Consent Cannot Be Delegated

Why AI shouldn’t decide what we share with AI – and what to do instead

No. 01

CTSi White Paper Series

Also available in German: Einwilligung lässt sich nicht delegieren

Summary

Cookie banners and privacy labels rarely lead to informed decisions. In a study with 136 valid responses, the options a banner offered were the only factor that significantly changed what people chose; knowledge about cookies made no difference. The paper explains why letting an AI system decide instead does not count as consent under the GDPR, and proposes a single consent window in the browser, with AI explaining the choice rather than making it.

Underlying publications

  1. Position paper, main basis

    Vrecar, R. (2026). Why AI Shouldn’t Decide What We Share with AI and How We Can Do Better. Position paper and presentation, workshop at CHI ’26, Barcelona. Open access, CC BY-NC-ND 4.0.

    hdl.handle.net/20.500.12708/228428

  2. Empirical basis

    Vrecar, R., Geld, B., Dobrosovestnova, A., Čolakovová, M. G., Weiss, A. (2026). Do Cookies Taste Different? The Impact of Options and Website Type When Setting Cookie Preferences. In: CHIRA 2025, CCIS 2834, pp. 56–77. Springer Nature Switzerland.

    doi.org/10.1007/978-3-032-16448-3_4

Cite this white paper

Text

Vrecar, R. (2026). Consent Cannot Be Delegated. CTSi White Paper No. 01. TU Wien.

BibTeX

@techreport{vrecar2026consent,
  author      = {Vrecar, Rafael},
  title       = {Consent Cannot Be Delegated},
  institution = {TU Wien},
  type        = {CTSi White Paper},
  number      = {01},
  year        = {2026},
  month       = sep,
  url         = {https://test.cts.wien/en/ctsi-publishing/white-papers/01/}
}