent state cannot be resolved per record is treated as unusable for consent-based processing.
Implement per-record consent metadata, enforce purpose checks at every pipeline boundary, and propagate withdrawals so non-consented records are excluded from cohorts, training sets, and exports.
e.g., a federated research platform that refuses to materialize a cohort when any included record carries an unresolved consent-version mismatch, forcing curation before extraction.
Regulation (EU) 2016/679 (GDPR), Art. 7(3): withdrawal of consent must be as easy as giving it
For research ethics committees and clinical-trial monitors, informed consent is an ongoing process, not a signed artifact: it begins with comprehensible disclosure, is tested through the participant's demonstrated understanding, and continues through the study as new risks emerge, with withdrawal available at any time without penalty. Reviewers assess the information sheet's readability, the voluntariness of recruitment, capacity procedures, and re-consent triggers. A file of signed forms proves documentation, not consent; the committee's question is whether participants understood and remain willing.
Assess consent materials and procedures for comprehension, voluntariness, capacity, and re-consent triggers, and treat signed forms as evidence to be tested rather than proof of consent.
In the Havasupai case (settled 2010), DNA samples given for diabetes research were reused for schizophrenia and migration studies; the forms were signed, but the uses exceeded what participants had understood and agreed to.
Anchors the 'consent as ongoing relational process' position in the recorded dissensus over what informed consent must be to count as valid across sectors.
J. Flory et al. (2004). Interventions to improve research participants' understanding in informed consent for research: a systematic review.. JAMA
For front-line bank and insurance staff, informed consent is a permission state on the customer file to verify before acting: the recorded consent must name the specific use at hand — a marketing offer, a data enrichment, an open-banking account pull — and must still be live, not lapsed, superseded, or withdrawn. The working distinction is between consent flags and other processing markers such as legitimate-interest or contractual-necessity codes, which must never be read as customer agreement. When the file is silent, ambiguous, or stale, the practice is to escalate to compliance rather than infer permission from the strength of the relationship.
Check that a recorded, still-live consent names the specific purpose, channel, and data involved before acting on customer data, and escalate rather than infer agreement when records are silent, stale, or ambiguous.
e.g., a relationship manager blocks a cross-sell campaign for customers whose marketing consent predates a product-terms change, until refreshed permissions are captured.
For risk and compliance executives, informed consent is a fragile legal basis to be chosen deliberately, not a default. Because consent can be withdrawn at any time and is invalid if bundled or coerced, credit and insurance processing is usually grounded in contract or legal obligation, with consent reserved for genuinely optional uses — and for GDPR Article 22(2)(c), where explicit consent is one of the narrow gateways to fully automated decisions with legal effect. The executive question is which processing can survive a consent withdrawal and which must never depend on consent at all.
Decide per processing purpose whether consent, contract, or legal obligation is the defensible basis, and ensure no critical decision pipeline depends on a permission the customer can withdraw.
e.g., a lender that gates an optional cash-flow-based affordability check on explicit consent to open-banking data, while keeping the mandatory creditworthiness assessment on a contractual basis.
Compliance teams dispute whether consent to data access that conditions a better rate or product is 'freely given' at all, or whether pricing incentives render it effectively coerced.
Regulation (EU) 2016/679 (GDPR), Art. 22(2)(c): explicit consent as an exception permitting solely automated decisions
For engineers in payments and open banking, informed consent is a machine-readable permission object with a lifecycle: created through strong customer authentication, scoped to named accounts, data clusters, and purposes, time-limited, renewable, and revocable through an API that third parties must honor. Consent is what the access token encodes; the build requirement is that no data flows without a live, matching consent object, that expiry forces re-authorization, and that revocation propagates to every downstream consumer within the agreed service-level window.
Design consent objects with explicit scope, expiry, and revocation semantics, and enforce at the API layer that no data access occurs without a live consent matching the requested purpose.
