Glossary
Consent
Permission given freely and specifically for a stated use of somebody's data, which is one of several available grounds rather than the default one.
In plain terms
Somebody agreed, knowing what they were agreeing to and having had a real option to decline. The demanding parts are the qualifiers. Permission buried in a long document nobody read, bundled with something they actually wanted, or given where refusing was not realistically available is weaker than it looks, and it is weakest at exactly the moment somebody wants to rely on it.
Why it matters
Because it is reached for reflexively as though it were the safe answer, and it is the most fragile of the available grounds. It can be withdrawn, it has to be specific about a use, and it has to be evidenced later by whoever is relying on it. For an AI buyer the sharp edge is the specificity: permission given years ago for one purpose does not stretch to cover a use nobody had thought of at the time.
How it works
It is tied to a stated purpose, which is where AI work runs into it. Material gathered for one reason, support tickets, application forms, recorded calls, arrives at a moment when somebody would like to use it to improve a system or train something. That is a new purpose rather than a continuation of the old one, and the original permission was not asked about it.
It can be withdrawn, and the practical question is whether you could act on that. Withdrawal is straightforward when material sits in one system with a delete button and much harder once it has been copied into several tools, embedded into a search index and quoted in a conversation history. That difficulty is a reason to think about where material goes, not a reason to hope nobody asks.
Bundling weakens it, and bundling is the normal way it gets collected. Permission taken as part of accepting terms in order to use a service at all is doing less work than a separate, specific ask, because the person's agreement was to the service. Where something matters, asking for it on its own is both stronger and, unhelpfully, more likely to be declined.
It is one ground among several and frequently not the best fit. Other bases exist for handling information where the relationship or the purpose already justifies it, and relying on permission where one of those applies gives away a right to withdraw that nobody needed to grant. Which applies to a given situation is a question for somebody qualified, and knowing that the choice exists is the part a buyer can act on.
The same material, two purposes
Seen in the wild
Recorded support conversations gathered to help a customer, later proposed as material for improving an assistant, which is a new purpose.
ChatGPTInternal documents indexed for search, where material a person agreed to share with one team becomes findable by everybody.
GleanContact records in a CRM, where what somebody agreed to when they gave their details is narrower than what a tool could do with them.
Attio
Common misconceptions
People assume
We have consent, so we can use the data.
In fact
For the purpose it was given for. A new use is a new question however reasonable it seems, and the commonest version of this in AI work is material collected for delivering a service being proposed for improving a system. That was not the thing anybody agreed to, because nobody was thinking about it.
People assume
It is the safest ground to rely on.
In fact
It is the most fragile. It can be withdrawn, it has to be specific, and whoever relies on it has to be able to evidence it later. Other grounds exist and are sometimes a better fit, and relying on permission where one of those applies gives away a right to withdraw that nobody needed to hand over.
Telling them apart
Consent vs Opt out
Consent
Permission given in advance, for a stated purpose, by the person.
A setting you change to stop a provider using your material.
One is about people whose data you hold; the other is about what your vendor does with what you send.
Questions
- Does old permission cover a new AI use?
- Generally not, because it is tied to the purpose stated at the time and nobody was thinking about this. Material gathered to deliver a service being proposed for improving a system is the version of this that comes up most, and it is a new question rather than a continuation.
- Why is it called fragile?
- Because it can be withdrawn, must be specific, and has to be evidenced by whoever relies on it. Those three make it demanding to maintain, particularly once material has been copied into several tools where acting on a withdrawal is considerably harder than it sounds.
- Should we always ask for it?
- Not necessarily, and reaching for it reflexively can be the weaker choice. Other grounds exist for situations where the relationship or purpose already justifies handling something. Which applies to you is a question for somebody qualified; knowing that the choice exists is what stops it being made by default.
Key takeaways
- It is tied to the purpose stated at the time, and a new use is a new question.
- Withdrawal is easy to promise and hard to honour once material is in several tools.
- Bundled permission is doing less work than a separate, specific ask.
- It is one ground among several and often not the best fit.
Last checked July 2026