Did Consumers Really Consent? How to Assess Notice and Consent in Digital Privacy Litigation

Digital privacy disputes often hinge on competing accounts of what consumers noticed, understood, and intended. Behavioral evidence and testing can assess those accounts.

If you have used Google Chrome, you may have encountered an option to “sync” your web browser with your Google account. You also may have seen a separate notification about Google’s broader data collection practices. What would accepting that notification or choosing not to enable sync tell us about the data collection you understood and authorized?

That distinction became central to Calhoun v. Google, a class action filed in 2020. Plaintiffs alleged that Google collected personal information from Chrome users who had not enabled sync, without their consent. Google argued that its broader privacy disclosures and consent notification authorized the collection.

In 2024, the Ninth Circuit held that the district court had applied the wrong standard when evaluating Google’s consent defense. The Ninth Circuit fond that the district court should have evaluated “how a reasonable user would understand Google’s various privacy policies” rather than focus on which policy would be more relevant.

The question around consumer understanding and consent extends to a broader set of digital privacy disputes that highlight the value of rigorous consumer-behavior analysis: examining how disclosures and choices were presented, testing what consumers noticed and understood, and assessing whether different disclosures would have changed their decisions.

What Does a Click Actually Tell Us About Consent?

Someone who has visited a website or app and seen a privacy notice, cookie banner, or settings screen may have clicked out of, scrolled past, or closed the message, not knowing (or ignoring) that the interaction may become evidence in a privacy dispute. Whether that happens and how often is an empirical question.

What this interaction tells us about what we have noticed, understood, and intended cannot be addressed by intuitive reasoning. A system record may establish an observable action but not reveal the consumer’s reasoning. Conversely, a consumer’s later recollection may be influenced by time, new information, or the dispute itself.

A sound evaluation requires a fuller account of the interaction: what the interface displayed, the context in which the choice arose, how consumers behaved, and whether competing explanations fit the observed conduct.

The consumer experience can be organized into four stages to explore why seemingly minor distinctions may matter:

1. Exposure: Was the disclosure presented and available to the consumer? Availability does not establish that the consumer saw or read it. Nor does limited reading necessarily establish misunderstanding. If a consumer did not encounter a particular disclosure, the analysis must consider whether and how the relevant information was otherwise communicated.
2. Attention: Was the disclosure likely to attract notice given its placement, timing, size, repetition, and visual treatment? Evidence that a consumer noticed a disclosure does not alone establish how the consumer understood it.
3. Understanding: How were consumers likely to understand wording, labels, and available options? What caused a particular understanding? A particular understanding does not mean that different wording, placement, or emphasis would change that understanding or the ultimate decision. Establishing an interpretation is distinct from showing what caused it or whether the information was material to the consumer’s decision.
4. Choice: What did consumers do and why? Selecting the fastest option does not, by itself, establish either informed consent or the absence of meaningful choice. Likewise, a later complaint does not necessarily reveal what motivated the original interaction.

Every digital choice has an architecture. Information must appear somewhere, options must be ordered, and actions may require different levels of effort. These design decisions can affect consumer behavior even when the information itself remains unchanged. The expert must distinguish what the evidence establishes from what an observed action merely suggests.

What Evidence Can Assess What Consumers Noticed and Understood?

Given the nuances above, it is little wonder that privacy disputes arise with defendants and plaintiffs presenting competing accounts of consumer interaction.

A consumer behavior expert advising on such matters might have a wide range of behavioral evidence at their disposal, including:

• Behavioral records generated in the ordinary course of business: clickstream and navigation data; time spent on relevant screens; selection, acceptance, and opt-out rates; repeat interactions with the same notice; changes in behavior following an interface revision
• Product and design records: historical screen flows, mobile and desktop versions, A/B testing designs and results, usability research, product release histories, documentation of design decisions
• Consumer research conducted for litigation: surveys assessing recall, experiments testing whether a particular interface element causes a particular interpretation or action, usability testing, structured interviews
• Other contextual evidence: Relevant academic research and systematic analysis of contemporaneous customer complaints or social media

Each method has its limits:

• Clickstream data show behavior but may not reveal motivation.
• Surveys and experiments can measure interpretation and isolate causal effects but may require substantial effort to recreate non-contemporaneous realities.
• Interviews provide detail but may be affected by hindsight and recall.
• Content analysis allows experts to explore past opinions and attitudes but does not necessarily support causal inference.

