Privacy Experts Highlight 'Tricky' Aspects of Consent

“When you look too closely anywhere, consent is broken,” said Meg Jones, a professor at Georgetown University. But Jones remains a “big fan” because, while it “needs to be bolstered by other things,” the “biggest wins” in privacy have come from simple laws around consent.

Jones said the Illinois Biometric Information Privacy Act is an example. “If you take away consent, you're saying someone else should make the decisions about how data [floats] around, and that's tech companies or the government,” she said. “And sometimes, neither of those options feels very good.”

Daniel Solove, law professor at George Washington University, said another tough element is deciding when consumers want the consent banner. “The tricky thing is, sometimes we want cookies, and maybe sometimes we don't,” he said. “I want them when they're good for me, but I don't want to actually figure that out. I want someone else to figure that out for me.”

Aside from what individuals access on their own, there are other situations where consent can be somewhat out of their control, such as with educational technology, Jones said. “There is unprecedented access to children through" educational apps and devices, "all of which are collecting data to make money, really, without consent.” Parents have "never been asked to give consent to a device, to the specific apps.”

There is a term, “consent on behalf of parents,” that serves as a workaround, based on the premise that there are other, extra limitations on the tech, said Jones. “But what's actually happening is no one's getting consent anywhere, and even when parents object, they're still consenting on your behalf.” Even though consent is typically centered at the heart of children’s privacy, this is a way not-real consent is given in practice, she said.

Parental consent is also easy to work around, Solove added. “What's tricky is, the current mechanisms of parental consent seem to not work very well,” he said. “I've yet to receive any instance where I needed to consent to something, and I know that my son has been on stuff that should have required parental consent somehow.”

It also puts a burden on parents to know what they are agreeing or not agreeing to, he said. “Parents don't know what they're consenting to a lot of times,” Solove said. “It’s hard to consent for ourselves, let alone for our kids.”

And given how inconsistent or hard-to-understand consent notifications can be, “I don't think that adults can really consent to a lot of this stuff” either, he said. “Putting too much pressure on consent puts too much pressure on” everyone.

Outside of consent, age-verification is the best way to go, Jones said. "When we talk about protecting kids, all roads lead to age verification," she said. "You want to talk about kids, you have to know who is a kid and what stage of childhood they're at."

Age-verification laws, however, have been contested in the courts recently in states like Mississippi (see 2505020058), Tennessee (see 2501170070) and Ohio (see 2504160049).

In front of the U.S. Supreme Court now is Free Speech Coalition v. Paxton, which deals with age verification (see 2501150073). Jones believes the contested Texas law in Paxton will be allowed. “The [justices] are receptive to the idea that the technology in the old cases … has changed significantly,” she said. “Even using those cases, they will be able to find the law is constitutional.”

Age-verification and other kids safety laws change the battle's participants, Jones said. “Right now, it's like kids versus their parents, which I don't feel good about winning,” she said. “What if it was kids versus Google, and Google was on the hook for doing this? That is a different calculus.”

“If you're holding tech companies liable for skirting their own systems,” I feel that’s “a lot stronger,” Jones said. “What a lot of these laws are trying to do is that. The parent is still there, but it moves the liability to tech companies to make them meaningful constraints.”