Blog · Review Essay · Last reviewed June 19, 2026

Consent of the Networked and the Problem of Platform Power

Rebecca MacKinnon's Consent of the Networked is a pre-AI book that now reads like a governance manual. Its question is not whether the internet liberates or represses. It is whether people have meaningful civic standing inside the private and state systems that mediate speech, identity, privacy, commerce, memory, association, and delegated action.

The useful definition is concrete: networked consent exists only where people and communities can understand a system's rules, limit its authority, contest its decisions, leave with their records and relationships intact, and force accountable institutions to answer for harm. Anything less is consent as interface decoration.

The Book

Consent of the Networked: The Worldwide Struggle for Internet Freedom was published by Basic Books in 2012, with the current Basic Books trade paperback listing showing a 2013 on-sale date and 352 pages. MacKinnon came to the book as an international journalist, co-founder of Global Voices, China internet-censorship analyst, and digital-rights advocate; Ranking Digital Rights says she founded that project in 2013 at New America.

The book's central move is to translate "consent of the governed" into networked life. People increasingly live, speak, organize, remember, work, and transact inside systems whose rules they did not write, cannot easily inspect, and often cannot refuse without losing access to practical life. Those systems are operated by states, firms, standards bodies, payment networks, telecoms, app stores, cloud platforms, moderators, ranking models, and contractual alliances between public and private power.

That makes the book stronger than a period argument about "internet freedom." MacKinnon is not simply asking whether the network helps dissidents or censors. She is asking what legitimacy means when civil liberties depend on technical intermediaries. The publisher's description names the problem as one of "corporate sovereigns"; the useful reading in 2026 is to treat that phrase as an institutional diagnosis, not a metaphor.

Networked consent is not clickwrap. It is a continuing capacity to know, contest, exit, port, appeal, and participate in rule-setting for systems that mediate speech, identity, privacy, commerce, association, and public memory. A user who accepts a terms-of-service document may have agreed to a contract. That does not mean the user has meaningful authority over ranking, moderation, ad targeting, account suspension, data handover, identity verification, recommender design, automated enforcement, or algorithmic visibility.

MacKinnon's strongest point is that dependence drains ordinary consent of force. If a platform is the practical place where a small business reaches customers, a journalist finds sources, a dissident reaches allies, a migrant family receives remittances, or a community keeps its archive, then "leave if you dislike the rules" is not a serious democratic answer. Exit matters, but exit alone cannot govern a system that has become a route to public life.

This is why the book still matters after the first social-media era. Platform power is not only a matter of user preference or product design. It is private governance at public scale: rulemaking, enforcement, evidence, sanction, appeal, market access, identity, and visibility bundled into technical systems.

The important distinction is between consent as permission and consent as jurisdiction. Permission answers whether an interface collected a yes. Jurisdiction answers whether the institution had a legitimate basis to demand the choice, whether refusal was usable, whether the scope was limited, whether the record is inspectable, and whether the affected person can force review. MacKinnon's argument becomes stronger when read at that second level.

The Consent Stack

The sharper definition is that networked consent has layers. Information means people can understand which system is acting, what data it uses, and what rule it applies. Granularity means authority is separated by function rather than bundled into one vague acceptance. Reversibility means people can revoke, delete, appeal, or roll back consequential permissions. Portability means people can leave without surrendering identity, records, audience, or livelihood. Accountability means there is a responsible institution, not only an interface.

That stack turns consent from a legal fiction into an operational property. A platform that gives notice but no appeal has publicity, not consent. A service that allows account deletion but keeps network effects, work history, payment rails, or identity credentials locked inside its ecosystem has weak exit. An agent that asks once for broad access and then reads, writes, sends, buys, stores, or delegates later is not meaningfully consented to simply because the initial modal looked friendly.

The collective layer matters too. Users cannot individually negotiate recommender logic, app-store rules, cloud chokepoints, lawful-access processes, interoperability terms, data-broker markets, or platform mergers. Networked consent therefore needs law, standards, public-interest research, unions or associations, civil-society pressure, procurement rules, and regulator access. Personal choice is necessary, but it is too small for infrastructure.

A consent stack also needs a refusal record. Systems often document acceptance in meticulous detail while treating refusal, revocation, failed appeal, inaccessible export, or forced workarounds as invisible. That asymmetry matters because abuse usually appears in the negative space: what the user could not decline, could not discover, could not move, could not challenge, or could not prove after the system changed.

