You’ve clicked it a thousand times. The box at the bottom of the signup screen, next to a sentence that begins “I agree to the Terms of Service” and links to documents longer than this post. You click it because the alternative is not using the product. You click it because everyone clicks it. And you click it because, whatever the documents say, the box itself only ever offers one deal: everything, or nothing.
That click is what most software means by consent, and it has almost none of the properties the word carries in ordinary life. When you say yes to a friend borrowing your car, you’ve said yes to a person, for a purpose, for a while — not to whoever asks, for anything, forever. This post is about what consent machinery looks like when it’s built to mean what the word means: three properties you can check in any product in about five minutes, with ours as the worked example, honestly, limits included.
It’s the fifth leg of a series on evaluating apps that hold sensitive material: the questions to ask a vendor, redaction, portability, accountability — and now consent, the machinery of saying yes.
The checkbox is consent theater
Theater is the fair name for the standard pattern, because it produces the appearance of permission without the structure of it.
Look at what that one box actually does. It collects a single decision, at the moment you know the product least, covering every category of data and every future use at once. It can’t hear “yes to this, no to that.” It has no memory — six months later, neither you nor the company can point to what exactly you understood yourself to be agreeing to. And it has no practical exit: your one lever for changing your mind is usually deleting the account, which is less “withdrawing consent” and more “leaving the country.”
None of this requires bad intent. Bundled consent is cheaper to build, and nothing forces the question. But the effect is that the word consent gets stamped on an interaction that wouldn’t pass for consent anywhere else in your life. If a person treated you this way — one take-it-or-leave-it yes, no changes, no record — you wouldn’t call what they obtained permission. You’d call it pressure.
The fix isn’t a better-worded checkbox. It’s different machinery.
The three-property test
Real consent has three properties, and each one is checkable from the outside.
Granular. Can you say yes to one thing and no to another? Sharing isn’t a mood, it’s a list — this item, with this party, not that one. A product that can only ask for everything is telling you it never designed for the possibility that you’d want to give less.
Revocable. Can you change your mind, and does changing it do something real, now? A yes you can’t take back isn’t an agreement, it’s a ratchet. The test isn’t whether a “withdraw consent” sentence exists in the policy — it’s whether there’s a control in the product that flips the permission off today.
Witnessed. When you do share, does anything write down what happens under that permission? A yes that nobody records is a yes nobody can be held to. This is the property you’ll almost never see marketed, because it protects you from the company rather than the company from you.
Carry those three questions around and you own portable equipment: they work on a wellness app, a bank, a smart doorbell, a school portal. The rest of this post runs them against our own provider-sharing system, partly as a tour and partly as a demonstration of what the answers sound like when a product has actually built the machinery — and where ours still hasn’t.
Granular: three switches, per provider
On NexTier, connecting with a provider — a coach you found in the directory, say — doesn’t open your account to them. It creates a link with three separate permissions, each its own decision: whether that provider can see your goals, whether they can see your progress, and whether they see your display name.
The first two are the working relationship. Goals are what you’re aiming at; progress is how it’s actually going — and you can hand over either without the other. Share goals but not progress and a coach knows what you care about without a live feed of your week. It’s the difference between telling someone your destination and handing them your location history.
The third switch is identity itself. Whether a provider sees your display name is a grant like any other, not a default of the relationship — what a pseudonym buys you walks through why that layer exists and when to lower it. Providers have their own version of the same question on their side of the table, which we’ve written about separately.
And all of it is per provider. Saying yes to one coach says nothing about the next one. Each relationship carries its own list, which is how consent works between people. It’s also how trust gets to be incremental: a first month of goals-only sharing is a probation period you’re allowed to impose, and widen later, on your own evidence.
Revocable: what one click undoes, and what it can’t
Revocation is where consent systems usually turn out to be decorative, so here’s ours in plain terms.
One action revokes a provider’s access. When you do it, every permission on that link switches off and the revocation is stamped with a timestamp. That stamp isn’t a note in a file — it’s a gate the software checks. While it’s set, every permission question about that provider comes back no, regardless of what the individual switches once said. If you later choose to share again, the new grant clears the stamp and the relationship starts from whatever you newly agree to. Changing your mind, in both directions, is a first-class operation.
