PANEL: Consent’s Journey from Annoying to Meaningful: Can Tech actually eliminate Cookie Consent Boxes?

So Martin's just been talking about how identity governance is moving beyond the traditional perimeter. And so that brings us neatly to the topic of the panel discussion because control, trust and accountability are also being redefined. And the area that that's happening in is the area of consent. And to explore the theme of modernizing consent, we've assembled an esteemed panel who needs no introduction really, Yves Mallot and Max Schrems. Please give them a warm welcome. So the title that they've chosen, thank you Yves, is Consent’s Journey from Annoying to Meaningful.

Can Tech actually eliminate Cookie Consent Boxes? That's a really great question. So time is short, let's get straight to it. I'd like to hear from each one of you, starting with you Martin. To what extent is consent as it's defined now failing or how and why is consent as it's defined now failing to deliver meaningful control to the end user? So if I were a cynic, I would say the most obvious and visible thing GDPR has brought to us are annoying cookie consent boxes. So this is really our GDPR experience in a bit and we end up very frequently with allowing way more than we intend to do.

So I think we need to think about isn't there technology, storing and verifying credentials, we potentially can use to get much better and much less intrusive on that and that would be something I really would love. Privacy without pain.

Well, I guess I'm next in the row. People may remember a couple of years ago I was talking about consent being dead. My take on why it's been failing to deliver is that we've set up the system structurally to make it fail. And that's because data monetization is a thing and it's way more powerful to any one organization's bottom line than identity solutions of any type, including decentralized identity ones. So I don't think we've really confronted that as the blocker yet. A couple of years ago I said the purpose of a system is what it does.

That is to say you can tell the purpose of a system from what it does and we're seeing what it does. And GDPR was not a great success so far.

Yeah, I think being the GDPR lawyer probably we have to separate a couple of things because there's six one legal basis. We have six different ones. The GDPR consent requirements is the one that people see, but 90% or 95%, probably 99% of licensing happens without any consent request, but for all the other legal basis we have. So there is this one bit.

What's interesting is there's this discussion right now about solving it through a digital signal, which is this 88B of the digital omnibus that I was actually yesterday at a workshop in Brussels on this and tomorrow is another one in Brussels, so back and forth on exactly that point. And there is this solution for about 20 years to automate, so to say, the last mile that there is a digital signal where I have an agent or whatever it is that then says yes or no and stuff. And interestingly the whole industry is against it. So why is that?

And basically the bottom line is a lot of this is always blamed on the GDPR or on the privacy people or something, but in reality that friction is intentional by the businesses that just want to be able to process data in situations where generally there is a no. And the only way that we can do that is consent. That's a big problem from a like how to solve it is we have consent in the Charter of Fundamental Rights, so we would need to change the EU treaties to get rid of consent in privacy.

So the only way is that we can optimize it realistically of like having more meaningful what you mentioned before, like actual consent of what people want, because bottom line it's a fundamental right, but you can give up your fundamental rights. I always say you can jump off the bridge and give up your right to life, so you can also give up your right to privacy, but it has to be done in a way that it's meaningful and people actually want that in reality. I wonder why people say that we're often depressing when we're up here.

So, Yves, you mentioned an interesting word there, monetization, and I'd like to maybe start with you, Max, to drill down in that a bit. To what extent is consent, I know this is one of the things you're keen on, is just a symptom of the deep issues in the data economy and the advertising model?

Yeah, I mean, the bottom line is it basically it's prohibited to use someone else's data. That's the fundamental rule we have ever since 1995, just that the larger parts of the industry don't get over that. The only way to legally get over it is to ask people for consent all the time. The original idea was that you simply don't do these things, and only in the exceptional case that someone is like, I really want to be tracked by you, I really want you to follow me around the whole internet, then the person has the right to say yes on this.

Like the reality has totally shifted, and a lot of it is really interface. Bottom line is it's really about the interface and how that transaction works. And that's not specific to privacy, I think that's important too. Same problems we have in consumer contracts. When I was in the US, most people, you can put anything in a contract in the US, basically, compared to the European levels, and we prohibited most of that because people do not read contracts.

