Privacy self-management and the consent dilemma

The current regulatory approach for protecting privacy involves what I refer to as "privacy self-management" - the law provides people with a set of rights to enable them to decide how to weigh the costs and benefits of the collection, use, or disclosure of their information. People's consent legitimizes nearly any form of collection, use, and disclosure of personal data. Although privacy self-management is certainly a necessary component of any regulatory regime, I contend in this article that it is being asked to do work beyond its capabilities. Privacy self-management does not provide meaningful control. Moreover, people cannot appropriately self-manage their privacy due to a series of structural problems. There are too many entities collecting and using personal data to make it feasible for people to manage their privacy separately with each entity. It is virtually impossible for people to weigh the costs and benefits of revealing information or permitting its use or transfer without an understanding of the potential downstream uses, further limiting the effectiveness of the privacy self-management framework. In order to advance, privacy law and policy must confront a complex and confounding dilemma with consent. In this article, I propose several ways privacy law can grapple with the consent dilemma and move beyond relying too heavily on privacy self-management.