Consent Fatigue: Rethinking User Autonomy and Transparency

🧠Executive Summary

This paper explores the growing challenge of consent fatigue in digital environments, where users face repeated, often poorly timed, and complex privacy prompts. Such prompts can undermine autonomy, diminish trust, and reduce the effectiveness of consent as a tool for personal data protection. Drawing from legal, design, and ethical perspectives, the analysis identifies systemic causes, assesses current regulatory responses, and proposes actionable solutions.

Key terms are defined, including consent fatigue, dark patterns, layered consent, and meaningful consent, to establish a shared vocabulary. The paper reviews regulatory initiatives in the EU, Japan, and the UK, and examines sector-specific patterns in healthcare, mobile apps, e-commerce, and consumer technology. Five systemic failures, ranging from legal formalism to dark patterns, are identified as core drivers of user disengagement. 

Proposed solutions include design strategies such as layered consent, just-in-time transparency, and consent dashboards, alongside cultural shifts reframing consent as an ongoing relationship rather than a one-time event. Eight tables summarize key definitions, regulatory comparisons, sectoral trends, systemic failures, strategies, cultural shifts, and reform priorities.

The recommendations align with global data privacy and protection frameworks, emphasizing transparency, user control, and cross-jurisdictional harmonization. Implementing these reforms can help create a trust-centered consent model that supports user autonomy while ensuring compliance

.

🧠 Introduction: Reassessing Consent in Digital Environments

Consent, once regarded as a cornerstone of digital autonomy and trust, is at risk of becoming functionally obsolete (Centre for Information Policy Leadership, 2024). Across apps, websites, health systems, and smart devices, users are continually asked to agree to terms they rarely understand, in moments they rarely control, for purposes they can seldom anticipate. This overexposure to consent requests is often delivered through dense policies, misleading interfaces, or poorly timed pop-ups. It has also produced a cognitive and emotional state widely recognized as consent fatigue.

Consent fatigue occurs when users, faced with repetitive or confusing privacy prompts, become increasingly disengaged from the decision-making process. This is not mere laziness. it is a rational response to an ecosystem where the burden of privacy protection has been disproportionately shifted onto individuals. Instead of empowering users, many consent systems now operate as compliance shields for organizations, obscuring rather than clarifying the scope of data collection and use.

The stakes are high. When users routinely bypass consent prompts, the legitimacy of digital governance erodes. If consent is to remain a meaningful safeguard for autonomy, dignity, and agency, it must be reimagined. A novel approach is urgently needed. One that respects users' time and cognitive limits while preserving their rights.

This article provides a comprehensive examination of consent fatigue as a design, legal, and ethical crisis. It explores how fatigue manifests across sectors, from health research to consumer platforms. It unpacks the legal and regulatory blind spots that allow it to persist. It proposes actionable reforms rooted in transparency, contextual integrity, and user empowerment. In doing so, it invites designers, regulators, and institutions to move beyond checkbox compliance toward consent as a sustainable, user-centered practice. It analyzes its causes across different sectors and assesses the adequacy of institutional, legal, and regulatory responses. It proposes a multidimensional redesign of consent. One grounded in usability, transparency, and sustained engagement.

🔑Key Terms: Framing the Language of Consent

Before examining the policy, design, and enforcement landscape surrounding consent fatigue, it is essential to establish a shared vocabulary. These terms provide a foundation for understanding how interface design, legal standards, and user psychology intersect to shape consent experiences. Without this clarity, it becomes difficult to evaluate whether proposed solutions meaningfully address the root causes of fatigue or repackage existing compliance practices.

Table 1 summarizes essential terms used throughout this paper. It is intended as a quick reference guide so that readers can easily revisit definitions, examples, and sources as they navigate the subsequent legal, design, and policy discussions.

