Rethinking online consent: Autonomy in a click-driven world

Online consent is typically given when users click a button to agree to a website's terms and conditions. Critics argue that such consent is often uninformed due to the complexity and length of privacy policies, which most users do not read or fully understand. Scholars like Daniel Solove and Shoshanna Zuboff claim that this lack of knowledge undermines the validity of online consent, as it fails to protect users' autonomy and sovereignty over their personal data.

In an age dominated by digital interactions, agreeing to terms and conditions has become a routine part of online life. Every time we download an app, sign up for a service, or visit a website, we’re met with a familiar prompt: "I agree to these terms." But how meaningful is this consent? Do users truly understand the implications of clicking that button? Scholars and privacy advocates have long argued that uninformed online consent undermines user autonomy and is ethically problematic. Yet, in the face of lengthy, jargon-filled privacy policies, many users opt not to read them, choosing convenience over comprehension.

Against this backdrop, Bartlomiej Chomanski and Lode Lauwaert offer a bold new perspective in their study, "Online Consent: How Much Do We Need to Know?" published in AI & Soc 39, 2879–2889 (2024). They challenge the conventional criticism of online consent by introducing the "Right Not to Know" (RNTK). This concept, originally rooted in bioethics, is repurposed to argue that individuals exercising their RNTK in digital contexts can still provide valid and ethically sound consent. Their work reshapes the discourse around digital privacy, autonomy, and the moral validity of online consent.

The debate over online consent

Online consent is typically given when users click a button to agree to a website's terms and conditions. Critics argue that such consent is often uninformed due to the complexity and length of privacy policies, which most users do not read or fully understand. Scholars like Daniel Solove and Shoshanna Zuboff claim that this lack of knowledge undermines the validity of online consent, as it fails to protect users' autonomy and sovereignty over their personal data.

The study acknowledges these concerns but takes a novel approach by applying the RNTK - a concept rooted in bioethics - to online consent. In bioethics, the RNTK allows patients to refuse potentially distressing or unwanted medical information. The authors argue that a similar principle applies in the digital domain, where users may choose not to engage with detailed privacy policies and still provide valid consent.

The Right Not to Know (RNTK)

The RNTK is grounded in autonomy and the idea that individuals should have control over their information, including the right to remain uninformed. This principle is already recognized in contexts such as genetic testing, where patients can opt not to know their predisposition to certain diseases. The authors extend this concept to online consent, asserting that users exercise their RNTK when they choose not to read privacy policies but still consent to their terms.

By doing so, users prioritize their time and mental resources, recognizing that the costs of fully engaging with lengthy legal documents may outweigh the benefits. This choice does not signify ignorance but reflects a rational decision to balance competing priorities. The authors argue that this decision should be respected as an exercise of autonomy, provided it does not lead to significant harm to others.

Key arguments supporting the RNTK in online consent:

• Consistency Across Contexts: If the RNTK is respected in medical ethics, it should logically extend to online privacy. For example, just as patients may choose to remain uninformed about certain medical conditions, users can choose not to engage with lengthy privacy policies while still exercising valid consent. Both decisions are rooted in the principle of autonomy.

• Protection of Legitimate Interests: Choosing not to engage with privacy policies can protect individuals from unnecessary stress or loss of productivity. A study estimated that the cumulative time required to read all privacy policies could cost billions in lost productivity annually. The RNTK allows individuals to focus on more meaningful activities while accepting the trade-offs involved in uninformed consent.

• Autonomy and Rational Decision-Making: Critics argue that uninformed consent undermines autonomy, but the authors counter that autonomy includes the right to make trade-offs. Users often accept a website’s terms because they trust the platform or deem the risks acceptable. This is not a failure of autonomy but a rational assessment of costs and benefits.

The RNTK provides a robust counterargument to the common criticisms of online consent. The authors address three primary concerns and demonstrate how the RNTK reframes these issues:

• Consent preceded by the RNTK remains valid because it reflects a deliberate choice to prioritize certain values, such as time efficiency or emotional well-being, over exhaustive knowledge. This is comparable to a patient declining medical information while consenting to treatment.

• Autonomy is not compromised when individuals consciously choose to remain uninformed. In fact, the RNTK reinforces autonomy by respecting individuals’ right to decide how much information they want to engage with.

• Critics argue that uninformed consent leads to unreasonable decisions. However, the authors highlight that rational decision-making often involves trade-offs, where individuals balance the cost of acquiring information against its perceived value. Online consent is no different.

Practical implications, critiques and considerations

The concept of the RNTK has significant implications for both users and organizations. For users, it acknowledges their ability to make informed trade-offs, even when they choose to remain uninformed about privacy policies. This empowers individuals to navigate the digital landscape without being overwhelmed by information overload.

For organizations, the study emphasizes the importance of transparency and simplicity in privacy policies. While the RNTK validates users’ right to forgo detailed knowledge, companies must still strive to present information clearly and concisely. Simplified privacy summaries or visual aids can bridge the gap between informed and uninformed consent, ensuring that users can make decisions aligned with their values.

The authors’ argument is not without its limitations. While the RNTK offers a compelling framework for understanding online consent, it may not fully address power imbalances between users and large tech companies. Critics may argue that relying on the RNTK places too much responsibility on users while absolving companies of their duty to ensure ethical data practices.

Furthermore, the study acknowledges that the RNTK should not be considered an absolute right. Situations where uninformed consent could lead to significant harm, such as misuse of sensitive data, may necessitate stricter safeguards. The balance between respecting autonomy and protecting users from harm remains a nuanced ethical challenge.