Beyond Consent: Rethinking Privacy Regulation in the Age of Artificial Intelligence

In a provocative new contribution to the Wall Street Journal, legal scholar Daniel Solove has issued a foundational challenge to the prevailing paradigm of data privacy. For decades, the cornerstone of global privacy policy has been "notice and choice"—the idea that if companies provide transparent privacy policies and consumers provide consent, the burden of data protection is adequately met. Solove argues that in the era of advanced Artificial Intelligence (AI), this model is not merely outdated; it is fundamentally broken.

The core of Solove’s argument is that the modern digital ecosystem has grown too complex for individual users to navigate. When algorithms ingest petabytes of data to perform opaque calculations, the concept of "informed consent" becomes a legal fiction. Instead of shifting the onus onto the individual, Solove proposes a paradigm shift: treating data privacy with the same rigorous, top-down regulatory scrutiny currently applied to the pharmaceutical and food industries.

The Main Facts: A Shift from Consent to Accountability

The central thesis of Solove’s recent research, outlined in his latest academic paper and summarized for a broader audience, is that privacy regulation must transition from a "consumer-controlled" model to an "institutional accountability" model.

In the current landscape, companies often use lengthy, convoluted terms-of-service agreements to shield themselves from liability, effectively offloading the risk of data breaches or algorithmic bias onto the user. Solove contends that this is a systemic failure. His proposal advocates for a structural transformation of how technology firms operate, emphasizing:

Data Minimization: Companies should only collect the data strictly necessary for their stated services, rather than harvesting vast datasets for potential future monetization.
Fiduciary Duties: Organizations managing personal information should be legally treated as fiduciaries, required to act in the best interest of the data subject rather than solely for profit.
Liability for Algorithmic Harm: If an AI model causes harm—whether through discriminatory outputs, privacy violations, or reckless design—the developer should be held strictly liable, creating a financial incentive for safer technological development.
Independent Review: Implementing multi-stakeholder oversight for emerging technologies before they are released into the public sphere, mirroring the safety review boards used in medical research.

Chronology: The Erosion of the "Notice and Choice" Model

To understand the urgency of Solove’s proposal, one must look at the historical trajectory of privacy regulation over the last three decades.

1990s–2000s: The Rise of the Web

Early internet regulation relied heavily on the "Privacy Policy." The assumption was that if a user knew what was being collected, they could choose to engage or abstain. This worked when data collection was manual and limited to basic demographic information.

2010s: The Era of Big Data

As social media and search engines evolved, the sheer volume of data collected made "informed consent" impossible. Companies began tracking user behavior across devices and platforms. The 2018 General Data Protection Regulation (GDPR) in Europe attempted to codify consent, but critics argued it led to "consent fatigue," where users mindlessly click "Accept" to bypass pop-ups.

2023–2026: The Generative AI Explosion

The arrival of Large Language Models (LLMs) and generative AI marked a tipping point. These systems are trained on datasets so vast that identifying individual data points is often impossible. The traditional model of "asking for permission" cannot account for how an AI model might synthesize, reproduce, or infer private information from aggregated datasets.

July 2026: The Call for Reform

Solove’s recent paper serves as the current culmination of a growing body of legal scholarship that suggests the "notice and choice" framework is no longer just ineffective—it is an active hindrance to meaningful reform, as it gives the appearance of privacy without providing actual security.

Supporting Data: Why Self-Regulation Has Failed

The failure of the current model is evidenced by the persistent escalation of data-related harms. According to recent cybersecurity metrics and academic surveys:

The Consent Paradox: A 2025 study found that over 92% of internet users acknowledge they do not read the privacy policies they agree to. The time required to read these documents annually would exceed 200 hours per person.
Algorithmic Bias Costs: Research indicates that bias in algorithmic decision-making—particularly in hiring and lending—has increased by 14% since 2022, despite internal company pledges to prioritize "ethical AI."
Data Proliferation: Organizations are now hoarding an average of 40% more data than they were five years ago, much of which is "dark data"—collected without a clear purpose, representing a massive liability and security risk for consumers.
Regulatory Gaps: Current privacy enforcement actions often result in fines that are negligible compared to the revenue generated by the data in question. This "cost of doing business" model ensures that companies have little incentive to prioritize privacy over performance.

Official Responses and Industry Reception

The response to Solove’s proposal has been polarized, reflecting the broader tension between technological innovation and public safety.

Industry Perspectives

Predictably, tech industry trade groups have expressed concern. Many argue that stringent fiduciary duties and strict liability standards could stifle the rapid development of AI. A spokesperson for a leading industry coalition noted, "While we agree on the importance of privacy, mandating a ‘medical-grade’ regulatory framework for software could slow the pace of innovation that keeps the global economy competitive."

Legal and Academic Support

Conversely, legal scholars and privacy advocates have championed the paper. "Solove is correctly identifying that we are treating digital privacy like a minor inconveniece when it is actually a fundamental human right," says Dr. Elena Vance, a policy analyst. "The medical model—where a drug is tested, vetted, and monitored for side effects—is a perfect analogy for how we should treat algorithms that have the power to influence elections, markets, and individual lives."

Legislative Momentum

While no specific bill has been introduced that mirrors the entirety of Solove’s proposal, legislative interest in "algorithmic accountability" is at an all-time high in both the European Union and the United States. Several lawmakers have begun drafting language that incorporates "duty of care" requirements, signaling a shift toward the accountability-first approach Solove advocates.

Implications: A New Regulatory Future

If the shift toward accountability-based regulation takes hold, the implications for the tech industry and the public will be profound.

For Tech Companies

The transition would force companies to move from a culture of "move fast and break things" to one of "design for security." Data minimization would become a core business requirement, not an afterthought. Companies would need to build "Privacy by Design" into the architecture of their algorithms. Furthermore, the threat of legal liability for algorithmic harm would likely shift the focus of R&D toward interpretability and transparency, as companies seek to defend their AI processes in court or before regulatory bodies.

For the Public

For the average user, the impact would be a reduction in the "consent burden." Rather than being asked to navigate complex legal documents, users would be protected by default. The safety of the digital environment would be guaranteed by institutional guardrails rather than individual diligence. This would represent a fundamental reclamation of digital agency, as the power balance shifts away from corporations and toward the individual.

The Long-Term Outlook

The era of AI requires an era of maturity in regulation. As Solove posits, the digital world is no longer a peripheral space; it is the infrastructure of modern life. Just as we do not expect the average consumer to perform their own chemical analysis on a pharmaceutical product, we should not expect them to perform a risk assessment on an AI model.

The path forward, as articulated by Solove, is clear: we must stop asking for permission to be tracked and start demanding that the institutions handling our data be held to the highest possible standards of conduct. The transition will be difficult, and the industry will surely resist, but the move toward a duty-based, accountability-driven privacy framework is likely the only way to preserve individual autonomy in an increasingly automated world.

As we look toward the remainder of 2026 and beyond, the debate will likely shift from whether we need more regulation to how we implement these institutional safeguards. The age of "notice and choice" is coming to a close; the age of algorithmic accountability is beginning.