Brett Frischmann

@brettfrischmann.bsky.social

2098 Followers 1468 Following

Interdisciplinary researcher & teacher (Villanova Univ.). Infrastructure. Knowledge Commons. Re-Engineering Humanity. Tech & Humanity/Society. IP Theory. Lately, Friction-in-design, Age Gating. TEDx: https://www.youtube.com/watch?v=SgbC3hmhHAU

The moral magic of consent in privacy law is pure illusion. Existing consent mechanisms transform legal and social relationships without requiring actual consent. Our surveillance-based economy is thus built upon countless legal lies. Privacy scholars lament this state of affairs. They acknowledge that consent is illusory and broken. Some argue it should be abandoned and replaced with substantive rules. Others argue it is "murky" and of questionable legitimacy but should still be tolerated as a governance mechanism. Most arguments about consent miss the mark, however, by failing to commit to a morally defensible theory of consent and to engage with plausible mechanisms for improving how it works in practice. This article is the first to examine how to reform the moral magic of consent in privacy law so that the law only transforms legal and social relationships when actual consent exists. We advance a morally defensible theory of consent based on subjective intent and understanding. Then, contrary to conventional wisdom, we show how such a normative commitment is doctrinally and practically possible. We propose a new legal standard of demonstrably informed consent. This standard would put the burden on the party drafting and designing consent mechanisms to generate reliable evidence that a person actually understands the consequential terms to which the person agrees. A doctrine that requires actual comprehension, rather than notice and assent, is feasible and normatively desirable. The article is also the first to engage with the friction-in-design literature and explore how to operationalize our novel legal requirement. We demonstrate that mechanisms for generating reliable evidence are not cost-prohibitive. Companies regularly employ this type of friction-in-design in online ethics and other training modules. Using the same mechanisms or new ones to generate and test comprehension is feasible, as results from our preliminary experimental studies show. ...
For example, he envisions a digital dou- ble going on millions of virtual dates and living countless probable lives so that it can deliver you the optimal romantic part- ner and life. But life and romance are not algorithmic optimization problems com- prehensible in the language of computa- tion. What if the costs of going on some bad dates let you to learn something about yourself and others? How will you know what you want without any experiences?
Outline 1. Introduction 2. Preliminaries on the concept of consent 3. Consent is necessary but insufficient a. Consent is necessary for privacy b. Consent is insufficient for privacy 4. Scholarly and policy arguments about consent identify shortcomings of existing consent mechanisms but fail to engage adequately with mechanism design that could improve consent mechanisms a. Failed disclosure mandates b. Transaction cost analysis c. Cognitive biases d. Consumer beliefs and preferences 5. Reform proposal a. Need and opportunity for reform b. Legal requirement of demonstrably informed consent c. Friction-in-design mechanisms to operationalize demonstrably informed consent d. Role of standards, regulations, and courts 6. Some applications and preliminary experiments a. Human subjects research b. Parental consent c. Lawyer-client confidentiality requires informed consent of client when lawyer inputs information pertaining to representation in a GenAI tool d. Cookie consent mechanisms e. Digital contracts with privacy terms i. App download ii. Course management software log-in iii. Commercial website / service iv. Gym membership f. Photograph and recording consent and release form 7. Responding to anticipated objections 8. Conclusion
For privacy laws generally, child privacy in particular, and many related areas of law where parental consent is required, this article proposes a new legal standard of demonstrably informed consent. This rule would put the burden on the party drafting and designing consent mechanisms to generate reliable evidence that a person actually understands the consequential terms to which the person agrees. A doctrine that requires actual comprehension, rather than notice and assent, is feasible and normatively desirable. Of course, determining what are the substantively important terms presents an issue where regulation or court decisions may be required. Technically, companies can test and develop mechanisms for generating reliable evidence of informed consent to substantively important terms. Notably, this will