Notice and Choice Must Go: The Collective Control Alternative

Abstract

Over twenty years of criticism conclusively confirm that Notice and Choice results in, as the law professor Fred Cate puts it, “the worst of all worlds: privacy protection is not enhanced, individuals and businesses pay the cost of bureaucratic laws.” So why is it still the dominant legislative and regulatory approach to ensuring adequate informational privacy online? Recent implementations of Notice and Choice include the European Union’s General Data Protection Regulation, and California’s Consumer Protection Privacy Act. There is a well-known alternative (advanced by Helen Nissenbaum and others) that sees informational privacy as arising from social norms that require conformity to shared expectations about selective information flows.

So why have twenty years of criticism been so ineffective in turning the tide from Notice and Choice to the social norm alternative? One plausible factor is that the Notice and Choice criticisms detail the flaws but do not adequately motivate the turn to the social norms. A motivationally compelling critique would show how and why the failure of Notice and Choice, properly understood, reveals the undeniable need for the collective control alternative provide by social norms. That does not yet exist in the Notice and Choice literature. Notice and Choice Must Go: The Collective Control Alternative remedies that lack.

Keywords: Notice and Choice, Consent, Free and Informed Consent, GDPR, Social Norms, Reasonable Expectations