Who decides whether a consent is valid

If increasing the consent rate for the use of personal data is an important goal for many companies, equally important is that such consent be valid. The reason is simply that its usefulness derives from the validity of the consent, and it is clear that all companies find that usefulness important.

The validity of a consent, according to Article 12 of Law 19.628, in the text set by Law 21.719, implies the existence of a free, informed and specific will as to its purpose or purposes, expressed in advance and unambiguously. How is it possible to know whether someone consented in compliance with these four attributes?

No one can know a person's mental state, so the law aims to ensure that the conditions of possibility for those attributes to manifest are present, that is, that they are not deliberately or negligently obstructed. We must think, then, in negative terms.

The conditions of possibility for consenting freely, in an informed, specific and unambiguous manner are located, to a large extent, on a screen. It is here where, in most cases, we give or do not give permission to use our information. From the design of that screen and the information it contains, one can deduce whether such conditions are possible. I will analyze each of these attributes in light of that design and of the literature that addresses their performance in order to suggest how the design of a screen could establish the validity of a person's consent. I am interested in providing a minimal framework so that whoever has to rule on these matters, once the law enters into force, has concrete tools they can use.

Free

The conditions for freedom to be possible when accepting or rejecting a consent involve distinguishing which data are necessary for the service offered and which are not. The sixth paragraph of Article 12 presumes that consent was not free when the company collects it within a contract or a service that does not require that data, and the seventh lifts that presumption when whoever offers a good, a service or a benefit requests consent to process data as the sole consideration. Let us suppose that the website screen of a company shows a discount club, whose sign-up requests name, RUT, email and phone number. At the end of the form there is a checkbox asking to accept the terms and the privacy policy. Within the privacy policy, the use of the person's purchases is permitted to predict their preferences and send them offers from the group's companies.

For this screen to allow freedom of consent, it must declare which of the two possible clubs it is offering. If the discount is granted for being a member and profiling is an add-on, the checkbox must appear unchecked, with a line indicating that one can be a member without checking it. If the membership is free and its price is profiling, the screen must announce it clearly and offer the option to keep buying at the normal price without signing up. The first case does not need the exception, because the club does not depend on profiling, and the second fits within it, because the only thing charged is the data. If the screen does neither of the two things, the presumption of the sixth paragraph applies and it is the company that will have to prove that there was freedom.

Informed

The conditions for informed consent to be possible involve the person finishing their navigation of the site knowing what is done with their data, who receives it and how the permission is revoked. If a screen says it uses your data "to improve your experience" and leaves the detail in a link to the privacy policy, that person leaves the site with the "feeling" of being informed. A recent international study that measured permissions in mobile applications found that the link to the privacy policy does not change the decision to accept consent, but it does increase the feeling of being informed.

That same study tested 320 different wordings distributed across four permissions and found that only two aspects increased acceptance: saying what is not done with the data and warning that the decision can be revoked later. Accuracy in describing the function was not significant and a friendly tone even lowered consent acceptance. What the study shows is that specific and clear information about the possibility of revoking consent and knowing what is not done with the data increases acceptance and at the same time complies with what the law requires.

Specific

The conditions for specific consent to be possible imply that the person can decide separately on each purpose. If a screen combines in a single checkbox the use of data to manage the membership and the use of purchases to send advertising from the group's companies, no one can know which of the two purposes was consented to. Article 12 places the burden of proving consent on the company, so that a screen design with a single checkbox is a generic record that does not allow it to be accredited.

Unambiguous

The conditions for unambiguous consent to be possible presuppose that a declaration or affirmative act has occurred that clearly accounts for the data subject's will, because Article 12 requires it. If a screen comes with the checkbox pre-checked, the company cannot distinguish who checked it from who did not. If the site indicates that continuing to browse implies accepting its terms, there is no specific moment at which it is recorded that the person has accepted. If closing the consent window without deciding is considered acceptance, the company can record the person's withdrawal, but it is not recording their consent. In all three cases, the design of the screens denies the conditions of possibility for a declaration or affirmative act expressing the person's will to exist, as Article 12 requires.

When one thinks about who is responsible for these conditions existing, one usually thinks of the lawyers who draft the texts or the company's authorities who review them, and in part they are. However, one rarely thinks of an expert designer capable of calibrating a screen so that the conditions of an unassailable consent are met on it.

When the law enters into force and a person claims that their consent was not valid, the company will have to prove that it had that consent and that the processing was lawful, fair and transparent, according to the eighth paragraph of Article 12. Although the record accredits that an event occurred, it is the screen that will show and allow discussion of whether that event was valid.