Table 1: Glossary of Key Terms in Consent Fatigue

Term	Definition	Example	Source
Consent Fatigue	A cognitive and emotional state where individuals become overwhelmed, desensitized, or disengaged from repeated or opaque privacy choices.	Users quickly click 'accept all' on cookie banners without reading.	King & Meinhardt, 2024
Dark Patterns	UI design tactics that manipulate, coerce, or confuse users into making unintended choices, often related to data collection or tracking.	Pre-checked boxes for marketing emails.	King & Meinhardt, 2024
Layered Consent	A consent model offering tiered information: a concise summary first, followed by optional deeper layers.	Short privacy notice with 'learn more' links for details.	Symons et al., 2022; UK ICO, 2025
Meaningful Consent	Consent that is freely given, specific, informed, and unambiguous, requiring both comprehension and intentional participation.	Clear, plain-language explanations before data is collected.	Intersoft Consulting, 2025a

Understanding these terms is not merely an academic exercise. They are the standards against which legal frameworks, policy proposals, and interface designs must be evaluated. In the next section, Legal and Regulatory Efforts to Address Consent Fatigue, we examine how jurisdictions around the world are responding to these challenges. We will assess whether emerging laws, regulations, and enforcement actions are genuinely aligned with these definitions or if they risk perpetuating the very conditions that cause consent fatigue.

⚖️Legal and Regulatory Efforts to Address Consent Fatigue

Consent fatigue is no longer a peripheral concern. it is beginning to surface as a direct target of regulatory reform. Across jurisdictions, some data protection authorities are taking concrete steps to mitigate the volume, complexity, and intrusiveness of consent requests that undermine user autonomy. Most legal and regulatory frameworks were not designed initially with high-volume digital interactions in mind. Consequently, select regulators are now advancing consent fatigue-sensitive policies through formal guidelines, interim reports, and proposed statutory amendments.

Table 2 below compares the regulatory and legal measures taken by selected jurisdictions to address consent fatigue, highlighting their stage of implementation and relevance to user autonomy.

Table 2: Comparative Overview of Jurisdictional Efforts on Consent Fatigue

Jurisdiction	Action Taken	Legal Instrument / Guidance	Stage (Proposed / Adopted)	Relevance to Consent Fatigue
European Union	EDPB issued Guidelines 05/2020 and Opinion 28/2024, warning that repetitive or manipulative consent interfaces can invalidate consent.	EU GDPR; EDPB Guidelines 05/2020; Opinion 28/2024	Adopted	Sets enforcement benchmarks against consent fatigue and design overload.
Japan	PPC proposed APPI amendments to reduce repetition, introduce adaptive consent, and promote clearer interfaces.	Act on the Protection of Personal Information (APPI) – Proposed Amendments	Proposed	One of the few proposals worldwide explicitly targeting consent fatigue in law.
United Kingdom	ICO's Online Tracking Strategy outlines layered privacy notices, prohibits misleading prompts, and reduces repetitive requests.	UK GDPR; ICO Online Tracking Strategy	Adopted	Connecting overexposure to consent prompts with trust decline and usability.

These national actions mark an emerging regulatory trend: a shift from treating consent fatigue as a design inconvenience to recognizing it as a legal and ethical flaw in digital governance. While implementation and enforcement remain uneven, these examples demonstrate that some authorities are now treating consent fatigue as a structural risk to data privacy and protection legitimacy. In the next section, Patterns of Consent Fatigue Across Sectors, we examine how these regulatory principles, or their absence, play out in the real world. We will also explore how consent fatigue manifests in industries such as consumer technology, e-commerce, and healthcare.

🧪 Patterns of Consent Fatigue Across Sectors

Consent fatigue is not confined to any single domain. It reveals itself across industries and platforms, driven by the same underlying design failures: repetition, opacity, and information overload.

Table 3 below summarizes how consent fatigue manifests across key sectors, identifying common triggers, examples, and impacts on user behavior and trust.

