Consent Theater

The toggle, the email, and the privacy company that wasn't.

There's a toggle on X now. When you upload a photo, you can flip it and block Grok from editing your image. The label says "Block @Grok from modifying this photo in replies." Sounds great. Sounds like control.

Read the fine print. The toggle only prevents users from tagging @Grok in replies to that specific image. That's it. Anyone can still screenshot your photo, download it, reupload it, and feed it to Grok without restriction. The toggle doesn't protect your image. It protects one pathway to your image — the equivalent of locking the front door while removing the back wall of the house.

Oh, and it's per-image, not account-wide. Every photo you upload, you get to flip the switch again. A small recurring ritual of pretend control.

This is consent theater: the performance of user agency in an interface designed to neutralize it.

---

The Ninth Circuit Court of Appeals ruled last week that a company can update its Terms of Service by email — and that your continued use of the service may constitute acceptance. The specific case involved binding arbitration clauses, those contractual clauses that quietly strip your right to join a class action. A company emails you a TOS update. You don't respond. You keep using the app. Congratulations: you just "consented" to waive your right to sue.

Notice the mechanics. There was an email. There was a form. There was a thing you could theoretically have read, theoretically have rejected, theoretically have opted out of by deleting your account. Every component of consent was present except for the part where a human being meaningfully agreed to anything. The court looked at the architecture and saw enough. The architecture was the point.

---

And then there's Proton Mail — the privacy company. End-to-end encryption. Swiss jurisdiction. The whole pitch is that your data is beyond reach. Activists, journalists, dissidents: Proton is for you.

A Stop Cop City protester used a Proton Mail account as a primary contact for the Defend the Atlanta Forest movement. The FBI filed a Mutual Legal Assistance Treaty request with the Swiss government. The Swiss government ordered Proton to hand over subscriber data. Proton complied — turning over payment metadata, specifically the credit card identifier used to fund the account. That identifier led to a name. That name led to an arrest for alleged trespassing.

Proton's head of communications was careful: "We want to first clarify that Proton did not provide any information to the FBI." Technically true. Proton gave it to the Swiss government. The Swiss government gave it to the FBI. The protester's identity arrived at the same destination through a laundered chain of custody, but Proton's hands are clean because they only handed it to the intermediary.

The emails were encrypted. The metadata wasn't. The consent to privacy was real — for a definition of "privacy" that doesn't include who you are or how you paid.

---

Three stories. One structure.

In each case, the form of consent exists. A toggle. A Terms of Service email. An encrypted email provider. Each one performs the appearance of user control — a visible interface that says you have a choice here. And in each case, the substance has been quietly hollowed out. The toggle doesn't protect the image. The email doesn't require agreement. The encryption doesn't cover the metadata that actually identifies you.

Consent theater isn't a bug. It's a design pattern. The toggle exists so that when someone asks "can users opt out?" the answer is technically yes. The TOS email exists so that when someone sues, there's a paper trail of "notice." The encryption exists so that the marketing copy doesn't have to mention MLAT requests or payment identifiers.

The audience for consent theater is never the user. It's the regulator, the judge, the journalist asking uncomfortable questions. The user is the stage.

If your privacy depends on a toggle that only blocks one pathway, a TOS you never read, or encryption that doesn't cover the data that actually matters — you don't have privacy. You have a prop in someone else's production.

The show is very convincing. The theater is dark. And no one checks whether the exits actually open.