And it's a typical one-to-many situation, you're a company, you have one lawyer that drafts the contracts for millions of consumers, and all these millions of consumers would have to get a lawyer and go through it and blah, blah, they're not going to do that. So the transaction costs are very one-sided, and that is where typically you simply prohibit certain practices because the market doesn't solve that. Or the other option is the transaction is made more efficient so that we have a functioning market.

That is a bit where research goes into to say once you have the full information and the possibility to say yes or no in a meaningful way, actually people make these decisions if they're processed in a way that is not, I think around 10,000 requests per day or so. I want to throw in two thoughts. The one is we have a trending AI nowadays. So we have something that could handle this on our behalf without permanently being asked.

I think this is something which may become a game changer because an agent is very well able to move all the interesting things from yes to no, which is totally annoying for a human. So this is the one thing. And totally illegal already. The other thing is when you look at the monetization aspect, doesn't it at the end of the day still fail? Many years ago we had here Doc Searles talking about attention economy versus intention economy. So we still try to figure out what someone wants to see next and most of what they see in AdWords on the web is total nonsense, totally irrelevant to us.

So it greatly fails. From a business perspective it would make way more sense to ensure that people see exactly what they are interested in at that point of time. Doc Searles wrote a book a long time ago and I think the point is back then we didn't have the technology. Right now we could have the technology to ensure that what we see, if you don't want to pay for the content, what we see is what we want. I'm going to push back a little bit. I love the work that Doc and others have been doing on what's now called My Terms. So the standard has now been ratified, the IEEE 7012.

I think it's amazing. The reason why I think we're still going to struggle as long as you're the second person to the table, as long as somebody is making an offer that you then are in a position to accept or not accept, theoretically, is that the deck is always stacked against you. And one of the things that I think is promising about the My Terms approach is that you can set your terms before anybody else arrives at your data and you don't have to be online when that happens. The asynchronicity, I think there's power in that. Technology is great.

I don't think technology is going to get us out of this because we've had a lot of great technology around for a long time. But I think to add one more point, currently some intermediaries earn a ton of money. And in a sense it's wasted money from the advertisers and from everyone else. So I think we have the chance, and that's a business aspect, to get rid of a lot of the intermediaries in the advertising space. And then there's a business advantage for everyone else. And who cares about intermediaries?

I mean, there's so much to kind of throw in. We looked very much into the pay-or-came model because we were interested in that and then really went into the economics of a lot of that. And it's so much more nuanced than like the pay versus content and so on. The interesting thing is that a lot of the quality journalism or the quality content we have cannot sustain even if they have all personal data. For example, look at the US. The Washington Post is also dead despite not having privacy protection. So privacy is not going to solve quality journalism or quality media.

That's one of the fundamental problems that we have. And that needs to be untangled. And then the other question is where does the money go and where does all the ad revenue go? And bottom line is it goes to four or five big international companies. And everybody else that we used to be able to fund with advertising is dead and is dying in the current system. So to change that current system, I think fundamentally probably benefit the vast majority of people. The big question is where do we want to go to?

One theory that I found interesting is if there's less data to a certain extent, the advertisement is not going to go away. Because if the whole market just has less data, you still have to advertise somewhere. And what was interesting when we looked into pay-or-came, for example, is that some of the publishers came up and said, actually, we're still making the most money with directly booked advertisement where you just booked a whole New York Times front page basically for an advertisement, not personalized, from a privacy perspective, not a problem at all. And the most revenue actually.

Now that has vanished because by now you can retarget the person from the high value publication on some shit page for almost no money. And that is a lot of parts where this data going out is even harming some of the publishers. Because it used to be that you have that exclusive knowledge that this is the high quality reader interested in this and that topic, because they're on our website. And now you can, and it used to be you could only get the people there because you didn't know where they were going next.

Now we can track them, obviously, a lot of that value proposition that some of the high quality publishers have apparently is also going with Google and so on. And I think a lot of that would need bold market decisions. But right now the publishers are terrified. And that blocks almost anything. So right now with the signal that we're discussing in Brussels, literally right now, it's interesting that the publishers are saying, you know, and you ask them, what is the alternative? What is going to solve the problem?

We don't know, but just don't change anything because we're so close to death, we're just afraid of anything. But I think that is a bit suicidal, isn't it? This position?

