by Tzortzia Koutsouri (Insuretics)

How many times have you clicked “I Agree” or “Accept” today?

Whether you’re installing a new app, signing up for an online service, accepting website cookies, or using a fitness tracker, chances are you’ve agreed to share your personal data multiple times without giving it much thought. In today’s digital world, consent has become a routine action — quick, automatic, and often overlooked.

But have you ever wondered what actually happens after you click “I Agree”?

Consent Shouldn’t End with a Click

For many online services, consent is treated as a one-time event. Once accepted, users often have little visibility into what happens next. Questions like the following are rarely easy to answer.

• Who currently has access to my personal data?
• What information did I actually agree to share?
• Is my data being used only for the purpose I approved?
• Can I easily withdraw my consent?
• Has my data been shared with third parties?
  

In many cases, the answers are hidden behind lengthy privacy policies, fragmented systems, or complex legal language. As a result, users lose track of their personal information and have very limited control over how it is processed over time.

Why Traditional Consent Falls Short

The digital services we use today are becoming increasingly interconnected. Healthcare providers, insurance companies, financial institutions, public authorities, and online platforms often need to exchange information to deliver better and more personalised services. While these data exchanges can generate significant benefits, they also introduce important privacy challenges [1] [2].

Traditional consent mechanisms were never designed for this dynamic digital ecosystem. In many cases, users are asked to accept broad terms and conditions without fully understanding how their information will be used afterwards. Once consent has been given, there is often little transparency regarding who accesses the data, for what purpose, or whether those purposes have changed over time. Reviewing, updating, or withdrawing consent can also be difficult, and organisations may struggle to demonstrate exactly when, how, and why consent was obtained. As digital ecosystems continue to evolve, consent must evolve as well.

From Static Consent to Dynamic Consent

Modern consent management is shifting from static agreements to dynamic, user-centric models. Instead of treating consent as a single decision made at the beginning of a service, dynamic consent allows individuals to manage their permissions throughout the entire lifecycle of their data [3]. Users can decide exactly which information they want to share, specify the purposes for which it may be used, update their preferences whenever circumstances change, and withdraw consent if they no longer wish their data to be processed. They can also receive notifications whenever their personal information is requested or accessed. This transforms consent from a legal checkbox into an ongoing relationship based on transparency, flexibility, and trust.

Why Traceability Matters

Knowing that consent has been given is only part of the story. Equally important is knowing what happens afterwards. A trustworthy consent management system should make it possible to trace who requested access to personal data, what information was accessed, when the access occurred, for which purpose, and whether that access complied with the user’s consent preferences. This level of traceability increases accountability for organisations while giving individuals greater confidence that their personal information is being handled responsibly. It also supports compliance with European regulations such as the General Data Protection Regulation (GDPR) [4], which requires consent to be informed, specific, freely given, and capable of being withdrawn.

How CONSENTIS Changes the Picture

The CONSENTIS project is developing a new generation of user-centric consent management solutions designed for the evolving European data ecosystem. Rather than asking users to simply click “Accept” and then remain unaware of how their consent is being used, CONSENTIS enables individuals to remain actively involved in every stage of the consent process.

Through technologies such as Self-Sovereign Identity (SSI), smart contracts, and Privacy Enhancing Technologies (PETs), the project allows users to:

• maintain control over their personal data;
• receive clear notifications when access to their data is requested;
• define consent policies based on their own preferences;
• monitor how their personal information is used;
• modify or revoke consent whenever necessary.

By integrating these capabilities into an intuitive and user-friendly framework, CONSENTIS aims to make privacy management understandable not only for experts but also for everyday users.

Building a Future Based on Trust

Digital services depend on data. But data sharing can only succeed when people trust the systems that collect and process their personal information. Trust is not built through longer privacy policies or more complicated consent forms. It is built through transparency, accountability, and giving people meaningful control over their own data. The next time you click “I Agree,” it should not mark the end of your involvement—it should be the beginning of a transparent, secure, and user-controlled relationship with your data.

Projects like CONSENTIS are helping turn that vision into reality, creating digital ecosystems where informed consent is continuous, traceable, and centred around the individual.

References

1. European Data Protection Board (EDPB). Guidelines 05/2020 on Consent under Regulation 2016/679, 2020.
2. Bonnici West, M., & Grima, S. Consent Management Platforms: Tools for Data Protection Compliance, 2019.
3. Merlec, S., et al. Dynamic Consent Management in IoT and Data Sharing Environments, 2020.
4. European Parliament and Council of the European Union. Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR). Official Journal of the European Union, 2016.