What happens to consent when the keys are handed to machines?

In June, Google disabled a feature in its Analytics platform that stopped personal data from being shared with Google Ads.

Launched just after GDPR in 2018, Google Signals gave businesses veto over whether Google’s ad network could see their visitor activity. Even if a user consented to being tracked, the final decision lay with the business, and many used it as an extra guardrail, with Google’s Consent Mode, to prevent falling foul of privacy laws. Then in June, Google Signals was gone.

You could assume the change was minor, especially because Consent Mode was still there to protect a user’s cookie consent choice. Yet straight after the switch, compliance failures across the world's biggest websites increased.

In the US, 87% of sites were found to be ignoring a user's opt-out signal, up from 81% before the change. In Europe, 56% kept tracking users even after they'd rejected cookies, up from 52%. One vendor changed one setting and elements of an already brittle consent framework began to unravel.

"If a single vendor can make this change which affects everybody's privacy compliance docket without most noticing,” says Vaibhav Antil, CEO and co-founder of Privado. “Imagine what happens when agents are deployed?"

Handing the keys to the machine

Bot web traffic has already overtaken human web traffic, according to Cloudflare’s traffic radar, and the number of non-human identities inside organizations outnumber humans by more than 80 to 1.

These agents are on the web comparing prices, filling in forms and booking appointments. They’re embedded in products, sifting job applications, querying databases, moving money, updating records, and increasingly making decisions that used to need a person to sign off on. Gartner expects 15% of day-to-day work decisions will be made autonomously by AI agents by 2028.

Yet the approval and consent process behind it all still largely consists of cookie banners, DSAR portals, and preference centres; tools built for a human ticking one box, once, and that consent holding until they say otherwise. AI actors are capable of acting thousands of times a second, or chaining several tools together to complete a single instruction. They need their permission checked before every move, and their actions can leave businesses unable to say, with confidence, what they did, when.

“A person with too much access is limited by habit, their training, and by their job,” adds Marcus Tommy, co-founder of MALTO Cyber. “An agent has none of that.”

The fan-out

Take, for example, someone who asks an agent to find out why sales have dropped. “The system can choose an analysis, run it, and generate SQL to investigate it,” explains Maurice Sikkink, CTO at Stormly. It might even reach into an external system for market data. Technically, a human approved the question, but they didn’t explicitly approve every step the agent took to answer it.

This becomes more stark when agents start connecting systems together. One linked agent might have permission to read customer records in a CRM, and permission to write to a marketing platform – both individually authorized. Yet the moment it starts moving a customer's data between them, it presents a new use of that person's data nobody explicitly consented to.

And then there’s the issue of revocation and re-authorisation. Revoking permissions can be done for several reasons, from policy changes to someone leaving a job. If an agent's session token or API key is valid for hours after the revocation kicks in, the underlying permission isn’t always automatically revoked.

"Those credentials haven’t necessarily been stolen," Harry Varatharasan, chief product officer at ComplyCube, says. "The agent might not be malicious. The identity behind them might be perfectly genuine, but the authority is stale.”

Auditability by design

Antil's answer, for copilots at least, is what he calls permission inheritance: "If you, the user, are not able to edit settings, then your copilot shouldn't be able to either.” When permission inheritance isn't enough, continues Antil, enterprise IT needs to decide what counts as dangerous, regardless of whether a single employee has permission to perform the task.

“A business might disable an email-to-Claude connector, for instance, because it's a common route for prompt injection attacks,” he adds.

However, even where access is logged and overseen, most systems can prove who had permission to ask the agent to act but not why the agent did what it did once inside.

Sikkink says this is where the industry is furthest behind. "Authentication tells me someone had access to the project. Attribution tells me that they asked the agent to do it.” What’s missing, he argues, “is a common way of carrying the identity of an original request through the entire chain.”

Varatharasan calls this idea of carrying identity and authority through the chain as “binding.” "Issuing the credential is only half the problem. Knowing whether you should still trust it is arguably the more important half,” he says. "I don't think the future is simply 'continuously identifying the agent ’. It’s the continuous assurance over the relationship between the individual, the agent, its credentials, its delegated authority and its behaviour."

Sikkink agrees: “[Not] every intermediate step needs another consent popup. That would make agents almost pointless. The important thing is that the agent stays inside a clearly defined boundary, and that we can reconstruct how it got from the user's request to the result.”

A push for clarity

From a technical point of view, Tommy argues that what’s needed to fix this largely already exists. “Cloud audit logs record the actor and the action. Token systems know the scope. Append-only log structures are proven technology; they run the public certificate transparency system. What’s missing is the join.”

In the UK, the Digital Verification Services Trust Framework is one attempt to build this join. It sets out guidance on proving delegated authority: what was granted, when and by whom, plus plans for cryptographic checks on signing keys. Under new California Consumer Privacy Act regulations, businesses using AI for significant decisions must give consumers a pre-use notice, a working opt-out, and the right to ask what the system did and why.

Antil calls these a step in the right direction, even if they don’t fully cover agentic workflows. Varatharasan adds that these frameworks have the right building blocks but fall short of addressing the bigger, lifecycle issues around revocation, re-authorisation, and continuous risk.

Ultimately though, Antil expects consent in the age of machines to resolve the way SaaS governance did. First, by applying existing regulations to the problem; second, through the rise of new regulations; and third, he expects “we’ll see a major public failure which will push enterprises to demand more controls and guardrails from vendors.”

There’s also a future when the governance itself will be automated. “Because agents and copilots have agency, act at machine speed around the clock, and are prone to hallucinations, enterprises will need to match that speed from a governance perspective," concludes Antil.