New paper warns online consent is GDPR legal fiction

A new paper by think tank Bruegel concludes that online consent banners required by the EU General Data Protection Regulation (GDPR) operate in practice as a legal and technical fiction.

Author Bertin Martens observes that while the GDPR requires consent to be freely given, specific, informed, and unambiguous, the statute establishes no technical standards for consent architecture. As a consequence, publishers and advertisers exploit user consent fatigue and employ deceptive interfaces to coerce compliance, leaving minimal tools aligned with regulatory demands. Furthermore, truly informed consent remains practically unachievable because individuals cannot anticipate or evaluate how their data is aggregated and analysed.

The paper also documents wider social and economic costs linked to restricted data sharing, including diminished market transparency, higher consumer prices, app market exits, and increased market concentration among data brokers. While proposed EU measures like automated browser-level opt-out signals reduce compliance friction, the author argues that they fail to enhance user understanding. Instead, the paper suggests neutral artificial intelligence (AI) agents acting for consumers could shift leverage away from attention-driven advertising towards service quality competition, addressing structural flaws provided these agents remain entirely uninfluenced by commercial interests.

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.