Table 3: Sectoral Patterns of Consent Fatigue

Sector	Common Triggers	Example	Impact
Consumer Technology	Multiple device prompts for the same account; lack of synchronization of preferences.	Smart home devices are asking for repeated permissions for the same features.	Frustration, leading to blanket acceptance of all requests.
E-commerce	Overuse of cookie banners, repeated prompts, and manipulative design patterns to push acceptance.	Online store with pop-up banners that obscure shopping until consent is given.	Erosion of trust and habitual 'click-accept' behavior.
Health and Biobanking	Lengthy, legalistic consent forms; presented only upfront; low comprehension; reduced engagement over time.	Clinical trials using 20+ page consent documents.	Decreased participant retention and lower data quality.
Mobile Apps and Digital Health Platforms	Fragmented disclosures; consent only at install; vague privacy policies; lack of follow-up prompts.	Health app requesting access to contacts without a clear explanation.	User disengagement or blind acceptance; uncertainty over data sharing.

These sectoral patterns make clear that consent fatigue is not merely the result of user disengagement. It is the predictable outcome of structural weaknesses in how consent systems are conceived and implemented. Whether in healthcare research, mobile applications, or website tracking interfaces, the same recurring flaws emerge. Consent is too often poorly timed, overly complex, and misaligned with user context. These recurring failures are not isolated accidents but symptoms of deeper systemic issues in design, policy interpretation, and product priorities. In the next section, Why the System Fails, we examine these underlying causes in detail and how they can erode meaningful consent and user preferences.

⚠️ Where the System Fails

Consent fatigue does not arise in a vacuum. It is the result of systemic breakdowns across legal, regulatory, and design environments that prioritize formality over comprehension and convenience over clarity. While laws and regulations like the EU GDPR require that consent be freely given, specific, informed, and unambiguous, real-world implementations often fall short. In this section, we examine five interlocking failures that drive user disengagement and diminish the credibility of digital consent.

Table 4 below summarizes the five primary systemic failures driving consent fatigue, providing concise descriptions, real-world examples, and their impacts on user trust and autonomy.

Table 4: Systemic Failures Contributing to Consent Fatigue

Failure	Description	Impact	Example
Conflicting Priorities in Product Development	Consent is treated as a usability barrier rather than an ethical obligation; preferences are hidden or obscured.	Reduces transparency and erodes trust.	Privacy settings are buried deep within mobile app menus.
Fragmented Legal and Regulatory Interpretations	Different definitions of valid consent across jurisdictions cause repetitive disclosures.	Frustrates global users and dilutes trust.	EU GDPR vs. Japan’s APPI consent differences.
Interface Constraints and Dark Patterns	Manipulative design elements like pre-selected options and ambiguous opt-outs.	Leads to unintended consent and regulatory scrutiny.	Cookie banners are designed to push acceptance.
Legal Formalism Over Cognitive Fit	Notices prioritize legal compliance over comprehension and timing.	Overwhelms users and undermines informed consent.	Technical jargon in healthcare consent forms.
Timing and Context Misalignment	Prompts appear at irrelevant times, disconnected from data processing.	Reduces comprehension and perceived relevance.	Account creation consent for services not yet used.

These approaches establish a human-centered foundation for consent systems, where trust and clarity are engineered into every interaction. In our next section, Key Design Strategies, we translate these principles into concrete design strategies and actionable tools that promote action to combat consent fatigue. We also discuss how organizations can evolve from checklists and compliance forms to systems that nurture autonomy as a lived, ongoing experience.

🛠️ Key Design Strategies

To rebuild trust and alleviate consent fatigue, design must move beyond legal formality to become a strategic tool for communication, agency, and accessibility. Effective consent is not merely about presenting information. It is about how, when, and where that information is delivered.

Table 5 below presents a matrix of proposed design strategies to combat consent fatigue, organized with descriptions, benefits, regulatory alignment, and real-world examples.

