Is Consent Enough? The Cost of Reading and the Right of Access to Data

When you browse your phone aimlessly, you leave a trace that is recorded and added to the traces of others. Once collected, the question remains: by what right, and who benefits?

Data is not used up by use

Many parties can use the same data at once, and this property ("nonrivalry" in the economists' language) is what makes the oil comparison fall short; we set it out in the article "Data Is Not the "New Oil": Where the Comparison Holds and Where It Misleads". Among its consequences, in a theoretical model published by Charles Jones and Christopher Tonetti in 2020, are that market structure and property rights become decisive and that firms hoarding data may waste its benefit. The model rests on specific assumptions and is no proof that individual ownership is the best practical solution, but it shows that the question "who owns it?" is not a technical detail.

Consent is not enough

Traditional law says: the user agreed, so the matter is settled. But a 2008 paper by Aleecia McDonald and Lorrie Faith Cranor estimated that reading the privacy policies an American user meets in a year would take about 244 hours (within a range of 181 to 304), and that the national cost of that time would be about $781 billion a year. These figures use 2008 data and do not describe today (and the paper itself gives a lower figure, about 201 hours, elsewhere), but they show that placing the whole burden of reading on the individual is not a workable rule. On inference and privacy, see the article "Privacy in the Age of AI".

Policies try another road

The European Union's Data Act moves towards a user's right to access the data of the connected products they use, such as cars and industrial machinery, and to share it with third parties, for example independent repair shops, which may lower the cost of services. It entered into force on 11 January 2024 and has applied since 12 September 2025. In Saudi Arabia the Personal Data Protection Law was issued, as discussed in the article referred to above.

None of this means the European model suits every setting as it stands; each society has its own priorities, systems and values.

Questions before you press "I agree"

• What is collected about me, and for what purpose is it used?
• Can I obtain my data, move it or share it?
• Who gains from combining it with other people's data?
• What happens to it if the firm is sold or merges?

Data is a trust in the hands of those who collect it, and whoever is entrusted with people's data must discharge that trust by guarding it and using it rightly. The better we understand its economic nature, the better we can defend our rights and make good use of it together.