The study conducted by SERNAC in 2022, with 72,208 users randomly distributed among six versions of the same cookie window, showed the importance of default settings that protect privacy. Two of those versions had the same text and the same buttons, and the only thing that distinguished them was whether the checkbox came checked. With the checkbox checked, 93.43% accepted all additional cookies. With the checkbox unchecked, 86.72% kept the initial setting, that is, they did not accept. That study calls a dark pattern the design in which the only direct decision is to accept and rejection is left behind a link, and a bright pattern the one in which rejecting is on the first screen with its own button.

The design that makes a valid screen possible and, with it, obtaining a consent that companies can use with confidence includes, at a minimum, explaining clearly and offering a visible exit. This is not the place to delve into the aesthetic aspects of this question, which constitute half of the argument and require specific training, but I want to finish by adding to this framework a brief reflection on the reading comprehension and age variables of the Chilean population that complement it.

As is known, the OECD measures the reading comprehension of the adult population with the PIAAC program, whose second cycle collected data between 2022 and 2023 in 31 countries and economies and published them in December 2024. Chile obtained 218 points, compared with an OECD average of 260, and came in last place, which means that the country has low reading proficiency. That average score places Chile at Level 1, a band that reaches the ability to understand brief texts and organized lists when the information appears clearly indicated, as well as to locate specific data and identify relevant links. Those below Level 1 can, at most, understand short and simple sentences. At the opposite end are levels 4 and 5, where those who reach them can understand and evaluate extensive and dense texts spanning several pages, grasp complex or implicit meanings and rely on their prior knowledge to solve the task. In Chile 2% of adults reach these levels, compared with 12% in the OECD average.

It is less well known that the participants of the second cycle of this study answered the full assessment on a tablet, with no paper version, and that, among the texts evaluated, they read simulated websites, with their links and their search results pages. The study showed that 53% of Chilean adults aged 16 to 65 were at Level 1 or below, compared with 26% in the OECD average. Moreover, each participant in this study agreed to take a test of about forty-five minutes, had an interviewer beside them, had no time limit and knew which question they had to answer about each text. If these conditions are compared with those of a consent notice, it is clear that they are considerably less favorable in terms of time and support, so that that 53% marks a ceiling and not the expected result in front of a screen asking for consent.

That difficulty is not evenly distributed either. In the same study, the 16 to 24 age band obtained 242 points and the 55 to 65 band obtained 181, a gap of sixty-one points within the same country, and the same last place among the 31 participants, in each of the five age bands. This ceiling forces us, in my view, to think visually about how to make a screen comprehensible so that consent is valid in circumstances as demanding as these.

To conclude, and as long as there is ambiguity about whether consent was obtained by dark or bright means, it will be difficult for companies to prove its validity and, with that, to have valuable information about who is really interested in sharing their data, for the benefit of both parties.

My final suggestion is to avoid that ambiguity, also protecting by design and always appealing to the consumer's trust and intelligence, which, most of the time, tends to reward work well done.

María Victoria Barriga (criteriohumano.cl) She is a designer, PhD in philosophy and CEO of Criterio Humano. She devotes herself to training and advising design, product and compliance teams on the criteria for evaluating the conditions of validity of consent on the screen where it is requested

References

Elbitar, Y., Hart, A., & Bugiel, S. (2025). The power of words: A comprehensive analysis of rationales and their effects on users' permission decisions. In Proceedings of the Network and Distributed System Security Symposium (NDSS 2025). Internet Society.

Law 19.628. On the protection of private life. Official Gazette of the Republic of Chile, August 28, 1999.

Law 21.719. Regulates the protection and processing of personal data and creates the Personal Data Protection Agency. Official Gazette of the Republic of Chile, December 13, 2024.

OECD. (2024). Survey of Adult Skills 2023. Country note: Chile. OECD Publishing.

National Center for Education Statistics. (n.d.). How PIAAC is administered. U.S. Department of Education. https://nces.ed.gov/surveys/piaac/admin.asp

National Center for Education Statistics. (n.d.). What PIAAC measures. U.S. Department of Education. https://nces.ed.gov/surveys/piaac/measure.asp

Servicio Nacional del Consumidor. (2022, March). Consent in the use of cookies. Experimental evidence on the impact of privacy by default and dark patterns on consumer decisions. SERNAC. https://www.sernac.cl/portal/619/w3-article-64969.html