The liturgy of consent

The GDPR defines consent in four precise words. It must be a freely given, specific, informed and unambiguous indication of the data subject's wishes.

It then adds concrete rules. If consent is requested in a written declaration that also concerns other matters, the request must be clearly distinguishable from the rest. And it must be as easy to withdraw consent as to give it.

Recital 32 closes the circle: silence, pre-ticked boxes or inactivity should not constitute consent. In 2019 the Court of Justice returned to exactly this point in Planet49, a case about a pre-ticked box for cookies.

From ritual to choice

Yet the consent we give every day bears little resemblance to this definition. It is a gesture. A click on "accept all" to make a box disappear. Repeated dozens of times until it becomes automatic.

In Habeas Mentem I call it the liturgy of consent. A ritual that keeps the form of a choice but has lost its substance. The words are right. The conditions for really choosing them are not.

The problem is not the person who clicks. It is the environment in which they click. If the choice comes when we only want to read an article, if refusing takes three steps and accepting one, if the text is long and vague, freedom becomes a word.

What can be done

Three things, starting now.

Ask for consent only when it is truly needed. Every unnecessary request makes the next one more distracted.

Make refusal as visible as acceptance. The principle that withdrawing must be as easy as giving already points there.

Check that the request is understood. Simple tests do it: ask a sample of people what they have just accepted.

Consent only makes sense if it is a decision. Everything else is liturgy.