Table 5: Design Strategies Matrix to Reduce Consent Fatigue

Strategy	Description	User Benefit	Regulatory Alignment	Example
Cooling-Off Periods	Allows users to set a time to retract or revise consent after giving it.	Reduces regret-based compliance and restores agency.	FTC 'Cooling Off Rule'; behavioral research support.	Allowing 24 hours to revoke marketing consent.
Empirically Informed Design	Uses research to shape concise, user-focused consent notices.	Improves comprehension and decision quality.	OECD disclosure effectiveness guidance.	A/B tested consent notices for clarity.
Ethical Privacy Nudges	Non-coercive prompts encouraging privacy-preserving behaviors.	Supports autonomy while avoiding manipulation.	Supports PbD principles.	Periodic reminders to review data-sharing settings.
Just-in-Time Adaptive Transparency	Provides explanations at or before data use in context.	Enhances relevance and comprehension.	Endorsed by UK ICO.	In-app prompts before location tracking begins.
Layered Consent Architecture and Disclosures	Offers high-level summaries with optional deeper layers of detail.	Prevents cognitive overload while ensuring transparency.	Supported by UK ICO and Canadian OPC.	Expandable sections in a digital privacy notice.
Memory, Legibility & Reviewability	Stores and displays user choices in an auditable, editable format.	Prevents repeated prompts and supports accountability.	Meets EU GDPR consent logging requirements.	User dashboard with consent history and edit options.

These strategies mark the beginning of a more profound shift. It moves away from transactional, one-off permissions toward relational, user-driven consent journeys. Still, design cannot solve everything alone. Lasting reform requires a cultural realignment. It requires an ecosystem-wide commitment to respect, transparency, and shared responsibility. In the next section, Beyond Compliance: A Shift in Autonomy Culture, we explore how organizations can evolve from checklists and compliance forms to systems that nurture autonomy as a lived, ongoing experience.

🔄 Beyond Compliance: A Shift in Autonomy Culture

Designing consent systems that can withstand fatigue and restore user agency is no longer simply a matter of cleaner interfaces or shorter forms. It is a cultural imperative. The persistence of consent fatigue signals more than design flaws or legal ambiguity. It reveals a deep disconnect between institutional expectations and the lived realities of users navigating digital environments.

For decades, consent in the digital sphere has been treated as a transactional, one-off legal checkbox, primarily serving as a compliance mechanism to shield organizations from liability (Solove, 2013). While such models meet the letter of the law, they fail to capture the fluid, evolving nature of digital interactions. Static consent is inherently insufficient in dynamic environments (e.g., where data is collected, shared, and repurposed continuously) (OECD, 2025c).

Consent must shift from a single moment to a sustained relationship as services and platforms increasingly operate in real time (e.g., personalizing interactions, adjusting algorithms, and making inferences on the fly). This reframing requires more than updated compliance checklists. it demands a rethinking of autonomy as an ongoing dialogue between users and institutions (European Data Protection Board, 2020). In such a model, transparency is not a one-time disclosure, but a continuing act of explanation. Control is not a buried settings menu, but a visible, accessible right that can be exercised at any stage of the user journey.

True reform means embedding ethical design principles into organizational culture, not just product user experience. This aligns with the PbD framework, which emphasizes proactive measures, user-centricity, and privacy as a default setting (Cavoukian, 2011). Information and Privacy Commissioner of Ontario, 2018). It also reflects emerging legal and regulatory thinking. This occurs when the burden of comprehension shifts away from the individual and toward the institutions that process their data (UK Information Commissioner’s Office, 2025).

Without this cultural shift, even the most well-intentioned reforms will remain superficial. They will exist as tweaks to the interface rather than changes to the underlying power dynamics between users and data controllers. Consent fatigue, at its core, is not just a usability problem. it is a trust problem. Rebuilding trust requires institutions to treat consent as an act of mutual respect. It occurs where both parties acknowledge the evolving nature of the relationship and the shared responsibility for maintaining it.