Under PSD2 open banking, account-access consents are time-limited and must be re-confirmed by the customer; a data aggregator's token simply stops working when the underlying consent lapses or is revoked.
In financial-services compliance audit, informed consent is an evidentiable record satisfying enumerable legal elements: who consented, when, to which purposes, via which notice version, with what affirmative action, and how withdrawal was honored. Auditors test consent the way they test any control: sample processing events, trace each back to a valid consent record predating the processing, and verify withdrawal latency against policy. A consent that cannot be reconstructed from records is treated as absent; conversely, a complete, well-formed record closes the question for audit purposes.
Sample processing activities, trace each to a valid, timestamped consent record with matching scope, and report untraceable or stale consents as control failures requiring remediation.
e.g., an internal audit that reconciles a quarter's marketing sends against the consent database and reports every send lacking a matching, live consent as a reportable exception.
Anchors the 'consent as documented compliance event' position in the recorded dissensus over whether a compliant record settles, or merely evidences, valid consent.
Regulation (EU) 2016/679 (GDPR), Art. 4(11) definition of consent and Art. 7(1) duty of the controller to demonstrate consent
In newsroom and documentary practice, informed consent is the subject's agreement to participate, given with a working understanding of how their words, image, or footage will be used — including, now, whether material may be altered or synthesized with AI. Practitioners operationalize it through the pre-interview explanation, on-record confirmation, and honoring the terms afterwards: agreement to an interview is not agreement to a voice clone, and consent given for one outlet or framing does not transfer to another. Vulnerable subjects get more explanation, not less.
Explain intended use before recording, obtain and note the subject's agreement on those terms, and renegotiate consent whenever the use, framing, or technology materially changes.
The documentary Roadrunner (2021) used AI to synthesize a few lines in Anthony Bourdain's voice, triggering a mainstream debate about whether any prior consent could cover a posthumous synthetic use.
For producers, editors, and studio executives, informed consent is the explicit, bargained permission that must exist before a performer's voice, likeness, or past work is digitally replicated or used to train a bespoke model. The operational elements are specificity and compensation: consent names the production, the use, and the payment; blanket clauses buried in engagement terms are treated as reputationally and legally insufficient. Under this operationalization the absence of a specific yes is a no, and proceeding without one is an executive risk acceptance, not a gray area.
Verify before greenlighting any digital replica or model training on performer material that specific, compensated, written consent exists for that exact use, and treat its absence as a stop condition.
The 2023 SAG-AFTRA TV/Theatrical agreement made explicit consent and compensation for digital replicas a contractual baseline after the strikes, turning a negotiating demand into standard production practice.
Anchors the 'affirmative opt-in' position in the recorded dissensus on whether generative-AI uses of creative material require prior consent or merely honored opt-outs.
For developers of generative models trained on web-scale media, informed consent is operationalized negatively: lawful access plus honored reservation. Training on publicly available works proceeds under text-and-data-mining exceptions unless the rightholder has expressed a machine-readable opt-out, so the build obligation is compliance infrastructure — parse and respect robots.txt and do-not-train signals, maintain opt-out registries, and exclude reserved works from crawls. Individual affirmative consent is required only for targeted uses: replicating an identifiable person's voice or likeness, or fine-tuning on a specific creator's corpus.
Implement and audit opt-out honoring across crawling and training pipelines, and obtain affirmative consent only where an identifiable person or a specific creator's corpus is deliberately targeted.
e.g., a model developer that checks every crawl batch against a do-not-train registry and rightsholder reservation signals before ingestion, while requiring signed releases for any commissioned voice replica.
Anchors the 'lawful access plus opt-out' position in the recorded dissensus; creator communities reject this as consent inverted, while developers treat it as the legally provided mechanism.