require more than mere disclosure. It requires comprehension, and thus teaching and confirmation that a person understands terms to which the person agrees. Digital mechanisms that utilize prosocial friction-in-design for such purposes already exist, but there is no incentive to deploy them. The new demonstrably informed consent standard would change that. ... While it may seem mundane, learning about the digital terms that govern so much of our modern lives would constitute a significant social benefit. After all, learning about the terms of trade is the only way to have a preference about those terms; it is the only basis for making demands that drive competition or even legal change. A demonstrably informed consent standard would press companies to explain, teach and confirm understanding in order to obtain consent. Over time, this process can empower consumers, whether to drive competition or to advocate politically for meaningful privacy laws.
Outline 1. Introduction 2. Preliminaries on the concept of consent 3. Consent is necessary but insufficient a. Consent is necessary for privacy b. Consent is insufficient for privacy 4. Scholarly and policy arguments about consent identify shortcomings of existing consent mechanisms but fail to engage adequately with mechanism design that could improve consent mechanisms a. Failed disclosure mandates b. Transaction cost analysis c. Cognitive biases d. Consumer beliefs and preferences 5. Reform proposal a. Need and opportunity for reform b. Legal requirement of demonstrably informed consent c. Friction-in-design mechanisms to operationalize demonstrably informed consent d. Role of standards, regulations, and courts 6. Some applications and preliminary experiments a. Human subjects research b. Parental consent c. Lawyer-client confidentiality requires informed consent of client when lawyer inputs information pertaining to representation in a GenAI tool d. Cookie consent mechanisms e. Digital contracts with privacy terms i. App download ii. Course management software log-in iii. Commercial website / service iv. Gym membership f. Photograph and recording consent and release form 7. Responding to anticipated objections 8. Conclusion
This article argues that consent is a necessary but insufficient mechanism for privacy governance. First, it explains why consent is necessary. Practically speaking, consent will not be replaced fully with substantive regulation. It is too deeply embedded in societal understanding of and expectations about privacy; there are good normative reasons for affording people meaningful agency in governing their data and other privacy-relevant relations with others. Second, the article explains why consent is insufficient, leveraging extensive scholarship on the limitations of consent and the social/relational consequences of privacy. (See, e.g., Cohen 2019; Cohen 2012; Viljoen 2021). Third, the article explains how and why arguments about consent miss the mark by failing to engage with plausible mechanisms for improving how it works operationally (See Elvy 2024; Frischmann & Vardi 2025). Fourth, the article argues in favor of legal regulation requiring demonstrably informed consent and implementation of friction-in-design mechanisms that would operationalize that legal requirement (Id.). Finally, the article describes interdisciplinary experimental work testing such mechanisms. Some privacy scholars argue consent mechanisms ought to be replaced with better privacy laws grounded in substantive rules and duties, such as a duty of loyalty (See, e.g., Richards & Hartzog 2021; Susser 2019). Other privacy scholars argue that “murky consent” should be tolerated but recognized as not fully legitimate (See Solove 2024; Elvy 2024). Consent, whether based in the notice-and-choice approach (US) or the express consent approach (EU), is heavily criticized for failing to achieve its basic normative objective, which is affording people a reasonable degree of autonomy in governing their privacy. The reasons for such failure are many, ranging from consent mechanism design to cognitive burdens, decision fatigue, and coercion (see, e.g., Bailey et al. 2021; Solove 2024).
Can we use ChatGPT or other genAI? No. Why not? There’s no need, it’s not helpful, … not skills we’ve focused on, too easily leads you astray, too difficult to properly attribute authorial responsibility, not an equal playing field for all students in the class, … [I could go on and on, as you know.] Bottom line: No. Not difficult to detect. Not worth it. Violation of my exam rules = violation of honor code, can have serious consequences not only for grading in this course, but with law school, bar admission, etc. But please, use spell check and grammar check functions in word processing software. You see? I am no Luddite. Some AI is allowed!!!