Before a workplace AI tool processes someone’s personal information, what has that person agreed to? Explicit consent means a clearly expressed, specific, informed, and freely given agreement to process personal data. It calls for more than assuming that someone accepts a use they may not know about. section 3.15
Consent matters because an AI system may handle information about people who never use it directly. Under the European Union’s General Data Protection Regulation (GDPR), an organization must identify a lawful basis for processing personal data. Consent is one possible basis, not the only one. In scrutiny of ChatGPT, Italian regulators indicated that OpenAI would need explicit consent from people whose data was used or show that its use qualified as a legitimate interest. Whether an opt-out reaches data already used for training remains contested. section 3.15
Consent also has practical implications beyond a legal finding:
- For an AI tool used at work or in a product, explain its use, require users’ consent, and offer ways to opt out or delete data. Avoid entering confidential information without assessing the risk. section 3.12
- For an assistant with persistent memory, give people meaningful control over what it retains and recalls. Greater personalization makes transparency and consent more urgent. section 10.4
- For student data, pair clear consent protocols with data governance and appropriate protections when schools use AI tools. section 3.16
Consent is not the end of the question
A song released with an AI-generated version of Randy Travis’s voice had his support. Unauthorized tracks mimicking Drake and The Weeknd did not have those artists’ consent. These are questions about a person’s voice and creative control, rather than a substitute for assessing the lawful processing of personal data. Even when an artist agrees, questions about control and legacy can remain. section 4.9
