Informed consent

Informed consent is the authorisation of an intervention by a person who is competent, adequately informed, acting voluntarily, and who has the standing to permit it. The modern doctrine crystallised in post-war research ethics: in the Nuremberg Code’s insistence on the voluntary consent of the human subject, in the Declaration of Helsinki, and in the Belmont Report’s principle of respect for persons. Faden and Beauchamp gave it its canonical philosophical form, distinguishing consent as autonomous authorisation from consent as institutionally effective permission.

From medicine the concept migrated into data protection, where the data subject inherited the consenting patient’s role, and from there into the governance of algorithmic systems. Consent is a lawful basis for processing under the GDPR; India’s Digital Personal Data Protection Act 2023 builds on consent and consent managers; and the Indian Supreme Court’s Aadhaar judgments, Puttaswamy I (2017) and II (2018), reasoned largely in its terms. Its sharpest critics, from Solove on privacy self-management to Nissenbaum’s contextual integrity and O’Neill’s argument that a signature is at best evidence that deeper obligations were met, refine or supplement it. They agree that there is a consenting subject to begin with.

My work concerns that presupposition. Debates about consent usually turn on competence, information and voluntariness; the fourth condition, standing, is taken for granted. I distinguish practical from conceptual failure. A practical failure occurs when the conditions of valid consent could be met but are not: the notice is too long, the user has not read it, and better design is the fix. A conceptual failure occurs when no redesign could restore consent to its role. That is the situation of people in constitutive dependence on an institution. Their standing as entitlement-bearers is what it produces, so refusal is not a costly option but a category mistake. To consent is already to have a standing that refusal could relinquish. When the standing is produced by the system, consent has nothing to authorise.

The claim is narrow. It concerns a defined class of algorithmic welfare and identification systems, not consent in the many contexts outside it. For that class, legitimacy must rest on what the institution owes, set out in the Constitutive Obligation Principle.