Delete Cookies, Not Digital Rights

You might think all of this has little to do with you. After all, being identifiable online may not seem dangerous. But consider the following cases, which show how easily companies can exploit our data, often without us realizing it. It is important to remember that large platforms will always use our information in their own interest unless we demand proper protection.

Between 2013 and 2018, Facebook promoted a “fun” personality quiz that secretly harvested data from users and their friends, later selling it to a political consulting firm. That information was used to micro-target political messages and influence voting behavior, turning a harmless game into a tool for manipulation.

In 2017, the fitness app Strava published a global “heat map” that unintentionally exposed the locations and routines of military personnel around sensitive bases. Many users were unaware that their workout data could reveal such details, demonstrating how “unintentional” data sharing can have serious security consequences.

A prominent EU case is the 2020 Vastaamo scandal in Finland, where a psychotherapy clinic was hacked and thousands of sensitive patient records were stolen. Attackers later tried to extort both the company and individual patients, showing how failing to protect personal data, especially sensitive health information, can have severe real-world consequences.

These are only snapshots of a much broader problem, one that often goes unnoticed precisely because it is invisible. And yet, at the same time, the EU is considering regulatory changes that could weaken existing protections. The European Commission has proposed delaying key parts of the AI Act and easing GDPR rules, making it easier for tech companies to use personal data to train AI without consent and reducing the need for cookie-consent requests. Civil society groups warn that these changes would weaken digital rights, let companies use more sensitive data, and reduce privacy protections.

Numerous similar incidents remain overlooked by the public, and their invisibility is precisely what makes them so alarming. These examples show that our personal information has much more power than we often tend to think it does. This also means that users can have much more power than they are currently granted. The issue isn’t the absence of data-protection mechanisms, but the lack of public awareness about how personal information can be misused. That’s why raising awareness and teaching users how to protect themselves is essential.

It is time to restore genuine consent in digital spaces through a system that is simplified and transparent. Giving consent should not require a law degree; every user must be able to understand what is behind the “accept all” button. Current cookie consent banners are often created in a way that fills them with jargon and makes them excessively long. Instead, websites and platforms should provide short, clear summaries that tell users exactly what data is collected, why it is collected, how long it is stored, who owns it, and for what purpose it is used. Basically, this means no euphemisms and no buried disclosures. The user should have the option to still access the full versions of what they are signing, but it is crucial that the first interaction is one that is transparent, yet simple and understandable.

Our idea is that of a two-step consent model. The first step would be a concise executive summary. Then, the second step would be an optional detailed section for those who wish to examine further what they are consenting to. For this process to be truly beneficial for the user, manipulative design features (for instance automatically accepted cookies or the lack of a “deny” button on the initial pop-up) must be banned. Deceptive design practices like this decrease user trust by making websites and companies seem untransparent. Even if transparency wasn’t an issue, who would willingly spend the equivalent of a work-week every month reading through the privacy policy of each website they visit or app they use? Giving consent should not require a law degree – nor should it mean that users should, in theory, spend half of their lives reading tedious data policies and terms (and conditions) sections. Improving disclosure practices will help reclaim users’ rights by enabling real understanding.

For people to understand what is at stake, there needs to be education about our rights to privacy and data protection as fundamental to digital literacy. Schools and workplaces must integrate short modules on online privacy, consent, and personal data rights. People need to understand the implications of data collection and selling. The internet is not a neutral territory - with every click and like, we are positioning ourselves and contributing to the making of the world online (and offline). As users, we might feel like decisions are up to those who create our platforms, but we hold power through our consumption.

Restoring the meaning of, and then working towards re-claiming, digital consent also necessitates the enactment of policy-change at the community level. As it stands (and especially after recent back-paddling), the EU’s data protection framework provides something by way of principle, but has little to offer in terms of consistency in practice. “Consent” is meant to be informed and freely given, but the way in which privacy notices are presented to users varies significantly from one platform to another – leading to unnecessary confusion and, ultimately, growing desensitization. As a quick fix, a standardized consent format should be mandated across platforms and websites. Harmonization of this kind will help ensure that “choice” can mean the same thing across the web.

Disclosure should be pushed further as well. Dealing with personal data that is gathered in what is increasingly a digital public sphere, companies should clearly disclose what data is stored where, by whom, why, and for how long. While the GDPR already mandates certain things to this end, the way in which these obligations are met is through privacy notices that are all but unreadable for standard users. Improving disclosure practices will help reclaim users’ rights by enabling real understanding.

Above and beyond the reactive practice of doling out fines for infringement, regulators must reclaim the power they have by stepping up the enforcement game. Mandated routine, independent auditing by public authorities or certified third party bodies will ensure that compliance becomes part of daily business for companies – instead of being a pesky afterthought.

Given that it is ultimately also in companies’ own interest to restore their appearance of trustworthiness in the eyes of consumers, it is quite fundamental that we advocate for ethical considerations to become part and parcel of corporate governance. The GDPR requires organizations that process a certain ("large" or “far-reaching”) amount of personal data to appoint a Data Protection Officer. While we might want to extend this practice to all companies handling personal data, it is worth considering whether, given the far-reaching societal impacts of data-practices, the duties of such officers should not be extended, or whether it might be worthwhile additionally appointing “data ethics officers.” Such officers would oversee practices in terms of broader notions of fairness and bias, handle internal monitoring of consent and privacy practices to detect potential misuse early, and provide regular reporting to authorities and the wider public.