AI and Consent Fatigue: Simplifying Data Permissions Without Sacrificing Ethics

Consent fatigue is not new. It predates AI. The research on informed consent in medical contexts identified the phenomenon decades ago, observing that patients given extensive disclosure documents often understood less about their treatment than patients given briefer, clearer explanations. The same dynamic plays out in digital privacy: the more consent mechanisms proliferate, the less each individual consent actually means.

The GDPR, which took effect in the European Union in 2018, was intended to give users more meaningful control over their data. In practice, it largely produced an explosion of cookie banners that annoyed users without improving their actual privacy. Research has found that 72% of cookie banner implementations contain at least one dark pattern designed to nudge users toward accepting tracking rather than genuinely informing their choice. Even among nominally compliant banners, a substantial portion still make the "accept" button more visually prominent than the "reject" option.

As of 2025, when websites offer a genuinely equal choice between accepting and rejecting tracking, roughly half to two-thirds of users now choose to reject. This tells us something important: users do not want their data collected and analyzed by default. But years of consent fatigue have trained them to click accept automatically because navigating the rejection process was designed to be difficult. When the barriers are equalized, their actual preferences emerge.

For nonprofits, this context matters because you are asking for consent from people who are already exhausted by consent requests and who have learned that such requests usually don't represent genuine choice. Your privacy notice, your email preference center, and your data sharing disclosures exist in this polluted environment. Even if your organization is genuinely committed to ethical data practices, you are competing for attention against years of bad actors who treated consent as a compliance formality rather than a real agreement.

The data privacy regulatory environment has grown significantly more complex in the past two years, and AI-specific requirements are layering on top of existing privacy law obligations. Nonprofit leaders who assumed that their organization's exempt status protected them from data privacy requirements will need to reassess that assumption.

At the state level, nonprofit exemptions from consumer data privacy laws are narrowing. The Indiana Consumer Data Protection Act, which took effect in January 2026, limits nonprofit exemptions to specific IRS classifications and explicitly requires organizations within its scope to provide clear opt-out mechanisms. The New Jersey SB 332, effective January 2025, has no nonprofit exemption at all. Several states now require the recognition of Global Privacy Control signals, which allow users to set universal opt-out preferences in their browsers without engaging with individual site banners.

On AI-specific requirements, the EU AI Act entered force in August 2024, with high-risk AI system provisions fully applicable from August 2026. For nonprofits operating internationally or working with EU-based individuals, this creates specific disclosure and consent requirements for AI systems that make consequential decisions about individuals. The FTC's updated COPPA Rule, finalized in June 2025, explicitly requires parental consent before using children's data to train AI models, a requirement with clear implications for nonprofits working with youth populations.

The key compliance principle that simplifies navigation of this landscape is recognizing that consent is not always the right legal basis for data processing. Under GDPR and similar frameworks, organizations can process data under several different legal bases, including contract execution, legal obligation, legitimate interests, and public task, not just consent. For nonprofits, many data processing activities can legitimately rely on the organization's mission-related legitimate interests rather than explicit consent, which reduces the consent request burden while maintaining compliance.

Where consent is required, the 2026 enforcement environment is particularly focused on five failure modes: broken opt-out mechanisms, cookies or tracking firing before consent is obtained, dark patterns that make rejection difficult, failure to honor Global Privacy Control signals, and poor response to data subject requests for access or deletion.

AI introduces consent challenges that generic privacy frameworks were not designed to address. When you tell someone that their data will be "used to improve services," that description could encompass manual staff review, statistical analysis, or AI model training, and those represent very different relationships with personal data. Being more specific about what AI actually does with data is both ethically required and increasingly legally required.

A practical starting point is to categorize your AI uses and determine which require explicit consent versus which can be handled under legitimate interests or other legal bases. AI that personalizes content based on a user's own stated preferences and past interactions is generally less sensitive than AI that draws inferences about characteristics the person never disclosed, or AI that uses data from one context (service provision) to inform a different context (fundraising). The more the AI use extends beyond what a person would reasonably expect given how they shared their data, the stronger the case for explicit consent.

For AI uses that do require explicit consent, the framing matters enormously. Consent requests that describe specific outcomes ("we use your giving history to send you information about causes you've supported in the past") work better than abstract descriptions ("we use AI to personalize your experience"). Requests that explain what you don't do ("we never sell your data or use it to train general AI models") can also help establish the boundaries of consent in ways that are more meaningful than generic permission grants.

Organizations working with particularly sensitive data, including health information, immigration status, financial circumstances, or domestic violence history, should apply additional scrutiny to any AI use that touches those data categories. In many cases, the ethical standard should be that sensitive data is not used for AI training at all, regardless of whether consent could technically be obtained. The risk that an AI model trained on sensitive beneficiary data could be compromised, misused, or produce unexpected inferences represents a harm that no consent mechanism can fully address after the fact.

The article on AI wellness tools for nonprofit teams addresses related questions about staff data in AI systems, while the article on evaluating AI vendors covers what questions to ask vendors about how they handle constituent data.