The Cookie

“We value your privacy.”

You’ve read that sentence more times than any sentence in human history. It appears on every website, every app, every service you’ve ever used. It is followed by a wall of text that nobody reads and a button that says “Accept All” in a large font next to a button that says “Manage Preferences” in a small font that opens a menu with forty-seven toggles that reset every time you clear your browser.

The design is not accidental. The large button is easy. The small button is work. The institution needs you to click the large button. The regulation requires the institution to give you the small one. Both requirements are met. Your data is collected. Your privacy is valued.

They call it consent. You clicked a button. The button authorized the collection of your browsing history, your location, your device fingerprint, your purchase patterns, and the construction of a behavioral profile sold to advertisers, data brokers, and anyone who pays. You consented to this the way you consent to gravity. The alternative is not using the internet.

The regulation was supposed to fix this. The regulation produced the banner. The banner produced the click. The click produced legal cover. The institution can now collect everything it collected before the regulation, but with a record of your consent. The regulation didn’t reduce data collection. It manufactured documentation that the collection is voluntary.

Forty-seven toggles. Each one a category of surveillance you can theoretically opt out of. Toggling all forty-seven takes nine minutes. The average user spends 0.4 seconds on the banner. The institution designed for the 0.4 seconds. The regulation designed for the nine minutes. The 0.4 seconds won.

Your privacy is valued. Not by much. But it’s valued.