Regulation (EU) 2024/1689 (AI Act), Art. 53(1)(c): providers of general-purpose AI models must put in place a policy to identify and comply with rights reservations expressed under Art. 4(3) of Directive (EU) 2019/790
In rights-clearance and standards practice, informed consent exists only as a traceable artifact chain: signed releases, licensing terms, and consent logs connecting every voice, face, and work in a production to a documented permission for the specific use. Clearance stewards operationalize consent as provenance — each asset carries who agreed, to what, when, and under which terms — and a gap in the chain blocks distribution. When AI-generated material enters the pipeline, the chain must extend to the humans whose data or performances the generation drew on.
Maintain a per-asset consent chain linking every identifiable person and work to a documented release for the specific use, and block distribution wherever the chain is broken.
The 2024 dispute over OpenAI's 'Sky' voice, which Scarlett Johansson said resembled hers after she had declined consent, showed why productions now demand documented consent provenance for synthetic voices.
For caseworkers handling citizens' files, informed consent is a narrow, easily overclaimed thing: a citizen's genuine, optional agreement to a use of their data that they could refuse without losing the service. In case-handling practice the operational rule is negative — acquiescence under need is not consent, a signature required to receive a benefit is not consent, and most processing rests on statutory duty, not agreement. What caseworkers must actually do with the concept is spot the rare genuinely optional uses and make refusal safe and real.
Distinguish statutory processing from genuinely optional uses, request consent only where refusal carries no cost to the citizen, and never present required processing as if it were a choice.
e.g., a benefits office that stops asking claimants to 'consent' to income verification it is legally required to perform, and reserves consent language for an optional SMS-reminder service.
Regulation (EU) 2016/679 (GDPR), Recital 43: consent presumed not freely given where there is a clear imbalance, in particular toward public authorities
For agency heads and policy leads, informed consent is chiefly a basis-selection question answered early in a programme's design: because of the power imbalance between state and citizen, GDPR Recital 43 makes consent presumptively not freely given toward public authorities, so lawful bases are normally public task or legal obligation, wrapped in transparency and objection rights. Choosing consent anyway creates a programme that must survive mass withdrawal; the responsible decision is to invoke consent only for genuinely voluntary add-ons and to say plainly when citizens are not being given a choice.
Select and defend the lawful basis for each programme, invoke consent only for genuinely voluntary components, and communicate honestly when processing is mandatory rather than dressing it as choice.
England's care.data programme (2013-2016) collapsed after opt-out communication failures destroyed public trust — a canonical case of a consent-and-objection design failing at population scale.
Regulation (EU) 2016/679 (GDPR), Recital 43 read with Art. 6(1)(e): public-task basis for public-authority processing
For government digital-service teams, informed consent is an interface and infrastructure obligation: where a service includes genuinely optional processing, the consent moment must be separate from mandatory steps, written in plain language at population reading levels, granular per purpose, defaulted to off, and reversible from the same place it was given. Dark patterns — bundled toggles, pre-ticked boxes, consent walls in front of entitlements — are treated as defects that invalidate the consent collected. Consent state is stored per citizen, per purpose, versioned against the exact notice shown.
Build consent interactions that are separate, granular, plain-language, default-off, and revocable in place, and store per-purpose consent state versioned against the exact notice displayed.
e.g., a national service portal that ships analytics strictly off by default and records, for each citizen, the notice version behind every active consent, so audits can replay what was actually shown.
NIST AI 100-3, The Language of Trustworthy AI: An In-Depth Glossary of Terms — 'informed consent' entry quoting the CCPA: acceptance of general terms and consent obtained through dark patterns do not constitute consent
For official statisticians and their governance bodies, informed consent occupies a deliberately limited role: statistical collection rests on legal mandate under statistics law, and the compact with respondents is confidentiality and exclusive statistical use, not consent to each processing. Stewards operationalize the concept at the boundary — respondents must be told whether a survey is mandatory or voluntary, voluntary surveys require genuine agreement, and reuse of administrative data for statistics is legitimated by law plus demonstrable confidentiality protections rather than by consent that was never sought.
