Beyond Notice and Choice: Privacy, Norms, and Consent

Abstract

Informational privacy is the ability to determine for yourself when and how others may collect and use your information. Adequate informational privacy requires a sufficiently broad ability to give or withhold free and informed consent to proposed uses.Notice and Choice (sometimes also called “notice and consent”) is the current paradigm for consent online. The Notice is a presentation of terms, typically in a privacy policy or terms of use agreement. The Choice is an action signifying acceptance of the terms, typically clicking on an “I agree” button, or simply using the website. Recent reports by the Federal Trade Commission explicitly endorse the Notice and Choice approach (and provide guidelines for its implementation). When the Notice contains information about data collection and use, the argument for Notice and Choice rests on two claims. First: a fully adequate implementation of the paradigm would ensure that website visitors can give free and informed consent to data collection and use practices. Second: the combined effect of all the individual decisions is an acceptable overall tradeoff between privacy and the benefits of collecting and using consumers’ data. There are (we contend) decisive critiques of both claims. So why do policy makers and privacy advocates continue to endorse Notice and Choice?Most likely, they see no need to seek an alternative. We find the critique of Notice and Choice conclusive, but our assessment is far from widely shared — and understandably so. Criticisms of Notice and Choice are scattered over several articles and books. No one has unified them and answered the obvious counterarguments. We do so. Making the critique plain, however, is not enough to ensure that policy makers turn to a viable alternative. The critiques are entirely negative; they do not offer any alternative to Notice and Choice. We offer an alternative: informational norms. When appropriate informational norms govern online data collection and use, they both ensure that visitors give free and informed consent to those practices, and yield an acceptable overall tradeoff between protecting privacy and the benefits of processing information. A fundamental difficulty is the lack of norms. Rapid advances in information processing technology have fueled new business models, and the rapid development has outpaced the slow evolution of norms. Notice and Choice cannot be pressed into service to remedy this lack. It is necessary to develop new norms.