An information technology revolution is transforming many aspects of society and the economy. To cite the phrase coined by Google: ‘We no longer go online, we live online.’ This shift is underpinned by the processing of personal data. Those data come from many sources: websites, mobile apps, networks, sensors and cameras. They describe real people: data subjects. Personal data can create a detailed picture of who they are, what they have been doing, with whom, what they have seen or told and what they are looking for. Such digital profiles may be compared with the profiles of others to make inferences about data subjects. The creation of such profiles is the main goal of many online service providers, since they can be monetised by selling the information about data subjects piece by piece to those who are interested in influencing them. This mechanism is universal and can serve anybody who wants data subjects to buy a product or be convinced of an idea. The result is that Internet users are not only stalked by advertisements that divert their attention; what they see online is also adjusted ‘on the fly’ and tailored to their particular personal traits, which exposes them to a range of risks. This not only influences their consumer behaviour, but also shapes their social interactions and affects societies as a whole. It may promote some ideas and stifle others or, for example, even tip the balance of elections. The more data provided on the profiles of these individuals, the more vulnerable they are to discrimination, manipulation, coercion or ‘identity theft'. This affects their autonomy and dignity and has serious social consequences: free, liberal democracy cannot exist without free, autonomous individuals. Paradoxically, data subjects not only consent to this mechanism of corporate surveillance by accepting Terms and Conditions of online services like Google or Facebook, but they also pay for it, usually in the price of the end products.

Online service providers rely mainly on that consent as a justification and a legal basis for personal data collection and use. They say they need those data to provide ‘free', personalised services for the willing users. The existing data privacy laws, including the newest one - the European General Data Protection Regulation (GDPR) - also keep focusing on consent as a main tool for individual authorisation.