State clearly whether each collection is mandatory or voluntary, obtain real agreement for voluntary surveys, and defend administrative-data reuse through legal mandate and demonstrable confidentiality, not implied consent.
e.g., a census authority that labels a voluntary well-being module as optional in its first sentence, prosecutes no one over it, and publishes the legal basis for every mandatory item.
European Statistics Code of Practice, Principle 2 (mandate for data collection and access to data) and Principle 5 (statistical confidentiality and data protection)
For teams testing medical AI in real-world conditions under the EU AI Act, informed consent is a defined regulatory gate: before a subject participates in real-world testing, they must freely give a specific, unambiguous, voluntary expression of willingness after being informed of all aspects of the testing relevant to their decision — its nature, objectives, duration, their rights, and how to withdraw. Builders operationalize this as a documented enrollment step distinct from clinical consent to care and from GDPR consent to data processing, each with its own record.
Implement real-world-testing enrollment that captures the AI Act's informed-consent elements as a distinct, documented step, separate from consent to treatment and from data-protection consent.
e.g., a hospital piloting a sepsis-prediction system on live wards enrolls patients through a testing-specific consent workflow, so a patient can accept care while declining participation in the AI test.
Regulation (EU) 2024/1689 (AI Act), Art. 3(59) definition of informed consent; informed consent for testing in real-world conditions per Arts. 60-61
For working artists, photographers, and writers navigating generative tools, informed consent is the thing conspicuously missing from the systems they are asked to adopt: their portfolios were scraped into training sets without anyone asking, and no notice, opt-out form, or license-after-the-fact converts that taking into agreement. In this community's usage, consent means being asked first, with the realistic power to say no and keep working; an opt-out offered after ingestion is documentation of non-consent. The concept functions as a test of whether a tool is built on colleagues' unconsented labor.
Question the provenance of a generative tool's training data, distinguish being asked beforehand from being offered an opt-out afterwards, and factor unconsented training into adoption and attribution choices.
Illustrators in Andersen v. Stability AI (filed 2023) allege their portfolios were scraped into image-generator training sets without being asked; for this community the case names the baseline harm — ingestion first, opt-out later, consent never.
Anchors the creator-side 'affirmative opt-in' position in the recorded dissensus on consent for generative-AI training uses of creative material.
For ombudspersons, civil-society watchdogs, and critical data stewards examining public-sector practice, informed consent is a legitimation device that structurally cannot do its work where refusing has costs: a person dependent on benefits, migration status, or public healthcare cannot meaningfully decline, so consent artifacts collected in such settings document compliance theater rather than agreement. This community operationalizes the concept by its preconditions — real exit options, symmetrical information, no penalty for refusal — and treats their absence as disqualifying, shifting the demand to democratic mandate, necessity tests, and independent oversight instead.
Test claimed consent against its preconditions of real refusability and symmetrical information, and where they fail, demand a democratic mandate and independent oversight instead of consent paperwork.
e.g., a welfare agency's 'consent' to data matching signed as part of a benefits application fails the refusability test — no claimant can decline and still receive support — so a watchdog treats the practice as unconsented processing needing a statutory mandate.
Anchors the 'consent structurally unavailable under power imbalance' position in the recorded dissensus on what informed consent must be to count as valid.
Regulation (EU) 2016/679 (GDPR), Recital 43: presumption against freely given consent under clear imbalance of power
For model developers in banks and insurers, informed consent is a per-record training constraint: a data point may enter a modeling dataset only if its consent state licenses model development, and the pipeline must recompute eligibility at every retraining. The hard technical questions are temporal — what happens to models already trained when consent is withdrawn: exclusion at the next retrain, immediate retraining, or approximate unlearning — and how consent scope maps onto derived features and embeddings that outlive the raw record. Consent filtering is implemented as dataset-assembly logic with logged eligibility decisions.
