Why “I Agreed to the Cookies” No Longer Means Anything

You never told anyone you were pregnant. You never mentioned the divorce, the diabetes risk, the second job, the fact that you are quietly caring for a parent who no longer recognises you. You clicked a few things. You scrolled slowly on a Tuesday night. You bought the unscented soap twice.

And a model, somewhere behind a login screen you have not looked at since 2021, put the pieces together — and then sold the guess.

That is the thing nobody warned you about. The privacy bargain we all grew up with was simple: you tell us something, we ask permission, we use it for what we said. Consent was a receipt. Now it is a rumour.

1. Consent Was a Receipt. Inference Is a Rumour.

The old deal had two moving parts. First, disclosure: you hand over a data point. Second, authorisation: you agree to a purpose. Consent sat between them like a signature on a delivery slip.

AI quietly deletes both ends of that chain. It derives attributes from signals you never considered data at all, and it does so at a scale where no human being could read the terms, let alone negotiate them. What you end up with is consent in name and inference in fact: a permission slip for a building you never entered.

If that sounds abstract, it is not. The published research is almost embarrassingly blunt about how little it takes.

2. What Inference Actually Is, and Why Consent Cannot Catch It

The dots you never handed over

In 2013, three researchers — Michal Kosinski, David Stillwell and Thore Graepel — took the Facebook “Likes” of more than 58,000 volunteers and asked a fairly modest question: what else can you predict from a list of public clicks?

Their answer, published in PNAS, is still the cleanest demonstration of the problem. From Likes alone, the model identified African-American versus Caucasian users 95% of the time, male versus female 93%, the sexual orientation of men 88%, political party 85%, Christian versus Muslim 82%. It also caught smokers at 73% — and, at 60%, whether your parents had split up before you turned 21, a result the authors themselves describe as only just above chance.

Nothing in that dataset was “sensitive” by design. Nobody consented to reveal their sexuality; they consented to a feature that let them tap a thumb icon. The inference happened upstream, out of sight, and it belonged to whoever held the model.

The same logic scales to less quaint inputs. A 2019 Nature Communications study by Luc Rocher, Julien Hendrickx and Yves-Alexandre de Montjoye found that 99.98% of Americans could be correctly re-identified in any dataset using just fifteen demographic attributes — postcode, birth date, gender, marital status, the ordinary stuff. Anonymisation, in other words, is a promise that the arithmetic does not keep. Which matters, because most privacy compliance is built on exactly that promise.

The law was written for disclosures, not deductions

Here is the awkward part. GDPR and its descendants were drafted around provided data. Article 22 gives you rights when a decision is made about you by automated means; the CCPA gives you notice, deletion, and opt-out rights. All of it assumes a traceable handover: someone gave us X, so we can tell you about X.

Inferred data has no handover. It has no obvious moment of collection. It may be sensitive — health, ethnicity, sexual orientation, financial strain — while the input that produced it was a soap purchase. So the compliance question “did we have a lawful basis for collecting this?” quietly becomes “did we have a lawful basis for knowing this?” Most organisations have never asked the second question, because until now there was nothing to ask.

3. Three Ways the Old Bargain Breaks

Failure one: notice cannot cover what nobody anticipated

Ex-ante notice cannot describe ex-post inference. A privacy policy is written before the model exists; inference is emergent, combinatorial, and often surprising even to the team that built it. You cannot disclose the conclusion of a calculation you have not run yet — and by the time you can, the calculation has run a million times.

Failure two: one yes, a thousand deductions

Consent is one-time. Inference is continuous. A single authorised purchase trains a model that then infers a hundred unauthorised facts about you, plus a few about people who resemble you. The permission was granted once, in a specific context, for a specific purpose, and it is now compounding in a direction nobody agreed to.

Failure three: purpose creep with no re-consent

Purpose limitation is the doctrine that says data collected for A cannot be used for B. Inference is a machine for generating B. The model takes delivery data and produces credit risk; takes browsing and produces fertility; takes tone of voice and produces “engagement risk”. The doctrine cannot follow an autonomous leap, because there is no re-consent moment to attach it to.

The fix, incidentally, is not more consent screens. It is fewer, better consent moments — plus transparency about the inference itself.

4. Regulators Stopped Reading Policies and Started Screenshotting the Interface

The dark-pattern docket

If you want a single sentence that describes enforcement in 2025 and 2026, it is this: the design is the conduct.