One deliberate design choice: revoking access doesn’t delete the connection. The chat history and the ability to message each other survive, so ending data-sharing doesn’t mean losing the conversation or the means to say “here’s why.” Access and relationship are separate things, and the machinery treats them separately.
Now the honest limit, and it’s a limit of physics, not of our implementation: revocation controls the future, not the past. What a provider already saw while the permission was on, they’ve seen. No system can reach into someone’s memory and unsee it for them. Any product that implies revocation erases the past is overpromising — the true claim, ours included, is that from this moment, the answer is no, and the system enforces it.
Witnessed: the part you can’t see from the outside
The third property is the quiet one. When a provider reads data you’ve shared, that read writes an audit row: who read, what kind of record, when. The rows are metadata-only — what your entries said never appears in the log. And each row is cryptographically chained to the one before it: alter a row, or delete one from the middle of the record, and the chain stops matching in a way that can be shown. We gave that machinery a full post of its own earlier in this series; consent is the property it exists to witness. A permission that leaves marks when it’s used is a different object from a permission that doesn’t.
Two gaps, stated plainly because this series has a policy of stating them. You can’t currently view your own audit trail — the log serves internal accountability, not yet your direct inspection. And your data export doesn’t include your audit history. Both gaps are real, tracked, and the same ones the audit-log post named. Until they close, the accurate sentence is: your consent is witnessed, and you’re trusting us to be the ones reading the witness.
The screen where you say yes
Consent machinery also includes the moment of asking, and we rebuilt ours recently, so this description is of the current system, verified against it.
When NexTier asks you to agree to something, you’re asked about the latest version of each document and only that — no stack of superseded versions to wade through, no re-agreeing to things that no longer apply. Each item is named in human language, not an internal code. Each one links to the actual document, and the link is checked against a single source of truth, so the thing you’re shown is the thing you’re agreeing to. And when terms change for providers, the consent screen includes a plain-language summary of what changed — because “we’ve updated our terms” with a 40-page diff isn’t disclosure, it’s camouflage.
None of that is heroic. It’s the minimum for the word consent to be doing any work at the moment it’s invoked: know what you’re agreeing to, in words you can read, with the current version in front of you. And it has a side effect worth wanting from any vendor: a company obliged to summarize its changes in plain language has to face what it changed. Machinery that informs you disciplines them.
The five-minute check, on anything
Here’s the test in runnable form, for any product you’re already using.
Open the settings and find sharing or privacy. First question, two minutes: is there more than one switch? Count the independent decisions you’re allowed to make. One master toggle means the granularity answer is no. Second, flip something off. Does the product tell you what that did, and when it takes effect? Vague copy around revocation (“changes may take time to propagate”) is worth noticing. Third, search the privacy policy for “access log” or “audit.” Silence doesn’t prove absence, but a company that built witnessing has every reason to say so — it’s expensive, and they’re proud of it.
A warm caveat before you run it, because this is a heuristic, not a verdict: the test reads a product’s consent machinery, and machinery isn’t the whole of trustworthiness. A small tool with one honest switch and no audit trail isn’t villainous — it’s under-built, which is information of a different kind. What the test reliably catches is the mismatch between ceremony and structure: a product that talks about your control at length and, on inspection, offers one checkbox, has told you what the talk is for.
The pattern of answers is the reading. And granularity, revocation, and logging are the kind of work a company documents when it’s done it — passing quietly would be strange, because the building was the hard part.
Saying yes like it means something
The checkbox survives because it costs nothing and looks like the real thing from a distance. Up close, the difference is structural: consent that can distinguish, reverse, and remember, versus consent that can only submit.
We’ve shown you ours with the seams visible — the switch-by-switch grants, the revocation stamp, the witnessed reads, and the two gaps we haven’t closed. The trust page keeps the standing account of the rest: what’s collected, what’s encrypted, what leaves, what we still owe. If you take one thing from this post, take the three questions — and feel free to aim them at us first. The five-minute check works on the people who taught it to you. That’s the point of teaching it.
—
This post is part of a series on how to evaluate apps that hold sensitive personal data. It describes NexTier’s provider-sharing consent as implemented at the time of writing, verified against the live system this session; the gaps named above are real and tracked. Educational content about evaluating software, not legal advice.