A consent screen is the cheapest thing a company ever builds and the most expensive thing it ever relies on. It takes an afternoon: a modal, a checkbox, a link to a document nobody opens, a timestamp written to a table. In exchange, the company gets to say a sentence that sounds like a fact — the user agreed — and to keep saying it for years.

The record it produces is real. It has a user id, a policy version, an IP address, a millisecond. What it does not have is any evidence that the person understood the sentence they were agreeing to. And in most systems, nobody has ever asked whether those are the same thing, because the record is auditable and the understanding is not.

That is the consent layer: the gap between permission and comprehension, and the fact that only one of the two leaves a row in a database.

What a consent record actually proves

A consent record proves an event: at time T, on version V, this account clicked a control that said "I agree." Every one of those three facts is worth having. None of them is the fact you need.

It does not prove what the person believed they were agreeing to. It does not prove they had the vocabulary to parse the sentence. It does not prove they could have refused. And it does not prove that the thing they agreed to is the thing your system now does — because the policy is versioned and the product is not frozen.

There is a name for the failure mode where a system measures the proxy and reports the target: you already have a dashboard for clicks, so clicks become the definition of consent. The metric is convenient, which is exactly why it survives.

Consent requires the ability to refuse

The word consent has a minimum condition: the person must be able to say no without losing something they cannot afford to lose.

This condition fails constantly and quietly. An employee consenting to monitoring on a work laptop is not consenting; they are accepting a term of employment, because the alternative is losing the job. A user consenting to analytics as a condition of using the only tool their company has standardized on is not consenting either. The checkbox is real. The choice is not.

Teams rarely notice when they cross this line, because nothing about the interface changes. Twice a year, someone in legal asks "do we have consent?" and someone in product says "yes, there's a checkbox" and the answer is accepted. The question that would have caught it — what happens to this person if they click no? — is not in the review.

If the honest answer is "they can't use the product," then what you have is a condition of service, not consent. That is sometimes legal. It is never the same thing, and the difference matters the moment the regulator, the journalist, or the customer's lawyer asks what the person actually chose.

Consent is given to a version and consumed by a different one

Every consent is given to a text at a moment. The system that acts on it is a different system, later.

The policy gets a material update. The vendor adds a subprocessor. The feature that was "aggregate analytics" starts producing per-user timelines. The model that classified support tickets gets replaced by one with different training data and different retention. Each change is individually reasonable, documented in a changelog, and announced by email to an address that receives forty other emails that day.

The notice is the cheap part. Comprehension is the expensive part, and it is the part nobody funds. So the organization performs the ritual — notice sent, version bumped, consent refreshed by a banner that people dismiss in under two seconds — and the record remains technically valid while the understanding it was supposed to represent has expired.

This is the same structure as every other layer in this series: the artifact that decays is not the document, it is the correspondence between the document and the world. A consent dated March 2024 is evidence about March 2024.

The subprocessor chain is legal at every hop and invisible end to end

You consent to a service. The service uses vendors. The vendors use vendors. Each contract in that chain is signed, each disclosure is technically present in a document, and the person at the top of the chain has no model of the bottom.

A concrete case from this week: a cloud assistant was reported to route personal files and mail through human reviewers. Every hop in that path can be defended — the terms permit processing by subprocessors, the reviewers are contractors under confidentiality, the region is disclosed somewhere. What cannot be defended is the claim that the user understood it, because the user was asked a question about a product, not a question about a staffing model in another country.

The honest framing is not "they hid it." It is worse and more ordinary: the disclosure was complete and the comprehension was zero. Documents can be complete and useless at the same time, and consent systems are optimized for the first property.

The person who consents is usually not the person affected

In business software, consent is almost always given by someone other than the subject. An administrator accepts the terms on behalf of two hundred employees. A procurement team signs a data processing agreement that covers the records of people who will never see it. A hospital's IT department enables a transcription tool that will record conversations between clinicians and patients.

The administrator is consenting to something that will happen to other people, and their incentives are not aligned with those people's interests in any way that a signature can capture. They are optimizing for procurement speed, budget, and not being the person who blocked a rollout. The affected population has no interface at all.

This is not a loophole; it is the normal shape of enterprise consent, and it means the question "did we get consent?" has a systematically wrong answer. The organization got permission from the party with signing authority. Whether the people whose data flows through the system would have agreed is a different question, and it is not asked, because there is no process that asks it and no column in the spreadsheet where the answer would go.

If you want to know whether this applies to you, try to name the person who will be affected by the last tool you approved, and then try to name the document where their view is recorded. Most teams can do the first and not the second.

Consent you cannot withdraw is a transfer, not a permission

A permission is revocable by definition. If withdrawing requires an email to an address that does not answer, a form that requires an account you no longer have, or a deletion request that removes the row but not the model trained on it, then what was granted was not permission. It was a transfer with a polite interface.

The operational question is not "can they withdraw?" but "how long after withdrawal does the effect stop?" If your access is revoked at 10:00 and the downstream cache, the index, the derived dataset, and the partner's copy keep using it until Friday, the withdrawal was a gesture. The record will say the consent was revoked at 10:00, and the record will be wrong about the world in the way that matters.

This is measurable, and almost nobody measures it: pick one permission, revoke it, and time how long until the last system stops acting on it. Most teams discover the number is not zero and are surprised by which systems are slow — usually the ones with no owner.

What to measure instead

You cannot measure understanding directly. You can measure four things that are cheap and that a click-through rate will never tell you.

One: could they have refused? Write the answer as a sentence. "They could have used the free tier without analytics" is consent. "They could have quit" is not. If the sentence embarrasses you, that is the finding.

Two: can one user state what they gave up? Ask five people, one question, no leading: what did you agree to when you signed up? You are not looking for accuracy. You are looking for whether the answer is a sentence at all. If five people produce five different guesses, your consent surface is a decoration.

Three: what changed since the consent, and who was told in a way that could be understood? Version numbers are not evidence. A change that requires reading a diff is a change that was not communicated, only published.

Four: how long does withdrawal take to take effect? One permission, one stopwatch, every downstream system. This is the only one of the four that produces a number, and it is the one regulators eventually ask for.

None of these is a dashboard. All of them are more informative than a checkbox count, because a checkbox count measures the interface, and the interface was never the problem.

Friday exercise

Pick one consent surface — the signup modal, the cookie banner, the employee monitoring notice, the model-training opt-in. Write four lines:

  1. Asked. What was the person actually asked, in the words on the screen?
  2. Transferred. What did the system actually receive — data, rights, retention, third parties?
  3. Refusal. What would have happened if they had said no, and would they still have been able to do their job?
  4. Proof. What evidence, if any, would show they understood it — and does that evidence exist anywhere today?

Then take the fourth line and try to produce one piece of it. Ask one user what they think they agreed to. The answer usually arrives in under ten seconds, and it is usually not what the document says.

The gap between "they agreed" and "they knew" is not a legal problem, and it will not be fixed by better legal text. It is a measurement problem: you built a system that counts clicks, and you have been reporting the count as if it were comprehension. The click was real. The comprehension was never measured, and a thing that is never measured does not improve — it just stays convenient.

If your organization has a consent surface it has been citing for years — a checkbox, a policy version, an admin who clicked through on behalf of two hundred people — say so in the comments. We keep a one-page worksheet that records four lines: what the person was actually asked, what was transferred, who had the ability to refuse, and what evidence exists that they understood it, and I will send it over. No form, no email list.