Well, there's a lot that's suicidal what's going on right now. I mean, like these intermediaries who pushed back that you were talking about, they're going to continue to push back until their dying day. And it may take a long time for that kind of long tail of opposition to play out. And in the meantime, I'm kind of encouraged by if we're thinking about content that you can choose to pay for, like we all pay for what it is we're using online in one or more of multiple ways. There's money. There's data. You give them data about yourself. And there's attention.

Your eyeballs as they sell back retargeted stuff to you. So like when the opportunity came for people to simply pay for a service with money instead of those other methods, we got the pay ROK scandal. So there's kind of no way for people to win who are trying to change some of these things.

I mean, pay ROK is its own beast. To be honest, that's a gateway drug just to go towards like subscriptions, which subscription is absolutely fair. Where we have a problem is the pay ROK approach because it gets a 99.99% concentrate. So I usually call it the North Korean concentrate. We know that about 3% of people actually want to be tracked online. If you have very sympathetic questions, then you get to 10% of people that actually want to be tracked online. And then we get 99.9% of people that actually click on it. So that's not really what freely given consent was meant to be.

I'm going to so use that phrase. It just encapsulates the whole problem in one sentence. We got Kim Jong-un on the cover of our report on this because it's really so absurd that we're discussing that that should be freely given consent. But the really interesting question is if some of that is broken up, we have to go away from like binaries of having data or not having data.

For example, there is research that would show that people are more willing to give their personal data to a trusted platform, which is typically their newspaper, for example, while they're not willing to give the data to the very big guys. And once you have transactions that are more meaningful and people can actually make more meaningful decisions because they have an agent, back to what you mentioned before, that could actually work. Interestingly, I think AI would help a little bit here.

But the reality is that 99% of all relevant tracking advertisement is done under a current very old style JSON file that is defined by the IAB. And these purposes are defined by the IAB. So you can really, with like the dumbest logic from the 90s, still do every meaningful agent that would give a proper answer back. And that there are some research, especially in Germany, that goes basically in the setup process through, you know, what are the 10 things you're okay with or not? And then it would generally answer that back.

Or what we said an agent like that could be like, I only ask you once you visit the page the third time, because let's be realistic, you're just getting a recipe for apple strudel. You're not going to be interested in privacy choices right now if you go to that website once in your life. But if you go to your newspaper each week, you probably want to say something on what's okay with you or not. And that could be interesting that that would actually open up this more meaningful thing.

And interestingly, the companies that are always about like personalization and being, you know, doing exactly what you want as a customer, blah, blah, blah, are exactly the ones that are absolutely blocking this idea. Because right now, they're just basically pushing you into consent and bully you into it by annoying you so much. And that is the current business model, which largely is illegal, but we have authorities that basically do nothing about it. We brought hundreds of complaints, most of them go nowhere, because the authorities we have simply do not enforce that.

So maybe we don't trust me to wait until they finally failed. And the new ones appear on the market. I don't know if I can wait that long for change. But this is why I don't even, I don't even like the word consent anymore, really, although it's very tough to get off of it, because it's what people understand. But it's legally defined as basically opt in or opt out and opt out is made illegal. It's very unsatisfying for somebody who wants to control anything or just have visibility into what's happening out there.

I just prefer permissions, you know, and we know in this room that authorization technology is how all those permissions are going to have to be enforced. So why not just go straight to it? Because people don't differentiate between some legally compliant consent versus permissioning a device or an application to connect to them.

If you permission someone to do something with your data for a defined purpose over defined time, like you're looking for a new car, then you may have some entities which deliver you information which figure out which is the best vehicle, which maybe say, okay, this is an additional information, which might be very interesting to you. And then you sign the contract for your new car and say, okay, the next five years, I'm not interested in this anymore.

Okay, Max, before you go, you mentioned about tracking earlier. So I'm just trying to drill down into that sort of, what would happen if tracking were to be, tracking-based advertising were to just disappear, or was heavily restricted? Would we end up with a better sort of equilibrium, do you think?

I mean, I'm a liberal, largely, or libertarian, even, in this one, which I hardly would ever use for myself otherwise. But in this one, quite frankly, if people want to be tracked, fair enough. There was the option to just say, let's prohibit online advertisement that is personalized at all. We can do that too.

