Why the EU right to consent to personal data processing doesn't work

This paper argues that consent banners for the collection of personal data under the European Union’s General Data Protection Regulation (GDPR) are, in practice, a legal and technical fiction. While the GDPR requires consent to be freely given, specific, informed and unambiguous, it prescribes no technical standards for consent tools. Publishers and advertisers design their own tools. They often exploit pervasive consent fatigue and use ‘dark patterns’ to nudge data subjects towards acceptance of personal data sharing. Few consent tools are fully GDPR-compliant.

More fundamentally, even a perfectly transparent, unbiased consent tool cannot tell data subjects how sharing their data will affect their welfare, since data controllers aggregate and analyse data in ways individuals cannot foresee or evaluate. This makes ‘informed’ consent impossible. Beyond private costs, reduced data sharing under the GDPR has social costs too: reduced market transparency, greater concentration among data brokers, app market exits and higher prices, though data externalities can cut either way for welfare. Policy responses so far, such as proposed EU browser-level opt-out signals and browser extensions that automate consent responses, reduce consent costs but do not improve information for data subjects. The paper closes by speculating that artificial-intelligence agents acting on behalf of data subjects could shift bargaining away from attention-based advertising towards genuine competition for quality online services, potentially resolving the consent fiction, though only if such agents are genuinely neutral rather than commercially biased.

This paper was written for a Bruegel Annual Meetings 2026 panel debate on the EU General Data Protection Regulation. It builds on, and uses substantive extracts from Mariniello et al (2026). However, the views expressed in this paper are the author’s alone and do not necessarily coincide with the views of co-authors in Mariniello et al (2026).