🧭 Four Cultural Shifts Toward Sustained Autonomy

Addressing consent fatigue requires more than incremental changes to interface design or minor adjustments to privacy notices. It demands a recalibration of the relationship between organizations and individuals. One in which autonomy is respected as an ongoing right rather than a one-time transaction. This transformation cannot be achieved through compliance alone. It calls for cultural change, embedded into the governance, design, and operational priorities of institutions that process personal data (Cavoukian, 2011; OECD, 2022).

The four shifts outlined below describe the mindset changes necessary to replace outdated, checkbox-style consent models with frameworks that are dynamic, transparent, and user-centered. Together, they form a blueprint for creating systems that not only meet legal requirements but also earn and sustain trust by recognizing users as active participants in their digital lives. Each shift challenges a prevailing norm, whether it be the static nature of consent (Mascalzoni et al., 2022; Symons et al., 2023), the minimalistic approach to compliance (Information and Privacy Commissioner of Ontario, 2018), the inadequacy of traditional disclosures (OECD, 2022), or the excessive burden placed on individuals (Hutchings et al., 2020). It proposes a path toward sustained, ethical engagement.

Table 6 below presents the four cultural shifts necessary to move from outdated, checkbox-style consent models to dynamic, user-centered frameworks. It contrasts current practices with the desired future state.

Table 6: Cultural Shifts from Transactional to Relational Consent

Current Consent Culture	Future Consent Culture
Consent as a one-time permission slip	Consent as continuous engagement, allowing revision and retraction over time
Legal formalism focused on compliance checklists	Ethical design centered on user dignity, transparency, and mental bandwidth
Transparency as a static disclosure	Transparency as an ongoing explanation of data use, processing, and inferences
User burden to evaluate, recall, and manage all consent decisions	Institutional responsibility to create intuitive, accessible, and cognitively considerate systems

Recognizing the cultural and ethical shifts required to address consent fatigue is only the beginning. Translating these values into concrete system improvements demands more than vision. it requires deliberate, cross-functional reform. Institutions must operationalize autonomy, transparency, and usability through policy guidance, design principles, and governance practices. In the following section, Recommendations for Reform, we present practical, evidence-based strategies that stakeholders can adopt to build consent experiences that are not only legally compliant but deeply aligned with human needs. These reforms mark the next step toward restoring meaningful choice in digital life.

🛠️ Recommendations for Reform: A Trust-Centered Consent Roadmap

Reversing the tide of consent fatigue requires a deliberate shift toward systems that are as transparent, adaptable, and respectful as they are compliant. The following reforms are drawn from cross-sector research, policy guidance, and behavioral insights. They aim to transform consent from a passive obligation into an active, user-centered process. One that builds sustained trust over time.

To support implementation, Table 7 below outlines five high-impact strategies that align design goals with regulatory standards while reducing user burden.

Table 7: Reform Pathways at a Glance

Reform	Description	Why It Matters
Consent Dashboards & Memory Tools	Central dashboards where users can review, modify, or revoke consent across services.	Increases legibility, builds trust, and reduces repeat fatigue.
Contextual, Just-in-Time Consent	Offer consent prompts precisely when data is used or shared, rather than as blanket upfront disclosure.	Enhance salience, relevance, and user control
Cooling-Off Periods	Allow users to retract consent within a set window after interacting with new features or data uses.	Mitigates regret and supports autonomy longitudinally
Cross-Jurisdictional Harmonization	Advocate for aligned consent expectations and design principles across global privacy regimes.	Prevents fragmented user experiences and reduces redundant prompts
User-Centered Nudging	Design choice architecture to encourage ethical reflection—not manipulation—such as privacy reminders or opt-in defaults.	Supports self-directed regulation and mental bandwidth preservation

Building on the reform pathways summarized above, Table 8 prioritizes each measure based on its potential impact on user autonomy, estimated implementation difficulty, and examples of jurisdictions where similar reforms have been applied.

