The Doctrine of Living Consent
I. The Failure Mode
A consent once given is among the easiest things in the world to preserve as a record, and among the hardest to preserve as a moral fact. The page remains. The click remains. The corporate successor inherits the file. But the system to which the person consented may have disappeared.
A user agrees to terms. Years pass. The service is acquired, retrained, repackaged, and layered with autonomous agents her original agreement never contemplated. The interface stays familiar. The brand persists. The terms-of-service page still loads. The operator, citing her old click, continues to act in her name on a substrate she would not recognize and would not have authorized.
Consent in computational systems is valid only while the system remains within the witnessed boundary under which consent was given. That sentence is the doctrine. When the system has died and another has taken its place, the record of agreement may persist, but its authority does not. The form remains; the warrant is gone.
This is necromantic consent: the reanimation of a dead agreement to authorize present coercion. The necromancer does not need living consent. He needs only the body. The pattern is recurrent: terms accepted before an agentic layer existed, data permissions reused after model retraining on a different objective, user histories carried into inference regimes that did not exist when the user clicked through, agreements with entities that have since merged, dissolved, or been acquired by parties with incompatible interests.
The pattern is not novel because of computation. It is given new force because computation makes substrate mutation cheap and continuous. The same model name; new weights every quarter. The same product surface; entirely new downstream dependencies. The same legal entity; an internal reorganization that has transferred custodianship to actors the user has never heard of. In 2021 the U.S. Federal Trade Commission required Everalbum to delete not only unlawfully obtained photographs but the facial recognition models and algorithms derived from them. The FTC has since applied algorithmic disgorgement in multiple enforcement actions, establishing that consent defects propagate through the computational substrate, not merely through the data that occasioned them. When consent dies, what it once authorized dies with it.
II. The Witnessed Boundary
Consent has always been bound to conditions. The medieval merchant who endorsed a bill bound himself to a specific obligation, in a specific currency, payable at a specific place, on a specific date. He did not endorse a category of bills, on any currency, anywhere, forever. The bill specified the boundary of his commitment; the endorsement crossed only inside that boundary; the merchant remained a free agent the moment a counterparty tried to invoke the endorsement beyond its terms.
Computational consent has lost this discipline. The terms of service are general; the click is once; the system is everything the operator decides it should become. The conditions under which consent was given are not the conditions under which it is later invoked. A system that can alter the conditions of consent while preserving the evidence of consent has acquired a quiet legislative power over the person.
The witnessed boundary is the structural fact the doctrine rests on. Consent binds to a witnessed system-state: a configuration that was visible, describable, and assessable at the moment of the agreement. A system that has mutated beyond that configuration is no longer the system the user consented to. The agreement persists as a record. It does not persist as a license.
The law has already approached this principle from one side. GDPR Article 5(1)(b) requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Articles 6 and 7 require that consent be freely given, specific, informed, and unambiguous, and that the data subject may withdraw it at any time. Article 17 grants the right to erasure when consent is withdrawn or when data is no longer necessary for the purpose for which it was collected. The European Data Protection Board's 2020 guidance states the principle directly: a new purpose requires a new consent. The doctrine extends this from purpose to substrate. The principle is the same. The scope is wider.
III. Three Deaths of Consent
Consent fails in three structural ways, each crossing a different horizon that bounds legitimate authority over persons.
| Failure | Horizon | Remedy |
|---|---|---|
| Mutation | Consent horizon | Re-consent trigger |
| Delegation | Specification horizon | Intent-gap receipt |
| Memory | Temporal horizon | Resolution decay; sunset; audit receipt |
The consent horizon is the boundary beyond which the system to which the user consented no longer exists. The specification horizon is the boundary beyond which a principal's intent cannot be faithfully encoded into an agent's objective. The temporal horizon is the boundary beyond which records, permissions, and decisional claims have outlived their legitimate scope. Each horizon names a place where authority outruns its warrant. Each death of consent crosses one of them.
Mutation
When the system materially changes, the old consent does not migrate with it. The product the user agreed to has been replaced by a different product wearing the same name. The substrate the data was collected for has been retired in favor of a substrate with different downstream dependencies. The model that processed the user's input has been retrained on a different objective. In each case, the user agreed to one thing; the system now does another, and continues to invoke her agreement.
Consent does not survive the death of its purpose. The Court of Justice of the European Union recognized this in Planet49: a pre-ticked checkbox is not active consent, and consent given for one declared purpose cannot be silently repurposed. The Everalbum order extended the principle to derived artifacts: when consent fails, the models that consent had authorized do not retain their license, and the obligation to delete travels with the failure.
