Systems store a timestamp, a document version and an identifier, and call the result consent. That record answers one question well and a different question not at all. Which is which, why only one of the standard conditions is testable in code, and what a builder can do about it this quarter.
The artefact, described without sarcasm
A row: who, when, which version of which document, and the fact that they proceeded.
It is well-built. It is accurate. It answers was this presented, and did they continue with something close to certainty, and it will hold up under review because holding up under review is what it was designed for.
The problem is not the record. The problem is the second question it gets used to answer.
Two questions that look like one
Was the process followed? The record answers this. That is its function and it performs it.
Would this person have chosen this? The record is silent, and its silence is not visible
from inside the database, because the column is called consent.
Nearly every dispute about consent in software is one party citing the first answer and the other asking the second.
Why bundling is what breaks the second question
One click covering dozens of unrelated uses produces an agreement carrying no information about which of those uses the person would have taken on its own.
Somebody accepting in order to open the product has told you they wanted the product. Their view on analytics, on profiling, on onward sharing to parties they cannot name — none of that was expressed, because no mechanism existed for expressing it.
So the record remains perfectly adequate as evidence of process and becomes nearly useless as evidence of preference. Both are true simultaneously, which is exactly why the confusion is durable.
The limit that better writing cannot reach
Suppose the disclosure is genuinely good. Short, plain, honest, no defensive drafting.
It still cannot describe what a future inference will reveal, because that inference does not exist yet. It may be produced by a system nobody has built, combining this data with sources not currently available, to answer a question nobody has thought to ask.
This is a limit on what is knowable at the moment of asking. It is not a drafting failure and cannot be fixed by drafting — worth being precise about, because most proposed remedies in this area are remedies for a problem the field does not have.
The one condition you can actually test
Of everything consent is supposed to be, revocation is the only property a builder can verify with code open on a screen. Four questions, answerable today.
Does withdrawal exist as something the person can do, without contacting anybody.
How many actions does it take, against the number that granted it.
Does it reach derived data, aggregates, warm copies and anything already sent onward — or only the original row.
What is the interval before it takes effect, and is that interval written down anywhere.
A system that cannot answer these four has not implemented consent. It has implemented a record, and the difference is visible from the inside long before anyone outside notices.
What to build instead of a better form
Five changes, all ordinary engineering, none requiring anybody's permission.
Ask at the point of use. A decision attached to a situation can be evaluated. A decision taken at the door, about everything, cannot.
Independent scopes. Granted and withdrawn separately, so the stored answer carries information.
A history the person can read. What was granted, when, and what it covered — the same record you already keep, pointed at them instead of at an auditor.
Expiry by default. Agreement lapses rather than persisting until somebody objects.
Collection limits, which remove some of these decisions from existence.
The decision you do not have to ask for
Data never collected needs no consent, no revocation, no retention schedule, no record, and no statement about what happens to it when the company is sold.
It is the only approach that survives every failure of the other mechanisms, because there is nothing left to fail. It is also the only one that has to be chosen early, before a pipeline exists whose removal somebody now owns.
Close
Consent was meant to move a decision to the person affected by it.
A mechanism that reliably produces agreement is evidence that the decision did not move — and the record proving the mechanism ran is not evidence against that. It is the same fact, filed under a reassuring name.