digital alma

You were about nine years old when the data collection started in earnest.

You did not know. Your parents probably did not think about it in a way that felt significant. A school district adopted a new learning management system. A pediatrician’s office moved to electronic health records. Someone set up an email address for you so you could register for a game. Your first search queries entered a database somewhere and never left.

By the time you were old enough to understand what data collection was, the collection had been underway for a decade. By the time you could legally agree to terms of service, the profile already existed.

Consent, in theory, is the thing that makes this okay. You clicked agree. You accepted the terms. The legal framework for data collection rests almost entirely on this mechanism. It is a fiction. And we all know it is a fiction, which is the strangest part.

The Conditions Consent Requires

Meaningful consent has specific conditions. It requires that you understand what you are agreeing to. It requires a real choice, that declining does not come at an unreasonable cost. It requires that you are agreeing to something defined and bounded, not a blank check. And it requires that you can revoke it.

Terms of service fail on every count. The privacy policy for a major platform can run to 30,000 words. Research on whether users read these documents is consistent: they do not. Reading every privacy policy you encounter in a year would take between 76 and 250 hours. No one does this. The companies writing these policies know no one does this. The legal system pretending this constitutes informed consent knows no one does this.

There is no real choice in most cases. You cannot use many essential tools of contemporary life, job applications, healthcare systems, banking, communication platforms, without accepting their data practices. When “decline” means “opt out of participating in modern society,” the choice is not a choice. It is coercion dressed in the language of agreement.

And revocation is mostly theoretical. You can delete your account. You cannot reach back into data already sold, already shared, already incorporated into models that will continue making inferences about people like you. The right to be forgotten exists on paper. In practice, your data has traveled through systems you cannot see, to entities you cannot name, for purposes you were never told about.

The Profile That Knows You Better Than You Know Yourself

Somewhere in a database, there is likely a record of where your phone was at 3am on a random Tuesday three years ago. There is a record of the searches you conducted during a medical crisis. There is a model built on your browsing behavior that predicts your political sympathies, your likelihood of purchasing specific products, your relationship status, your mental health. These inferences were made not by asking you but by running your behavior through models trained on everyone else’s behavior.

The data brokers, a largely invisible industry, collect, aggregate, and sell this information. There are thousands of them. They hold records on most American adults, sold to advertisers, employers, landlords, insurance companies, and anyone willing to pay. You did not agree to this. You agreed to use a social media platform, or a weather app, and somewhere in the cascade of data sharing, the information migrated. You could not have tracked it even if you wanted to.

Children cannot consent to data collection in any legal or meaningful sense. They do not have the cognitive development to understand what they are agreeing to. COPPA restricts data collection for users under 13, but it stops there. The moment a child turns 13, the full apparatus applies. We treat thirteen-year-olds as capable of consenting to surveillance architectures that most adults cannot comprehend.

More broadly, the data collected about children does not disappear when they become adults. The profile built from years of behavioral data on a minor persists and forms the foundation for the adult profile. The browsing behavior at 12 is in the database when they are 25. We are building behavioral archives on children who cannot consent, will not understand what they agreed to when they age into consent, and will never have the opportunity to review what was collected before they were old enough to know it mattered.

The Consent You Give By Simply Existing

There is something more subtle than terms of service that deserves attention: the ambient agreement that develops from simply being visible. When you walk through a city equipped with facial recognition cameras, your presence has been harvested even if you never clicked agree. When a store’s app collects location data from nearby devices, including people who have never used the app, there is no consent mechanism at all. Your proximity is treated as permission.

The consent framework was designed for a world where data collection happened at clear interface points. You walked into a store. You filled out a form. You signed a document. Contemporary data collection happens continuously, in the background of existence. There is no policy covering the version of you being assembled from a thousand points of peripheral data, the you that emerges from WiFi signals and Bluetooth pings and the metadata of people you have never met.

This is not a privacy problem in the traditional sense. It is a power problem. When entities know more about you than you know about yourself, the power differential is not small. This information is used to price things you buy, determine your eligibility for credit, target you with content calibrated to your psychological vulnerabilities. The consent fiction enables this by making it appear voluntary. If you agreed, then what happens next is your responsibility.

Genuine consent would require policies written in plain language, actually read before they take effect. It would require a real opt-in architecture rather than the current opt-out default. Opt-out is not neutrality. Opt-out is a system designed to maximize capture by exploiting inertia, confusion, and the exhaustion of people who do not have time to read 30,000 words before using email.

It would require meaningful portability and a right to deletion that travels through the cascade, not just the original platform. If one delete the data from the app, but the app has already sold it to 47 data brokers, and those brokers have sold it to 300 clients, the deletion request has accomplished nothing. Real deletion would mean deletion everywhere. This is technically possible. It is not politically convenient.

It would require rethinking the consent of minors entirely. Not just raising the age threshold, though that might help, but building systems that do not rely on harvesting children’s behavioral data as a precondition for participation in education, entertainment, and social connection. We treat children’s data as fair game because we treat all data as fair game. The problem is not a special case. It is the system.

None of this is impossible. What it requires is the decision that the current arrangement is not acceptable, which is a political decision, not a technical one. The tools to build respectful data systems exist. The will does not, because the current system is profitable, and the people it profits are not the people it surveils.

You are living inside an agreement you never made, governing data you never intended to share, used in ways you cannot track, by entities you cannot name. The checkbox said you agreed. You did not. Not really. That gap, between the form of consent and its substance, is the space where almost all contemporary data exploitation lives. We know this. We participate anyway, because the alternative is to disappear from systems we need to survive. That is not consent. That is captivity with paperwork. Naming it is the first step toward anything better.

By Digital Alma