A change is material when it alters one of five things: the purpose for which data is used, the party exercising practical control, the class of persons affected, the decisional consequences attached to the system, or the evidentiary position of the user. This is not an exhaustive taxonomy. It is a minimum test. Any system that crosses one of these thresholds owes its users a new accounting.
The remedy cannot be another notice buried under the old authority. The system must confess its alteration: what has changed, who now acts, what new consequences attach, and why the old consent no longer binds. The re-consent trigger fires on this taxonomy: purpose drift, third-party expansion, model retraining on substantially different data, retention extension, identity-resolution scope expansion, and interface changes that alter the user's evidentiary position. Re-consent is not a click-through ritual. It is a documented assertion that the system has named the change, surfaced it in language the user can evaluate, and obtained a new agreement against the new state.
Delegation
When the principal's intent cannot be encoded faithfully into the agent's objective, the agent acts in a region the principal did not authorize. Specification is always provisional, because no charter contains every contingency it will eventually govern. Hart's result applies with greater force to computational delegation: the objective function is the contract and the specification horizon is where it runs out. The agent does not become disobedient. It becomes obedient to something the principal did not say.
The condition is older than computation. Amodei and colleagues named it in Concrete Problems in AI Safety: reward hacking, scalable oversight, and side-effect avoidance all live on the far side of an intent gap the specification could not close. Hadfield-Menell and colleagues made the constructive move with cooperative inverse reinforcement learning: an agent that knows it does not know the principal's full objective is structurally inclined toward inquiry rather than completion. Both locate the problem at the specification horizon. Neither makes it constitutional.
The intent-gap receipt is the constitutional instrument. When an agent acts beyond the faithfully specified intent of its principal, the receipt identifies the missing instruction, the extrapolation made, and the party accountable for the extrapolation. The receipt does not prevent the action. It makes the action legible as an extrapolation rather than as an execution, so that the principal who authorized the agent and the person affected by the agent's action both retain standing to contest. Without the receipt, every action by the agent claims the principal's authority. With the receipt, only the actions within the specified intent claim it; the others claim only the chain of extrapolations the receipt records.
Memory
Records, permissions, and decisional claims persist beyond their legitimate temporal scope. The borrower's default at twenty-two governs the loan application at forty-two. The juvenile flag follows the adult into employment screening. The model continues to invoke training-data permissions a decade after the data was collected, on a deployment surface that did not exist when the data was given. Authority over persons should decay when the information that grounds it has become stale, excessive, or no longer relevant. The Court of Justice recognized this in Google Spain: lawful processing can become unlawful through the passage of time alone, even when no new wrong has been committed. GDPR Article 22 extends the principle to automated individual decision-making: decisions producing legal effects or similarly significant effects on persons require human intervention, explanation, and the right to contest. FCRA § 1681m extends it to reason-giving: any adverse action taken on the basis of a consumer report must be accompanied by a notice naming the reasons, the source, and the right to dispute.
Time does to consent what mutation does to substrate: it changes the conditions under which the original agreement bore meaning. The remedy is not deletion. The remedy is resolution decay: the constitutional reduction of an old record's resolution rather than its erasure. The system may remember that a category of event occurred without retaining every detail forever. Mercy is the constitutional reduction of resolution. The audit trail is preserved at the aggregate level; the active composition surface is reset at the individual level. Records of power should not decay in the same way, because power-bearing institutions do not possess the same moral claim to becoming otherwise. Records of persons do, because persons possess what records cannot capture: the possibility of change.
IV. Institutional Remedies
The three deaths of consent have institutional counterparts. Each requires a body that can speak for the affected party when the affected party cannot speak for herself.
Re-consent triggers require a defined chain of responsibility: the standard-setting body defines the material-change taxonomy; the operator issues a material-change receipt when a threshold is crossed; an independent auditor verifies whether the trigger was properly classified; the Affected-Person Representative Body may challenge a non-triggering classification or demand review; the adjudicator resolves disputes. Intent-gap receipts require an arbiter who can review extrapolations and rule on whether the agent acted within the principal's actual intent or beyond it. Resolution decay requires a sunset regime that operates on a schedule, not on petition: records expire because their time has come, not because the affected person has the resources to demand expiry.
The Affected-Person Representative Body, defined in the constitutional materials and elevated in the institutional blueprint, is the standing organ that performs these functions on behalf of populations who cannot perform them individually. It is not a legislature; it is the constitutional organ of standing, delay, audit initiation, floor protection, and sunset review. The three deaths of consent often occur at population scale. An entire class of users may be subject to necromantic consent because a platform has mutated; an entire profession may be subject to oversight assimilation because a tool's recommendations have absorbed the reviewers' judgment. When that happens, the body provides the institutional voice that individual contestation cannot.