On 25 September 2025, on the second day of a jury trial it was widely expected to lose, Amazon settled the US Federal Trade Commission’s Prime case for up to $2.5 billion — a $1 billion civil penalty plus up to $1.5 billion in consumer refunds covering roughly 35 million people. The FTC’s theory was not that Amazon lied in a document. It was that Amazon built a sign-up flow and a cancellation flow that produced consent people did not have, with a cancellation path staff internally called the Iliad. The remedy was prescriptive: a real decline button, simpler cancellation, disclosure before billing. Design, mandated.

Note what did not happen. The FTC’s click-to-cancel rule was vacated by the Eighth Circuit on 8 July 2025 in Custom Communications v. FTC on procedural grounds. Enforcement did not pause. It simply moved to case-by-case work under older statutes — ROSCA, Section 5, the CCPA.

California has been running the same play with smaller numbers and sharper optics. In March 2025 the state’s Privacy Protection Agency fined American Honda $632,500, partly because refusing advertising cookies took two clicks while accepting them took one. In May 2025 it fined retailer Todd Snyder $345,178 after an opt-out banner that appeared and vanished, and a data request form that demanded a photo of your ID to exercise a right that requires no verification at all. Both orders were built on an enforcement advisory the agency issued in September 2024, which said out loud what most of us suspected: asymmetrical choice is not consent.

Inference moves into the price tag

Then there is pricing, where inference stops being creepy and starts being expensive.

In December 2025, Instacart agreed to pay $60 million in refunds to settle FTC allegations about “free delivery” claims, a satisfaction guarantee that paid out in credits, and free trials that converted into paid membership without clear disclosure. Read that list carefully, because a lot of commentary merged it with a different story. The pricing findings came from a separate Consumer Reports and Groundwork Collaborative investigation, also December 2025, which found identical items priced up to 23% higher for some shoppers and basket totals varying by around 7%, with an estimate of roughly $1,200 a year in extra cost for a household. Instacart disputes those figures and ended its price testing days later.

The federal thread on pricing has its own strange history. The FTC issued 6(b) orders to eight intermediaries in July 2024 and published staff research summaries on 17 January 2025, describing tools that track mouse movements, abandoned carts and browsing history, and that in one documented cosmetics example sorted shoppers by skin tone. The study was then effectively shelved — the public comment window was closed and no final report followed. On 19 August 2026 the Commission revived the concern from a different direction, voting 2–0 on a proposed enforcement policy statement on personalised pricing: disclose that the price is personalised, disclose the basis, disclose the data used. Comments closed on 25 September 2026.

Around that federal vacuum, states are legislating: New York requires disclosure of personalised algorithmic pricing, Maryland became the first state to restrict it in groceries, and New Jersey has moved on data-driven pricing. Three names for one practice — surveillance pricing, dynamic pricing, personalised algorithmic pricing — which is its own compliance problem for anyone running a single global model.

5. Europe Wrote a Separate Rulebook for Inference

Europe’s contribution is conceptual, and it is the more useful one.

Since 2 February 2025, Article 5(1)(f) of the EU AI Act has banned emotion recognition in workplaces and educational institutions outright. The Commission’s guidelines, published two days later, extended the ban in two directions worth noticing: it covers inferred intentions, not just emotions, and it applies to job candidates before they are employees. Physical states such as pain or fatigue sit outside the definition — but general stress or burnout monitoring does not qualify for the medical or safety exemption. If your wellbeing programme infers how your staff feel, that programme is prohibited, not merely disclosed.

Meanwhile the European Data Protection Board’s Opinion 28/2024, adopted in December 2024, closed the loophole that inference had been hiding in. Models trained on personal data are not presumed anonymous; anonymity has to be demonstrated, case by case, with evidence that personal data cannot be extracted directly or through queries. Legitimate interest is not a default basis for training — it needs a documented three-step test, and unlawful processing at the development stage can contaminate lawful deployment later.

That last point is the one to put in front of a board. “We did not collect anything sensitive” is not a defence if you inferred it.

6. China’s Test Is Whether the Off Switch Actually Works

China arrived at the same problem through a different door, and the door is worth studying because it is unusually concrete.

Article 24 of the Personal Information Protection Law prohibits unreasonable differential treatment in price or transaction terms under automated decision-making — the practice usually translated as big-data price discrimination — and requires that automated marketing offers either a non-personalised option or an easy way to refuse. It also grants a right to an explanation, and a right to refuse decisions made solely by algorithm when the impact is material. The 2022 Algorithmic Recommendation Provisions add the plumbing: prominent disclosure that recommendation exists, and a convenient switch.