Table 8: Reform Pathways Prioritized by Implementation Difficulty and Impact

Reform Pathway	Implementation Difficulty	Impact on User Autonomy	Example Jurisdiction
Consent Dashboards & Memory Tools	Medium	High	EU GDPR-compliant EU services
Contextual, Just-in-Time Consent	Medium	High	UK ICO guidance implementations
Cooling-Off Periods	Low	Medium	US FTC “Cooling Off Rule”
Cross-Jurisdictional Harmonization	High	High	Ongoing OECD privacy discussions
User-Centered Nudging	Low	Medium	Canadian OPC best practices

These reform strategies show that consent can be both legally robust and psychologically sustainable without sacrificing usability or trust. They are the blueprint for a future where consent is not a one-time transaction but an ongoing, empowering relationship. In the concluding section, Conclusion: From Transactional to Relational Consent, we reflect on why consent fatigue is a defining challenge for our digital era. We also discuss how a reimagined consent ecosystem can center autonomy, fairness, and human dignity at its core.

✅ Conclusion: From Transactional to Relational Consent

Consent fatigue is not a byproduct of user indifference. It is a signal of systemic breakdown. It arises from consent systems that are poorly designed, overly repetitive, and cognitively exhausting. Left unchecked, these systems erode autonomy, trust, and the very notion of informed consent.

The path forward demands profound reorientation. A shift from consent as a one-time legal formality to consent as an ongoing, relational process. Meaningful reform requires alignment across institutions:

1. Designers and developers must implement consent mechanisms that are transparent, contextual, and cognitively considerate, including in-tool explainability and layered information structures.

2. Organizations must shift their mindset from viewing consent as a checkbox to recognizing it as a commitment to ethical engagement and mutual trust.

3. Policymakers must establish clear enforcement standards that prioritize user autonomy and not just procedural compliance.

   
   

This transformation is neither easy nor optional. Consent must evolve to meet the pace and complexity of digital life. A digital environment where control is not surrendered at signup, but is negotiated, reviewed, and retained throughout the user journey (Hutchings et al., 2020; Mascalzoni et al., 2022).

With much-needed reforms in view, our next section, Key Questions for Stakeholders, translates insight into action. Here, we identify the critical questions that designers, regulators, platform operators, and data privacy and protection leaders should ask to build trust-centered consent systems. How can institutions demonstrate real accountability? How can legal frameworks evolve to support relational consent? These are the questions that will define the future of ethical data governance.

🏢 Key Takeaways

1.   Collaboration among designers, organizations, and regulators is critical for success.

2.   Consent fatigue is a systemic problem that undermines both trust and user autonomy.

3.   Cultural shifts are essential to move from transactional to relational consent. Regulatory initiatives in the EU, Japan, and the UK signal growing recognition, but global harmonization is lacking.

4.   Design strategies including layered consent, just-in-time transparency, and consent dashboards can mitigate fatigue.

5.   Reform pathways should be prioritized by impact and feasibility.

6.   Sectoral patterns reveal that industries face distinct consent challenges, requiring tailored approaches.

7.   Systemic failures such as legal formalism, manipulative design, and poor timing must be addressed.

👥 Key Questions for Stakeholders: Reimagining Consent in a Fatigued Digital Ecosystem

Solving the complex challenge of consent fatigue requires more than isolated fixes. It demands coordinated, cross-sectoral engagement among those who shape digital experiences: Designers, developers, platform operators, policymakers, and regulators. These questions are designed to provoke critical reflection, institutional accountability, and concrete action toward building consent systems that are ethical, durable, and human-centered.

🎨 Designers and Developers

1. How can interface design reduce cognitive overload without oversimplifying or obscuring critical data practices?

2. Which consent patterns enhance user comprehension and retention over time?

3. How can dark patterns be actively identified and replaced with ethical nudges that support autonomy and informed decision-making?

4. What usability testing protocols should be employed to validate consent mechanisms against fatigue, confusion, or regret?