A reliable analysis should match the method to the proposition being tested and consider multiple sources where feasible.

Why Consumer Variation Matters in Privacy Class Actions

In June 2025, after the Ninth Circuit returned Calhoun v. Google to the trial court, the court denied plaintiffs’ motion for class certification. Google had pointed to five sources of disclosure (privacy policy, account holder agreement, new account creation agreement, help center articles, disclosures by websites), and the court found that “inquiries relating to Google’s implied consent defense will overwhelm the damages claims for all causes of action,” that “plaintiffs have failed to identify any surviving promise in Google’s various disclosures that evidence an ongoing promise to avoid collecting data that Google does, in fact, surreptitiously collect,” and that “liability in this case ultimately turns on each class member’s subjective understanding of defendant’s promises.”

The ruling illustrates why consumer variation deserves careful examination. Consumers may differ in their experience, preferences, and circumstances, while the interfaces and disclosures they encounter may also vary. Relevant differences may include:

• Experience and familiarity: digital literacy, familiarity with the product, previous exposure to the notice
• Decision context: time pressure, purpose of the visit, mobile versus desktop use
• Account and interface conditions: new versus established accounts, product and policy versions, location-specific configurations, privacy settings
• Preferences: privacy concerns and willingness to exchange data for convenience or other benefits

Even consumers exposed to similar information may differ in whether they notice and how they interpret particular information and may make different choices. Conversely, consumers who take the same action may do so for different reasons. The expert’s task is to assess differences and how they might affect the conclusions that can be drawn reliably across the proposed class.

Would a Clearer Privacy Notice Have Changed Consumer Behavior?

A notice may be imperfect without affecting what consumers ultimately choose. The relevant empirical question is often: Would a more detailed, prominent, or differently timed disclosure have produced materially different behavior?

In Applebaum v. Lyft (a case with details that may be relevant to privacy cases), the US District Court for the Southern District of New York found that Lyft’s signup screen before September 30, 2016, was insufficient, particularly when compared with the version Lyft presented starting September 20, 2016. Why? Before September 30, the app asked consumers to check a box agreeing to its terms of service, which users could view only by clicking a light-blue hyperlink (which the court considered not sufficiently conspicuous); starting September 30, consumers had to scroll through an agreement and accept it at the bottom of the screen.

Experts can investigate a notice’s potential effect by:

• comparing conduct before and after a design change, including examining whether consumers changed their settings after receiving additional information or evaluating continued use after learning about the practice
• testing alternative versions of a notice through experiments
• comparing abstract preferences about privacy with observed product use

Importantly, consumers may express concern about privacy while continuing to use a product. That pattern alone does not establish that the concern is immaterial or that the original disclosure was adequate. The expert’s role is to assess what explains the observed behavior and what supports the effect of a different disclosure.

How Courts and Lawmakers Are Addressing Digital Consent

A disclosure, click, or complaint rarely tells the whole story.

Recent decisions illustrate why the surrounding consumer experience matters: the wording presented, prominence and repetition of the notice, actions consumers took, and context surrounding those actions.

For instance, in Lakes v. Ubisoft, a Northern District of California judge dismissed privacy claims after concluding that Ubisoft’s consent process was sufficient. Its analysis considered disclosures and consent opportunities at several points during the purchase process. In Chabolla v. ClassPass, the Ninth Circuit affirmed the denial of a motion to compel arbitration. The court examined both the presentation of contractual notices, including small gray text outside the natural signup flow on one screen, and whether the interface clearly communicated that clicking a button signified agreement. These cases address different legal requirements but illustrate why an action must be evaluated in context rather than treated as conclusive evidence of consent.

Legislation is adding another question: Did systems communicate and honor the consumer’s privacy preference? What did a particular click mean to whether the system took in a signal appropriately? The California Opt Me Out Act will require browsers to provide configurable opt-out-signal functionality beginning January 1, 2027, complementing other existing obligations. The functionality must be easy for a reasonable person to locate and configure, enabling consumers to communicate their choice to opt out of the sale and sharing of personal information.

For companies and counsel, the practical lesson is to preserve the record of historical screen flows, design documentation, A/B testing designs and results, consent logs, and evidence of how opt-out signals were processed.

In disputes over notice and consent, the expert’s role is to distinguish what the evidence establishes from what an observed action merely suggests. The most persuasive account of consumer behavior rests on evidence, not assumptions, and will have been tested rather than assumed.