Then, on 2 April 2026, the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security launched a joint campaign on personal information protection that targeted online advertising directly. Among the listed violations: no accessible personalised-recommendation off switch; continuing to collect personal data after the user switches it off; and failing to let users delete the profile tags built about them.

Read that list as a design spec. Not “did you disclose?” but “does the refusal actually stop the inference, and can the person delete the conclusions?” It is the most operationally specific answer anyone has given to the question this article is about.

7. The Public Already Assumes the Worst

Marketers often talk about privacy as an education problem, as if the objection were a misunderstanding. The survey data does not support that. It supports something closer to resignation.

Pew Research Center’s 2023 privacy study, based on 5,101 US adults, found that among people who had heard of AI, 81% expected companies to use the information they collect in ways those people would not be comfortable with; 80% expected uses that were never intended; 70% had little or no trust in companies to make responsible decisions about AI. Pew’s February 2026 survey of 5,119 adults found 71% saying AI will make their personal information less secure, and 67% with little or no confidence that government regulates it effectively.

Cisco’s 2025 benchmark — 2,600 privacy and security professionals across twelve countries, and yes, vendor-sponsored research, so treat it as a vendor’s view — adds two commercially interesting numbers: 95% say customers will not buy from an organisation whose data protection they distrust, and 90% say strong privacy laws make customers more willing to share data with AI tools.

Put those together and the strategic conclusion writes itself. Privacy is not the tax you pay for personalisation. It is the precondition for anyone believing your personalisation was meant to help them.

8. The Trust-Earning Playbook

Ask more, infer less

Zero-party data — preferences, intentions, declared attributes — is the only category you can defend line by line, because the person told you. Every inference you skip is a liability you never carry. The instinct to deduce rather than ask is a habit, not an economic necessity.

Minimise sensitive inference by design

Do not build models that infer health, ethnicity, sexual orientation, political lean or financial distress unless the purpose genuinely requires it, and document that purpose before training, not after. The inference you never made cannot be subpoenaed, leaked, or used to price someone out of a product.

Explain the inference at the moment of use

If a recommendation rests on an inferred attribute, say so where the person can see it: “we think you may be shopping for a household of four, based on basket size”. Explanation converts uncanny into accountable. Vague reassurance converts accountable into suspicious.

Make consent symmetrical

One click to say yes, one click to say no. The same medium for signing up and cancelling. A refusal that stops the processing, not just the display. California has now fined asymmetry twice; the EU treats it as invalid consent; China treats a non-working off switch as a violation. This is the cheapest compliance work available and the most visible.

Govern inference as processing, because it is

Map where inference happens, write it into your data inventory, run it through a data protection impact assessment, and give people a route to object and to delete derived tags. The EDPB’s three-step test and China’s tag-deletion requirement are the same instruction in different languages: treat the conclusion as data.

9. The Honest Caveats

“We only use purchase history” is not a defence. Purchase history is one of the richest inference substrates there is. Innocuous input, sensitive output — the input’s innocence is exactly what makes the output defensible on paper and indefensible in a headline.

More banners will not save you. Additional friction does not reduce inference; it trains people to click through and gives regulators a paper trail of consent nobody read. Add transparency, not toll booths.

Over-correction has a real cost. Switch off every personalisation signal and you lose the relevance dividend that funds the whole exercise — and customers notice a worse experience long before they notice a principled one. The goal is transparent, minimised, meaningful personalisation, not its abolition.

And there is a genuine tension. Inference is a capability, not a category. Used with disclosure and restraint, it makes a mediocre experience useful. Used in the dark, it makes a useful experience predatory. The line is not technical; it is whether the person on the other side could see the inference and object to it without a fight.

10. Conclusion: Transparency Is the Consent That Works

AI did not merely collect more data. It learned to conclude — to convert ordinary behaviour into sensitive fact, continuously, at a scale no consent screen can bound. The legal order is catching up unevenly: American enforcement punishes the interface and now demands pricing disclosure; Europe bans emotion inference where power is lopsided and refuses to presume anonymity; China insists the off switch stops the collection and the tag can be deleted.

For anyone building campaigns on top of this machinery, the position that earns trust is the opposite of the industry default. Ask for what you need instead of deducing what you can. Minimise the sensitive inferences you make at all. Explain the ones you keep. And make refusal as easy as agreement.

Inference is powerful. It compounds trust only when it is visible and accountable. In the age of inference, transparency is the consent that actually works.