Cookie Law for Robots · Domen Kožar
Skip to content
Building tools for better developer environments at cachix.org, secretspec.dev, and devenv.sh.
GitHub ↗<br>Twitter ↗<br>Email ↗
Consent without choice
When a website asks me to accept cookies, I usually click the button before I<br>have finished reading it.
I suspect most people do. When researchers asked participants to join a<br>fictitious social network,<br>most never opened the terms or the privacy policy,<br>and those who did spent about a minute on a document that takes half an hour to<br>read. This is strange, because the legal point of consent is to give us a<br>genuine, informed choice.<br>Instead the notice has trained us to continue without choosing.
By one measure, cookie law has been a spectacular success. The web is covered<br>in banners, preference panels, privacy policies, and records showing which<br>button you pressed. The European Commission even convened a<br>Cookie Pledge project<br>to explore how consumers might make more effective choices about tracking,<br>though it<br>collapsed without ever being signed.
By another measure, it has failed. People often<br>skip or merely skim privacy policies,<br>while the design of the banner itself can<br>shift consent rates by double digits.<br>The banner records a decision that, psychologically, may never have happened.
Cookie law may even have made the problem worse. It taught us that consent is<br>an obstacle placed between us and what we want. The fastest way past the<br>obstacle is to agree.
Summaries that help us decide
There is already a better response to this problem.
Terms of Service; Didn’t Read takes documents almost no<br>one reads and turns them into something people can use: a grade and a short<br>list of the terms that deserve attention. The grade is useful, but the list is<br>more important. It tells you that a service may<br>keep deleted data and use your identity in advertising,<br>or change its terms without notice.
This is more than making the document shorter. A shorter document can preserve<br>all the wrong things. ToS;DR organizes it around consequences. Its contributors<br>extract individual points, discuss them, and classify them,<br>while the project publishes its work as open data. The summary does not merely<br>save time. It helps you decide.
Cookie banners ask millions of people to spend attention they do not have on<br>the same problem. ToS;DR does the hard reading once and lets everyone reuse the<br>result. It accepts that attention is scarce and tries to spend it well.
AI as an assistant
Software has<br>tracked how terms change since 2009<br>and still does, while researchers have proposed<br>plain-English contract summaries and<br>party-specific summaries. An<br>assistant could combine these abilities: compare a new contract with the old<br>one, find the clauses that affect me, and ask about the few decisions that<br>matter.
The word summary undersells this. A generic summary tells everyone the same<br>five things. An assistant that knows my context can know whether I am the<br>tenant or the landlord, which compromises I have refused before, and how a new<br>policy conflicts with the way I work. But context is personal data by another<br>name. I should be able to inspect, correct, delete, and move what my assistant<br>remembers. Otherwise it is the company’s assistant with access to me.
Generated summaries can be<br>plausible but inconsistent with their source,<br>so every claim should lead back to a clause.
The useful future is not AI replacing ToS;DR, but extending it: humans decide<br>which consequences matter and review disputed judgments; assistants handle the<br>reading and revisions.
Cookie banners for AI
The EU AI Act now requires<br>certain AI systems to tell people when they are interacting with AI, and<br>certain AI-generated content to be marked. These are sensible rules. But AI<br>policy could make the same mistake if disclosure becomes its main measure of<br>human agency.
It is easy to require an AI system to display a warning. Warnings are visible.<br>They can be photographed, audited, and shown to regulators. It is harder to<br>determine whether users have meaningful control over the system, because<br>control is not a sentence on a screen. It depends on who owns the model, who<br>can inspect it, whether you can leave, and what happens to your data when you<br>do.
So we may get the AI equivalent of cookie banners. You will be told that you<br>are talking to a machine. You will click Continue. The institution operating it<br>will have satisfied the disclosure rule, and nothing important will have<br>changed.
Open source projects writing disclosure rules for LLM-assisted contributions<br>meet the same difficulty. The label is easy to require. The judgment behind it<br>is not.
The mistake is to confuse a visible ceremony with a change in power.
Hierarchy or melding
Animals offer a clue. Species compete most when they<br>occupy the same niche.<br>Humans and AI will too. If both do the same work for the same rewards, one will<br>eventually be put above the other.
Hierarchy is the default answer. Humans...