   
   

🏢 Organizations, Data Controllers, and Platform Operators

1. Are your current consent workflows structured to support ongoing engagement, or are they static and one-time?

2. How are user choices retained, traced, and editable across sessions, devices, and services?

3. What mechanisms are in place to detect and limit consent fatigue indicators (e.g., high opt-out rates, auto-accept patterns, or disengagement)?

4. How do your data privacy and protection practices honor user dignity and comprehension in long-term relationships, not just onboarding flows?

   
   

🏛️ Regulators and Policymakers

1. How can legislation move beyond prescriptive checkboxes to encourage relational consent practices grounded in clarity and trust?

2. What safeguards should be established to prevent coercive design and ensure users are not manipulated into unwanted data sharing?

3. How can dynamic consent approaches (e.g., layered disclosures and contextual explainability) be standardized and enforced across jurisdictions?

4. What collaborative frameworks are needed to ensure interoperability of consent standards in cross-border data processing environments?

   
   

The questions raised above reveal not just gaps in technical execution, but deep-rooted tensions in how digital systems conceive of and manage user preferences. They also expose a systemic failure to align legal and regulatory intent with real-world usability. To respond meaningfully to consent fatigue, stakeholders must move beyond diagnostics toward transformation. What follows are concrete, evidence-based recommendations for reform. These are practical steps that organizations, regulators, and design teams can implement to build more transparent, autonomy-respecting, and trust-enabling consent systems.

📚References

1.    Cavoukian, A. (2011, January). Privacy-by-Design: The 7 foundational principles. Information & Privacy Commissioner of Ontario. https://www.sfu.ca/~palys/Cavoukian-2011-PrivacyByDesign-7FoundationalPrinciples.pdf

2.    Centre for Information Policy Leadership. (2024, December). The limitations of consent as a legal basis for data processing in the digital society. Hunton Andrews Kurth. https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/cipl_bkl_limitations_of_consent_legal_basis_data_processing_dec24.pdf

3.    Cookiepal.io. (2024). The role of consent logs in GDPR compliance. FYI. https://vocal.media/fyi/the-role-of-consent-logs-in-gdpr-compliance

4.    Cornell Law School. (2021, June). Cooling-off rule. Legal Information Institute. https://www.law.cornell.edu/wex/cooling-off_rule

5.    European Data Protection Board. (2024, December 17). Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models. https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf

6.    European Data Protection Board. (2020, May 4). Guidelines 05/2020 on consent under Regulation 2016/679: Version 1.1. https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf

7.    Federal Trade Commission. (2025, July 5). Part 429: Rule concerning cooling-off periods for sales made at homes or at certain other locations. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-429

8.    Federal Trade Commission. (2022, September 15). FTC report shows rise in sophisticated dark patterns designed to trick and trap consumers. https://www.ftc.gov/news-events/news/press-releases/2022/09/ftc-report-shows-rise-sophisticated-dark-patterns-designed-trick-trap-consumers

9.    Hassan, M., Ghani, A., Zaffar, M.F., & Bashir, M. (2025, January 31). Decoding user concerns in AI health chatbots: An exploration of security and privacy in app reviews. arXiv. https://doi.org/10.48550/arXiv.2502.00067

10. Heywood, D., & Blofeld, C. (2025, June 9). Taking control of online tracking – the ICO’s focus for 2025. TaylorWessing. https://www.taylorwessing.com/en/global-data-hub/2025/spotlight-on-the-uk-data-landscape/gdh---taking-control-of-online-tracking

11. Hutchings, E., Loomes, M.W., Butow, P.N., & Boyle, F.M. (2021, May 4). A systematic literature review of attitudes towards secondary use and sharing of health administrative and clinical trial data: A focus on consent. Systematic Reviews, 10(132). https://systematicreviewsjournal.biomedcentral.com/articles/10.1186/s13643-021-01663-z

12. Information and Privacy Commissioner of Ontario. (2018, January). Privacy-by-Design. https://www.ipc.on.ca/sites/default/files/legacy/2018/01/pbd-1.pdf