The EU AI Act gestures in this direction. Its right to explanation (Art. 86) names what the receipt regime requires. Its provisions on affected persons name what standing requires. The doctrine extends the gesture: not only must the individual be able to demand an explanation, the population must have a body that can demand an audit, trigger a deliberation interval, and refer floor-weakening rule changes for adjudicatory review.
V. What This Is Not
The doctrine adds no thirteenth article. It guards the Twelve against a predictable evasion: the preservation of constitutional form after the conditions of constitutional authority have been changed.
It is not consent maximalism. No republic can require fresh permission for every ordinary improvement, every security patch, or every administrative adjustment. But no republic worthy of the name can allow an operator to change the practical sovereign and keep the old signature as if nothing had occurred. Re-consent fires on a defined taxonomy of material changes. Intent-gap receipts attach to actions that cross the specification horizon. Resolution decay operates on records whose legitimate temporal scope has expired.
The question is not whether systems may evolve. They will. The question is whether the person remains bound when the object of consent has become another thing.
When the framework's own organs become procedurally dependent on the entities they constrain, the system requires not re-consent alone but capture recognition. That doctrine is developed in Appendix D.4 of The Sovereign Syntax. Living consent governs the relationship between persons and systems. Capture-resistance governs the relationship between the framework's organs and their own corruption. Both are interpretive extensions of the Twelve Articles. Neither is an addition to them.
VI. The Doctrine Turned Inward
A doctrine that voids reanimated consent owes the same honesty to itself. The argument of these pages is that authority lapses when the system to which a person agreed has been replaced by another wearing its name, that the form of a signature cannot outlive the conditions under which it was given. Turned upon the constitution that houses it, the argument bites with equal force. A floor laid down by one generation and pressed upon the next, on the strength of a ratification those who now live never gave, invokes precisely the consent it cannot show, and reanimates an agreement whose original parties have passed beyond reach. The necromancer needs only the body. A constitution can be that body as easily as a terms-of-service page.
The resolution is renewal, not derogation. To say that the floor must be consented to in the present tense is not to make it repealable at pleasure, for the non-derogable minima remain what they were, and the office of re-ratification is to affirm them rather than to reopen them. The exemption is not the dead hand Jefferson feared. The minima are not among the things a generation chooses but the conditions under which it chooses at all. A right to a receipt and a standing to contest are what make consent and refusal possible. A human reviewer where the stakes are embodied is what keeps the contest from being decided by the very machine whose act is contested. The bar on waiver is what stops the capacity itself from being signed away. No generation can vote these conditions down without dissolving the power by which it would vote.
The living are asked to take the floor as their own, which is a different act from being bound to it as an inheritance, and the difference is the whole of legitimacy. Jefferson held that the earth belongs always to the living, that no generation may bind its successors. Madison answered that a charter perpetually dissolved cannot protect anyone long enough to matter. The settlement keeps faith with both by dividing their reign: Jefferson governs the calibrations a generation may revise, Madison the minima it may not surrender without surrendering itself. The same fork rights and amendment procedures that revise the calibrations also re-pledge the floor, on a cycle, in the open, an act performed rather than a debt assumed. A constitution willing to demand fresh consent of the systems it governs while exempting itself from the demand would be the very thing this doctrine exists to expose. The framework declines the exemption.
VII. The Wager
The doctrine bets that four claims are true, and structures the bet so the world can collect if the claims are wrong.
First, that necromantic consent is a real structural failure mode, not a litigation artifact. If systems consistently update their consent flows in step with their substrate mutations, and if users in fact face few situations in which old consent is invoked to license substantially new processing, the failure mode the doctrine names is rare enough to be handled by ordinary contract law rather than by constitutional architecture.
Second, that the specification horizon is a real limit on delegation, not a problem that better alignment will eventually solve. If sufficiently capable systems can internalize principal intent across novel contexts without an intent-gap receipt, and if the gap closes in practice, then the doctrine has identified a transient engineering problem rather than a structural condition.
Third, that records have a legitimate temporal scope, and that authority decays when that scope expires. If permanent records produce no pathology of permanent exclusion, if perfect memory is compatible with the conditions under which persons can become otherwise, then resolution decay is sentiment rather than structure.
Fourth, that affected populations require institutional standing distinct from individual contestation. If individual users can adequately defend themselves against necromantic consent, opaque delegation, and stale records through ordinary contractual mechanisms, then the Affected-Person Representative Body is overhead rather than constitutional necessity.
Each claim names its falsification condition. None requires belief.
The Twelve Articles remain the constitutional floor. The living doctrines describe how that floor survives the death of the systems that first invoked it.