Gate training-set assembly on per-record consent eligibility, log the consent basis of every included record, and define and implement the pipeline's response to withdrawal, including retraining policy.
e.g., a churn-model pipeline that rebuilds its training set nightly from consent-eligible records and files a retraining ticket whenever cumulative withdrawals exceed a set fraction of the previous training population.
Practitioners disagree whether consent withdrawal obliges only future exclusion or also removal of the record's influence from already-trained models, where exact unlearning is generally infeasible.
For hospital data-protection officers, informed consent under the GDPR is a distinct legal instrument that must not be conflated with research-ethics consent: Article 9(2)(a) explicit consent is one lawful basis among several for processing health data, with its own validity conditions — granularity, demonstrability, withdrawal without detriment — and a study can hold impeccable ethics-committee consent yet process data on a different GDPR basis entirely, or vice versa. The DPO's operational task is keeping the two instruments separately documented, because an audit that finds them merged has found neither.
Document data-protection consent and research-participation consent as separate instruments with separate records, and identify the actual GDPR lawful basis rather than assuming ethics consent supplies it.
e.g., a trial whose participants signed research-ethics consent while the hospital processes their data under a public-interest research basis — the DPO records both instruments, and neither substitutes for the other.
DPOs and ethics committees dispute whether participant consent should double as the GDPR lawful basis or whether research processing is better grounded in public-interest bases, with consent reserved for the ethical relationship.
Regulation (EU) 2016/679 (GDPR), Art. 9(2): explicit consent as one of several conditions lifting the prohibition on processing special-category data
In agricultural data practice, consent is exercised at the dealership and in the app store: telematics terms, platform licences, and data clauses in machinery contracts determine what the manufacturer or agri-platform may do with field and machine data. Where the farm is a sole proprietorship the data is personal and the GDPR standard applies — consent must be freely given, specific, informed, and unambiguous — which bundled, take-it-or-lose-the-features contract terms routinely fail; elsewhere 'consent' is really contractual permission, negotiated from unequal bargaining positions.
Scrutinize data clauses in machinery and platform contracts, separate genuine freely given consent from bundled contractual permission, and renegotiate terms that condition core functions on data surrender.
e.g., a telematics contract bundles agronomic data sharing with warranty coverage — decline and lose remote diagnostics; where the data identifies a sole proprietor, such consent is not freely given.
In this sector, informed consent survives principally in two places, both strained by hierarchy: research on service members, where military codes require voluntary, informed agreement while rank structure and unit cohesion pressure genuine voluntariness; and medical interventions, where investigational products require individual consent or an explicit government waiver. Outside these enclaves, much of the sector's core activity, including intelligence collection and surveillance of adversaries, proceeds deliberately without the subject's consent, resting on legal authority instead. Practitioners therefore operationalize consent as a bounded, documented safeguard for specific protected relationships, not a general basis for data processing.
Identify whether an activity sits inside a consent-governed enclave, such as human-subjects research or medical care, and there document voluntary, pressure-free agreement; elsewhere, identify the legal authority that substitutes.
In Doe v. Rumsfeld (2004), a U.S. court halted mandatory anthrax vaccination of service members with an investigational product absent informed consent or a presidential waiver.
Voluntariness under command hierarchy is the disputed core: research-ethics boards hold that superior-subordinate settings require extra safeguards because refusal is never cost-free, while some commanders and program offices treat standard consent documentation as sufficient.
In education, informed consent operates under a structural shadow: attendance is compulsory, grades carry power, and the data subjects are often minors, so 'freely given' is rarely straightforward. Institutions operationalize consent through parental agreement for younger pupils, age-appropriate notices, and — critically — through knowing when not to rely on it: much school data processing proceeds on public-task or legal-obligation bases precisely because refusing a school's platform is not a real option for a learner. Genuine consent is reserved for the truly optional — research participation, photographs, non-essential apps — where refusal must carry no educational penalty.