Like, we limited a lot of advertisement, just because in a digital space, everybody thinks that's pretty extreme. But for example, in Europe, there's no more than six minutes of advertisement on normal TV channels.

Like, we just told private businesses, you can't have more advertisement than six minutes an hour, full stop. We basically prohibit that it's louder than the rest, which in the US, once you have like an advertisement, the TV is suddenly blasting at you, because it's twice the sound level. A lot of that we just prohibited, and we could do that on social media as well. We could say a news feed has to have 10% news in it. How about that? And we have must-carry rules in networks, all of that we did.

So I think there is a lot of options we already did in other media for 100 years, that we should just somewhat similar, apply at least to it. That would already make a big difference. Going back to your question on actually really prohibiting it, that would be one option. I personally think if people really want to have it, fair enough. And there may be situations where people actually find it beneficial, as you mentioned it before. Best example is retargeting. People find that super creepy that shoes are following them.

But the reality is, if you're retargeting, you usually get a 30% discount on the shoes you were close to buying, and it may actually be a deal that is not very data invasive. It's basically you looked at that three days ago, which is very different than building a whole profile about everything you did the last two years online. And that may be something where people have different views of what they're happy with or not happy with. Once you're educated, then they can make one or two choices that prolongs for the next couple of years and not have to do it on each page.

So we're rapidly running out of time. Maybe we could just focus on the technologies.

Martin, can technologies such as wallets and verifiable credentials or machine-readable policies eliminate these annoying cookie banners and improve both privacy and user interaction? Eliminate is a big thing, I would say. But I think we have more and more technology. As I've said, when you go back these 10 years or so, or even more to when Doc Service talked about this, we had the idea about the technology. When GDPR was introduced, we had a very different set of technologies than we have today. So I think we have quite a lot of technologies which can benefit most of the players.

I think that we also clearly need to work from different ends, like also the legal thing. I think the same is like, why doesn't have an influencer the same obligations like a journalist, for instance? So I think we need to think about some of the rules we are setting properly. And then I think we can make progress. It will be still a long journey, but I think it makes a lot of sense. You talked about new standards arriving. I think we are doing that anyway. It's a journey, but I think it can help most parties a lot.

I'm going to say, I give it sort of a partial yes to what you're saying, because wallets and verifiable credentials deliver data of known quality. If that data is relevant to some of the potent solutions that are coming online, well, then they can be an unlock for those solutions, whether it's literally keys that help you manage things like fully homomorphic encryption, or they contain your terms that somebody needs to agree to, things like that. I don't think wallets have proven yet that they inherently constrain... They may be an element of it, they are not the solution, very clearly.

They're the signal side, I would say, and if the signals are used cleverly, it can factor into the decision-making and the enforcement. It's really not a single technology.

Yeah, clearly. Okay, so we need to start wrapping up, unfortunately, I knew 20 minutes was going to go like that, and it did. So to wrap up with some sort of forward-looking insights, could each of you just tell us what realistic changes can we expect, say, in the next 12 months or so that could improve how consent works in practice?

I think on our end, the most simple thing is this ADAB of the new digital omnibus that basically covers exactly that topic of having automated signals, and the big part is if industry has any positive signals, because right now, Google is dominating the lobby fight in Brussels and is absolutely dead against it. If other players are like, quite honestly, that would be a possibility for us to be that agent that does that part, and we have technology in that direction, that would probably help some of the conservative parts to swing it.

Yeah, I'm going to say there's exciting technical things that are going on. I've mentioned a few of them, I won't mention them again, but there's some exciting non-technical things that might go on, like I'm still keeping an eye on the unfollow everything 2.0, which is about taking the shackles off of people to do stuff with big, you know, with very large online platforms behaviour. If you're not familiar, it was this guy who wants to be able to change your Facebook feed so that you get to only see what you feel like seeing, and he's been scared into not being able to deliver it.

And so I actually think, since we already have, even in the EU, there's 100% coverage of the online population by folks like LiveRamp, who are enabling all the retargeting, right? Identity resolution has taken over, we tend not to see it every day. Given that, I'd rather see less regulation to make it more possible to innovate the things that might work. Follow IT Martin. I would say everything has been said by the two, so I don't want just to be repetitive. I think we have a chance to improve things, it will take time. Thank you very much. Thanks a lot.