Document Type
Article
Publication Date
2026
Publisher
George Washington University Law School
Language
en-US
Abstract
When it comes to talking about autonomy, privacy law could use a little clarity. Its discourse uses terms like “choice,” “consent,” and “control” to evoke autonomy, but these terms are too rarely defined and too often used interchangeably, even though they can mean very different things. The three terms have become entangled in a way that has become confusing and counterproductive. We call this problem “privacy’s autonomy thicket,” and it matters because it encourages talking past each other in policy debates, enabling the redefinition of these terms in misleading ways that produce weak and disempowering “notice and choice” regimes.
In this essay, we argue that choice, consent, and control are often conflated in ways that weaken individual autonomy. We distinguish between mere choice—simply selecting among options—and meaningful choice, which requires real, substantive alternatives. Consent, while legally authorizing data use, is different from having actual power to negotiate terms. Control, as currently understood in privacy law and theory, tends to narrowly focus on managing personal data rather than empowering individuals in broader relational contexts. Disentangling these concepts shows how current privacy frameworks fail to provide individuals with true agency.
This conceptual confusion has led to flawed privacy rules that offer a mere illusion of empowerment—such as “consent at scale” and fragmented opt-out mechanisms—while reinforcing vulnerability. Neither consent nor control alone can offer meaningful autonomy or achieve any of privacy law’s other goals. Instead, we call for a reorientation of privacy law’s autonomy goals toward fostering meaningful choice—the ability to make significant life decisions unburdened by significant privacy risks. Doing so will require not just better definitions of choice, consent, and control, but additional legal protections (many of them grounded in trust and loyalty) that safeguard the vulnerable parties in informational relationships.
Recommended Citation
Jordan Francis, Woodrow Hartzog & Neil Richards,
Privacy’s Autonomy Thicket: Disentangling Choice, Consent and Control
,
2
George Washington Journal of Law & Technology
36
(2026).
Available at:
https://scholarship.law.bu.edu/faculty_scholarship/4307