Determine for each processing of learner data whether consent can be freely given; where it cannot, use another lawful basis and never penalize a learner's refusal of optional uses.
e.g., a school that makes a third-party homework app compulsory and asks parents to 'consent' to its analytics — an agreement that fails the freely-given test because declining would exclude the child from coursework.
Practitioners diverge on consent's proper role: data-protection officers treat it as usually the wrong lawful basis in compulsory schooling, while research-ethics boards and some parent advocates insist on affirmative consent for any analytics on minors, seeing lawful-basis substitution as an evasion.
Art. 4(11) (definition of consent); Art. 8 (child's consent)
In industrial workplaces, informed consent does most of its honest work by being ruled out: the employment power imbalance means a worker's click-through 'agreement' to wearable sensors, cabin cameras, or exoskeleton telemetry rarely counts as freely given, so lawful deployment runs instead through works agreements, purpose limitation, and collective negotiation. Where consent is genuinely operative — pilot studies, ergonomics research, optional health features — engineers operationalize it as a specific, revocable, documented choice with a real alternative: the line keeps running and the job stays the same for whoever declines.
Determine whether a data collection from workers can rely on consent at all; where it can, ensure a documented, revocable choice with no job consequences for refusal.
e.g., an exoskeleton pilot lets assembly workers opt in to motion-data collection for the ergonomics study, with a paper alternative and explicit assurance that declining never reaches the shift plan.
Art. 4(11); Recital 43 (imbalance of power)
In legal practice, informed consent is a documented safeguard with validity conditions: a client's agreement to a conflict waiver, a limited-scope engagement, or the use of an external AI tool on their matter binds only if counsel adequately disclosed the material risks and reasonably available alternatives, and it is operationalized through the writing that evidences it. Advising on data protection applies the same structure to data subjects: consent must be freely given, specific, informed, and unambiguous, and the controller must be able to demonstrate it — a consent that cannot be proven, or that was bundled or coerced, fails as a processing basis.
Disclose material risks and alternatives before seeking consent, obtain it in demonstrable written form, and re-examine its validity whenever the scope of use or the risks disclosed have changed.
e.g., an engagement letter stating that the firm uses a vetted generative-AI platform on client documents, naming the confidentiality safeguards and offering an opt-out, converts tool use from silent practice into informed client consent.
In fleet and delivery operations, informed consent is invoked for cab cameras, driver-facing monitoring apps, and customer-side services such as geolocated delivery notifications, but on the employment side its operational value is thin: a driver asked to accept camera monitoring as a condition of routes has few real alternatives, so operators are pushed toward other legal bases combined with works-council agreements, with consent reserved for genuinely optional features. On the consumer side it is interface practice, an opt-in for tracking notifications that must be as easy to revoke as it was to give.
Determine per data stream whether consent can be freely given; where the employment relationship undermines it, use another lawful basis with collective agreement; keep optional features genuinely optional.
In 2021 Amazon required US delivery drivers to consent to AI camera monitoring as a condition of continuing to drive, widely cited as consent that is not freely given in employment.
Operators and telematics vendors treat a signed consent form as sufficient authorization for driver monitoring, while data-protection officers and labour representatives hold that consent under employment dependence is not freely given and demand a different lawful basis; deployments stall on this divide.
Regulation (EU) 2016/679 (General Data Protection Regulation)
Art. 4(11) definition of consent; Recital 43 on imbalance of power
Across care and platform work, informed consent is stretched between a legal formula and lived dependence. A care recipient consenting to a sensor mat or a shared care record must actually understand it, may lack capacity, and can rarely refuse the only service on offer; a courier consents to location tracking by tapping through terms that condition access to income. GDPR's standard — freely given, specific, informed, unambiguous — is the benchmark, and the sector's persistent question is whether consent extracted inside dependence and take-it-or-leave-it interfaces can ever meet it.
Check that consent to tracking, sensors, or data sharing is specific, comprehensible, and genuinely refusable for the person giving it, and use another lawful basis where it is not.
e.g., a home-care provider replaces blanket admission-form consent with per-device choices after finding clients did not know their fall-sensor data went to an external analytics firm.