13. Intersoft Consulting. (2025a). Article 4 GDPR: Definitions. https://gdpr-info.eu/art-4-gdpr/

14. Intersoft Consulting. (2025b). General Data Protection Regulation. https://gdpr-info.eu/

15. Intersoft Consulting, (2025c). GDPR: Consent. https://gdpr-info.eu/issues/consent/

16. Kawai, Y., Mizuguchi, A., Ito, T., & Otsuka, M. (2024, August 2). Japan: Draft interim report on review of the Act on the Protection of Personal Information. Nishimura & Asahi. https://www.nishimura.com/en/knowledge/newsletters/data_protection_240802

17. King, J., & Meinhardt, C. (2024, February). Rethinking privacy in the AI era: Policy provocations for a data-centric world. Stanford University Human-Centered Artificial Intelligence. https://hai-production.s3.amazonaws.com/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf

18. Mascalzoni, D., Melotti, R., Pattaro, C., Pramstaller, P.P., Gogele, M., De Grandi, A., & Biasiotto, R. (2022, September 5). Ten years of dynamic consent in the CHRIS study: Informed consent as a dynamic process. European Journal of Human Genetics, 30, 1391-1397.

19. Nagae, S. (2024, June 28). Amendments to the Act on the Protection of Personal Information proposed for 2025. https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2024/06/amendments-to-the-act-on-the-protection-of-personal-information-set-for-2025.html

20. Nouwens, M., Liccardi, I., Veale, M., Karger, D., and Kagal, L. (2020, January 8). Dark patterns after the GDPR: Scraping consent pop-ups and demonstrating their influence. arXiv. https://doi.org/10.48550/arXiv.2001.02479

21. OECD. (2025). Digital. https://www.oecd.org/en/topics/digital.html

22. OECD. (2022, October). Enhancing online disclosure effectiveness: OECD digital economy papers. https://www.oecd.org/content/dam/oecd/en/publications/reports/2022/10/enhancing-online-disclosure-effectiveness_e8b230aa/6d7ea79c-en.pdf

23. Office of the Privacy Commissioner of Canada. (2013). Guidelines for online consent. https://oipc.ab.ca/wp-content/uploads/2022/02/Online-Consent-2014.pdf

24. Pegarella, S. (2025, May 6). Are consent logs required? How to comply with cookie consent laws. TermsFeed. https://www.termsfeed.com/blog/cookie-consent-log/

25. SecurePrivacy. (2025, June 18). Adaptive consent frequency: Using AI to combat consent fatigue in privacy interfaces. https://secureprivacy.ai/blog/adaptive-consent-frequency-using-ai-to-combat-consent-fatigue

26. Solove, D.J. (2013). Privacy self-management and the consent dilemma. George Washington University Law School. https://scholarship.law.gwu.edu/cgi/viewcontent.cgi?referer&httpsredir=1&article=2093&context=faculty_publications

27. Symons, T.J., Straiton, N., Gagnon, R., Littleford, R., Campbell, A.J., Bowen, A.C., Stewart, A.G., Tong, S.Y.C., & Davis, J.S. (2022, December 28). Consumer perspectives on simplified, layered consent for a low risk, but complex pragmatic trial. Trials, 23(1055). https://doi.org/10.1186/s13063-022-07023-z

28. Tanaka, H., & Shiozaki, K. (2024, July 11). Japan’s DPA publishes interim summary of amendments to data protection regulations. IAPP. https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations

29. Tatsuno, D., & Kondo, Y. (2025, May 8). Japan: Discussions for the amendment of the data privacy law. Baker McKenzie. https://connectontech.bakermckenzie.com/japan-discussions-for-the-amendment-of-the-data-privacy-law/

30. UK Information Commissioner’s Office. (2025). What methods can we use to provide privacy information? https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-methods-can-we-use-to-provide-privacy-information/