Consent, targeting, surveillance, data brokerage and the ethics of machine learning are usually argued as separate disputes. They share one structure: a decision made in a moment produces a record that persists far beyond it, and nearly all the harm lives in that gap. A single frame for the field, and what follows from it.
The shape underneath the arguments
Privacy is usually argued case by case. Was that consent real. Is that targeting acceptable. Should that company hold that data. Each argument is conducted on its own terms, and the terms are always about the moment of collection.
Underneath them is one structure. A person decides something under the conditions of a particular moment — this interface, this intent, this audience, this version of themselves. The record produced by that decision then persists under entirely different conditions: different technology, different owners, different law, and a different person.
Almost all privacy harm lives in that gap. Not in the collection, which is usually mundane and often useful, but in the distance between the conditions that justified a record and the conditions it eventually exists under.
Why the moment is a bad place to put the protection
Nearly every protective mechanism we have built acts at collection: banners, permission prompts, settings pages, terms of service. All of them ask a person to decide, once, at the start.
This is the weakest available position, for three reasons that have nothing to do with carelessness.
The person is optimising for the next thirty seconds. They came to do something, and the prompt is an obstacle between them and it. That is not distraction; it is the correct allocation of attention to the task at hand.
They have incomplete information about future uses, and so does the company asking. Nobody in the transaction knows what the data will be worth to a model that does not exist yet.
And they cannot represent their future self, who will have different vulnerabilities, different circumstances, and possibly different opinions about what was fine to share.
Asking an individual to solve a fifteen-year problem in one second, with less information than the counterparty, is not a safeguard. It is a ritual that produces a record of compliance.
Four ways a record outlives its decision
Duration. Retention outlasts relevance, because deletion requires a decision and retention requires none. The record collected for a good reason remains after the reason ends, and time detaches it from the context that made it reasonable.
Derivation. The record becomes a conclusion. What was inferred from it does not disappear when it is deleted, and the inference is frequently the thing that mattered — the score, the category, the prediction that gets applied to you.
Transfer. The record changes hands through acquisition, partnership, breach, or a change of policy. Whoever holds it at the end is not the party you evaluated, and the evaluation was the only thing you were ever asked to do.
Recombination. The record joins other records. Items that are individually harmless assemble into something nobody consented to, and nobody had to deliberately collect it — it accumulated.
These compound rather than sit side by side. Duration provides the material for derivation. Derivation increases the value that makes transfer attractive. Transfer puts the record beside other collections, which is where recombination happens.
The asymmetry that makes it stable
Collecting is cheap, automatic and continuous. Objecting is expensive, manual and episodic.
The benefit of collection is concentrated in one party who can measure it precisely. The cost is diffuse, delayed, and falls on people who cannot measure it at all.
And the person best placed to notice a harm is structurally the last to learn of it, because the harm typically arrives as a decision made about them elsewhere, using material they never saw.
The arrangement is stable because it is profitable and lawful, not because anybody involved is unusually wicked. That distinction matters: a system held in place by ordinary incentives is not fixed by finding villains.
Why individual measures underperform
Blockers, private browsing, careful settings, refusing banners — all of them help at the margin, and none of them touches duration, derivation, transfer or recombination, because none of those four is under the individual's control.
That is the whole difficulty in one sentence. The measures available to a person operate on collection. The harm operates on everything that happens afterwards.
Advice aimed at individuals persists partly because it is cheap to give and comfortable to receive. It also shifts responsibility onto the party least able to act, which is why it survives despite not working.
What actually operates on the gap
Four interventions, none of which a user can perform.
Shorter retention by default, so that the passage of time deletes rather than accumulates.
Collection limited to what a function requires, which is the only measure that also prevents derivation, transfer and recombination, since none of them can act on what was never held.
Deletion that reaches derived data, without which deletion is a gesture at the source while the conclusion survives.
Constraints that travel with data on transfer, so the terms evaluated at the start still apply to whoever holds it at the end.
Every one of these is a design or policy decision. That is not an argument against individuals acting. It is an argument about where to direct expectations.
What an individual can still do, ranked honestly
Not producing the record. The only complete measure, and the only one with no failure mode. Most people will not take it, and that is a structural fact rather than a weakness — the arrangement is built to make non-participation expensive.
Reducing identifiability of what is produced. Real, partial, and frequently reversed by recombination.
Separating identities across contexts, which raises the cost of assembly. Effortful, and almost nobody sustains it for years.
Choosing architectures rather than promises — services that cannot do the thing, instead of services that undertake not to. This is the one with the best ratio of effort to effect.
The test I apply
Before producing a durable record, I ask what it would mean read in fifteen years, by somebody with no context and no goodwill, under rules that do not exist yet.
It sounds dramatic. It is only the arithmetic of retention, applied honestly. Fifteen years is not a long time for a file, and every one of the four mechanisms above has that long to operate.
The frame again
The question is never only what is collected. It is for how long, by whom, becoming what, and joined to what.
Ask those four about anything — a photograph, a banner, a device, a model — and the argument usually resolves without needing anybody to be a villain.