Platforms and some providers treat signed terms and in-app acceptance as valid consent; data-protection authorities, care ethicists, and worker advocates argue the power imbalance of platform work and care dependence makes freely given consent largely unavailable, requiring other lawful bases and safeguards.
D. Clifford et al. (2019). Pre-formulated Declarations of Data Subject Consent—Citizen-Consumer Empowerment and the Alignment of Data, Consumer and Competition Law Protections. German Law Journal
In e-commerce and adtech practice, informed consent is the banner-and-string machinery that legitimizes tracking: the consent-management platform's purpose list, the recorded affirmative act, the TCF signal distributed to vendors, and the proof kept for audit. Operationally, consent is informed when purposes are named and granular, freely given when refusing is as easy as accepting, and valid only as deep as the vendor list it actually covers — while the sector simultaneously optimizes banner design for acceptance rates, placing every consent flow in tension between legal validity and conversion.
Design consent flows where refusal equals acceptance in effort, name purposes and vendors granularly, store proof of each consent, and re-prompt when purposes or vendor lists materially change.
France's CNIL fined Google 150 million euros and Facebook 60 million euros (2021-2022) because rejecting cookies took more clicks than accepting — an asymmetry held to vitiate consent.
Growth teams treat consent-banner design as legitimate conversion optimization; regulators and consumer advocates class asymmetric buttons and nudging layouts as dark patterns that void the consent collected — the validity of optimized flows is the live dispute.
Art. 4(11), Art. 7 (freely given, specific, informed, unambiguous indication by clear affirmative action)
In research with human participants, informed consent is a documented process rather than a signature: a participant with capacity receives the purpose, procedures, risks, data uses, retention, sharing arrangements, and withdrawal terms in comprehensible language, has a real opportunity to ask questions, and agrees voluntarily and free of dependency pressure. Ethics committees assess the information sheet and the consent procedure together, and the scope of that consent bounds every later use: secondary analysis, record linkage, deposit in an open repository, or model training on the material each require that the original consent covered it, a new consent, or an approved alternative basis.
Obtain and document consent whose stated scope genuinely covers the intended analysis, sharing, and retention, and seek fresh approval before any use participants were not told about.
e.g., interview transcripts collected under consent for a single study and later requested for a public archive; without archiving in the original consent, deposit requires re-consent or a documented ethics decision.
Biobanks and large consortia operationalize broad or dynamic consent so that unforeseen re-use remains possible, while participant-facing ethics committees and many qualitative social scientists insist on study-specific consent. The disagreement decides whether an existing collection may be re-used at all.
Regulation (EU) 2016/679 (GDPR), conditions for consent and consent in scientific research
Art. 4(11) (freely given, specific, informed and unambiguous); Recital 33 (consent to certain areas of scientific research)
Inside the teams that build consent flows, informed consent is an engineered artifact with known failure modes: banner UX, purpose taxonomies, consent strings propagated through tags and SDKs, and preference centers whose choices must actually reach every downstream processor. Builders operationalize it as state to be collected, stored, propagated, and honored at query time - and many are frank that click-through design manufactures agreement rather than informing it. The profession thus holds both the machinery of consent and the sharpest evidence that, as deployed at scale, it often fails the people it is named for.
Treat consent as propagated state: verify every downstream system honors recorded choices, test withdrawal paths end to end, and refuse dark-pattern designs that manufacture agreement.
The Belgian data-protection authority found in 2022 that IAB Europe's Transparency and Consent Framework - the consent-string plumbing behind much of online advertising - failed GDPR requirements, indicting the industry's core consent infrastructure.
The split runs between adtech and consent-platform engineers, who treat compliant consent strings as valid consent, and privacy engineers and researchers who argue interface-manufactured agreement is consent theater regardless of the string's validity.
GDPR, definition and conditions of consent