In the past twenty years, the rapid growth of data-intensive technologies such as smart devices and social media platforms has resulted in the collection and use of ever-expanding volumes and varieties of personal information. Despite this fundamental reshaping of our relationship with technology, the legal framework for consent that underpins much of this data use has remained relatively static.
Given the extraordinary impacts that data has on society and individuals, that framework should change. The traditional privacy and data protection framework relies heavily on notice-and-consent. In this regime, entities that collect and process personal information from individuals are generally required to tell users about the mechanics of what they do: what categories of information will be collected (e.g., online activity), how it may be used (e.g., to personalize ads or improve user experience), and with whom it may be shared (e.g., third-party partners and vendors).
The explanations provided in these privacy notices and terms of service rarely, however, describe what the likely impact to individuals or to society will be. Looking at the widely reported example of Instagram teen mental health research alleged by whistleblower Frances Haugen, this paper argues that traditional privacy law has a great deal to learn from the guidelines for informed consent that applies in federally funded biomedical and behavioral research.
Under that framework, researchers must notify research subjects not only of what information will be collected and how it will be used (i.e., the mechanics of data use) but also what the likely impact of those uses will be, including risk of harm to the study participant, potential benefits to society, and the right to withdraw from the research. Applying this standard to information privacy—requiring entities, including commercial companies, to inform individuals about the likely impact of allowing their information to be used—would go a long way towards creating the conditions for meaningful informed consent: that is, towards creating a framework in which individuals can more fully understand the substantive consequences they are likely to experience if they consent to having their information collected or used.