Govern
Consent & Data Use Transparency
What data is being used and how?
Makes personal data use understandable at the point of decision, so consent is informed rather than just collected.
- Evidence: research-based (Gray et al. 2021, Cavoukian 2009)
- Tested: concept only, mock data
Overview
Why it matters
"I agree" is not the same as "I understand".
Someone clicks "I agree" in two seconds. Paragraph 18 of a 4,000-word document says their data may be used to train AI models. They didn't know, and they would have cared.
The gap between legal and informed consent is almost entirely a design problem. For AI, it matters more: using data to train a model is a different purpose from using it to deliver a service, yet most consent flows treat them as one.
What does it look like?
Layered consent at onboarding
Layered consent at onboarding
- User creates an account for a service that uses AI.
- Consent flow presents: brief summary of data use in plain language.
- User can accept basic service terms and separately choose whether to opt in to AI model improvement use.
- Controls are genuinely separate: declining model training does not affect access to the service.
- Choices are stored and reflected in the user's data rights panel.
Exercising the right of access
Exercising the right of access
- User wants to know what data the system holds about them.
- Data rights panel: "View my data" → user is presented with their data in a readable format.
- User notices an incorrect attribute (wrong employment status from a third-party source).
- User submits a correction request. Correction is applied; correction event is logged in the audit trail.
- User is notified when the correction has been applied.
Objecting to automated processing
Objecting to automated processing
- User receives an adverse automated decision and wants to object.
- Data rights panel includes: "Object to automated processing."
- User submits an objection.
- Case is routed to human review as required by GDPR Article 22.
- User receives a response within the legally required timeframe.
When does it fit?
Use it when
- The system processes personal data to make or support decisions
- Personal data is used to train or improve models
- Data is used beyond the purpose it was collected for
Skip it when
- No personal data is processed
- "Consent theater" is the only option: then reconsider the data use itself
Design
How do I apply it?
-
Design for understanding, not completion.
A screen built to be accepted fast produces uninformed consent.
-
Separate service from training.
Delivering a service and training a model are different purposes. Ask separately.
-
Make rights usable.
"See all data we hold about you" beats "you have the right to access your data".
-
Name AI uses plainly.
"To improve our services" doesn't describe model training. Say what happens.
-
Tell people when use changes.
A quiet policy update is not a notification.
How can I show it?
Data use summary card
What data, for what, who sees it, how long.
A compact, plain-language summary of what personal data is used in this system and for what purpose: - What data is used (categories, not raw fields) - Why it is used (the purpose) - Who can access it - How long it is retained - The legal basis
Model training opt-out
A separate switch for use in model training.
A specific, visible control for whether the user's data is used to train or improve AI models. This is distinct from consent for the service itself and should be separately controllable.
Purpose-specific consent controls
One choice per purpose, not one box for all.
Separate consent for separate purposes, not a single checkbox for everything: - Consent for processing data to provide the service (may be required) - Consent for using data to improve the AI model (genuinely optional) - Consent for sharing data with third parties (genuinely optional)
Layered consent flow
A short summary first, full detail one step away.
A consent interface designed for genuine understanding, not speed of completion: - Layer 1: plain-language summary of key data uses (can I proceed without reading further?) - Layer 2: full details for each data use category - Layer 3: link to the full privacy notice
Data use change notification
An active message when data use changes.
When data use practices change, such as new purposes, new third parties, or new AI training uses, send a proactive notification to users, not just an update to terms of service.
Data rights access panel
See, correct, delete or download your data.
A persistent interface for users to exercise their data rights: - View the data held about me - Correct inaccurate data - Delete my data - Object to automated processing - Download a copy of my data Each right links to the mechanism for exercising it, not just a description of the right.
What does it cost?
Informed consent vs. fatigue
The more detail, the less is read. Test whether people actually understand.
Transparency vs. business secrets
Data use can reveal how a system is built. Weigh it against people's right to know.
Control vs. model quality
Opt-outs can reduce model quality. Solve that in the system, not by hiding the opt-out.
Connections
Which patterns work with it?
Data Provenance & Lineage
Where does this data come from?
Provenance shows where data came from. Consent & Data Use Transparency shows what it's used for. Both are needed for complete data transparency.
AI Presence Disclosure
Am I interacting with an AI?
Disclosure says AI is involved. Consent transparency says what data is used in that AI involvement.
Audit Trail & Logging
What is the complete record of this decision?
Consent records are themselves audit data: what was consented to, when, and with what understanding. They must be logged.
Contestability & Appeal
How can I challenge this decision?
The GDPR right to object to automated processing is a form of contestability specifically tied to data use.
Sources (4)
Sources (4)
European Union (2016) — General Data Protection Regulation (GDPR)
Articles 13/14 (information obligations), Article 15 (right of access), Article 17 (right of erasure), Article 21 (right to object), and Article 22 (automated decision-making) form the comprehensive legal framework underlying this pattern
Gray et al. (2021) — Dark Patterns and the Legal Requirements of Consent Banners: An Interaction Criticism Perspective
analyzes consent banners through the lens of dark patterns, documenting how consent interfaces are routinely designed to maximize consent rates rather than informed consent: the "consent theater" problem this pattern is designed to counteract
Cavoukian (2009) — Privacy by Design
foundational framework proposing that privacy be built into systems by design rather than added as a compliance layer. Informs the proactive transparency approach of this pattern
European Union (2024) — EU AI Act, Article 13
transparency obligations for high-risk AI systems: providers must give deployers instructions that disclose the system's capabilities, limitations, and the data it was designed to work with. The right of affected persons to an explanation of individual decisions sits in Article 86
"Users agreed to the terms" doesn't cover how you now use their data.
Often noticed when new AI training uses come into scope. That's where this pattern starts. Let's look at your interface together.
Work with me