What data is being used and how?
Surfaces when a client's privacy counsel realizes that 'users agreed to the terms' does not cover the specific AI training uses now in scope, or when users object to data uses they weren't clearly informed of.
A user clicks "I agree" on a consent screen. It took two seconds. The document they agreed to is 4,000 words long and covers, somewhere in paragraph 18, that their interaction data may be used to improve AI models. They did not know this. They would have cared if asked.
This is the gap between legal consent and informed consent, and it is almost entirely a design problem. The information exists. The legal basis is documented. The failure is that consent interfaces are routinely designed to be accepted, not understood: fine print, pre-ticked boxes, vague language about "improving our services," buried opt-outs. The result is that users have nominally agreed to data uses they have no awareness of.
For AI systems specifically, this gap has become acute. Data used to train or fine-tune a model is a fundamentally different use from data processed to deliver a service, but most consent flows don't distinguish between them. This pattern addresses both sides: making data use genuinely legible to users, and giving them real control over the uses they care about most.
Make personal data use visible, comprehensible, and genuinely consented to: giving users a clear understanding of what data is used in AI systems, for what purpose, and what they can do about it.
A compact, plain-language summary of what personal data is used in this system and for what purpose: - What data is used (categories, not raw fields) - Why it is used (the purpose) - Who can access it - How long it is retained - The legal basis
A consent interface designed for genuine understanding, not speed of completion: - Layer 1: plain-language summary of key data uses (can I proceed without reading further?) - Layer 2: full details for each data use category - Layer 3: link to the full privacy notice
Separate consent for separate purposes, not a single checkbox for everything: - Consent for processing data to provide the service (may be required) - Consent for using data to improve the AI model (genuinely optional) - Consent for sharing data with third parties (genuinely optional)
A persistent interface for users to exercise their data rights: - View the data held about me - Correct inaccurate data - Delete my data - Object to automated processing - Download a copy of my data Each right links to the mechanism for exercising it, not just a description of the right.
When data use practices change, such as new purposes, new third parties, or new AI training uses, send a proactive notification to users, not just an update to terms of service.
A specific, visible control for whether the user's data is used to train or improve AI models. This is distinct from consent for the service itself and should be separately controllable.
A consent screen that requires minimal interaction maximizes consent rates, but produces uninformed consent. Design for users who want to understand before they agree.
Using someone's data to provide a service they requested is different from using their data to train a model. These are different purposes with different legal bases and should be disclosed and consented to separately.
"You have the right to access your data" is a legal statement. "Click here to see all data we hold about you" is a design decision that makes the right real. Every data right should link to a mechanism for exercising it.
General privacy notices were not written for AI use cases. Terms like "to improve our services" do not adequately describe model training on personal data. Be specific: "Your interaction data may be used to improve the AI model that generates responses."
A buried update to a privacy policy is not meaningful notification. If AI training uses are added, extended, or changed, users who previously consented should be actively notified.
Informed consent vs. consent fatigue
The more detailed and layered a consent flow, the less likely users are to read it. Design for comprehension at minimum viable depth, and test whether users actually understand what they've agreed to.
Transparency vs. proprietary disclosure
Being transparent about data use may reveal details about AI system design or data sourcing that organizations consider proprietary. Weigh legitimate commercial sensitivity against the user's right to understand what happens with their data.
User control vs. system integrity
Allowing users to opt out of data use for model training may reduce the quality of the model. This trade-off is real and should be managed through system design (opt-out cohort handling, synthetic data) rather than by making opt-out difficult.
Provenance shows where data came from. Consent & Data Use Transparency shows what it's used for. Both are needed for complete data transparency.
Disclosure says AI is involved. Consent transparency says what data is used in that AI involvement.
Consent records are themselves audit data: what was consented to, when, and with what understanding. They must be logged.
The GDPR right to object to automated processing is a form of contestability specifically tied to data use.
European Union (2016). Articles 13/14 (information obligations), Article 15 (right of access), Article 17 (right of erasure), Article 21 (right to object), Article 22 (automated decision-making). The comprehensive legal framework underlying this pattern. https://gdpr-info.eu/ - Dark Patterns in the Age of the GDPR, Gray et al. (2021) — General Data Protection Regulation (GDPR)
documents how consent interfaces are routinely designed to maximize consent rates rather than informed consent: the "consent theater" problem this pattern is designed to counteract
Cavoukian (2009) — Privacy by Design
foundational framework proposing that privacy be built into systems by design rather than added as a compliance layer. Informs the proactive transparency approach of this pattern
European Union (2024) — EU AI Act, Article 13
transparency obligations for high-risk AI systems, including disclosure of the nature of the system and the data it uses to affected persons