The Consent Impact Test

A useful test begins with a blunt question: what can this system make difficult, invisible, expensive, or irreversible for the person who depends on it? If the answer includes speech, audience, work, money, identity, evidence, reputation, memory, mobility, care, education, public benefits, or legal standing, then consent needs more than notice. It needs procedure.

The review questions are concrete. Authority: what powers are being granted, and are read, write, publish, spend, delete, infer, train, share, and change-permission powers separated? Asymmetry: what does the operator know about the user that the user cannot know about the operator's rule, model, ranking, or enforcement history? Dependency: what would the user lose by refusing or leaving? Record: what evidence is preserved when a decision, recommendation, moderation action, or agent action causes harm? Remedy: who can reverse the decision, repair the loss, or explain why reversal is impossible?

For AI agents, add one more question: can the system prove which authority it used for each action? A permission grant should identify the human or institution represented, the credential, the tool, the scope, the data touched, the destination, the confirmation gate, the expiry, and the log location. Without that chain, the user is left disputing a decision that was technically made "as them" but institutionally made by a stack they could not audit.

This test ties platform governance to the site's work on deceptive design patterns, notice and appeal, privacy and data, and research integrity. A consent record is weak if the interface was manipulative, the evidence trail is missing, the appeal path is decorative, or the user cannot tell which system acted. A governance process is weak if it can document acceptance but cannot document refusal.

Consent Failure Modes

The book is easiest to use if consent failures are named precisely. Bundled consent turns many unrelated powers into one acceptance. Asymmetric visibility lets the platform inspect the user while the user cannot inspect the rule, model, or enforcement history. Account hostage makes exit formally available but practically punishing because identity, income, contacts, archives, or reputation are locked inside the service.

Silent substitution changes a person's media environment, feed, recommendation path, or answer source without making the change contestable. Delegated ambiguity lets an app or AI agent act through a person's credentials without separating read, write, send, publish, spend, delete, and permission-change powers. Regulatory theater produces dashboards, notices, or transparency reports that cannot be used to challenge an actual decision.

Source capture is the AI-era variant: an answer engine, feed, or assistant compresses the world through sources, advertisers, internal policies, retrieval indexes, and ranking systems that the user cannot inspect. The user may consent to a service while never seeing the contestable choices that shape what counts as evidence. This is not a claim that the system thinks; it is a claim that the institution behind the system can route attention and proof.

Those failure modes matter because they turn consent into a one-way valve. People supply data, attention, work, identity, and authorization; the system returns access on terms that can be changed faster than ordinary users, workers, schools, publishers, or civil-society groups can respond. MacKinnon's civic vocabulary is useful because it refuses to treat that dependency as ordinary customer preference.

Private Sovereignty

MacKinnon is precise about the state-corporate entanglement. Governments pressure companies to remove content, disclose data, block services, localize infrastructure, or build surveillance interfaces. Companies write terms, shape product defaults, rank speech, sell ads, manage identity, and decide how much resistance or cooperation is worth the cost. The result is not a clean opposition between state censorship and private freedom. It is a negotiated control system.

That pattern has only become more legible. App stores decide which software reaches phones. Cloud providers and payment processors can make whole services fragile. Social networks and search engines shape discovery. Messaging services set encryption and interoperability defaults. Ad systems decide what kinds of persuasion can scale. Infrastructure owners can turn a policy change into a lived fact before courts, journalists, or users can make sense of it.

The point is not that every platform decision is illegitimate. Content moderation, fraud control, child-safety work, election-integrity work, privacy protection, spam defense, and security response are real necessities. The problem is legitimacy without procedure: opaque rules, unequal enforcement, no usable appeal, weak evidence, overbroad government demands, and business models that reward extraction while presenting dependence as choice.

The governance test for private sovereignty is therefore procedural. A state request, platform restriction, account lock, ad ban, marketplace delisting, identity demand, or data handover should have a legal basis or policy basis, a scope, a decision maker, a preservation rule, a notice rule, an emergency exception, a challenge route, and aggregate public reporting. Without those pieces, public power and private infrastructure can merge while both sides deny responsibility for the final harm.

The AI-Age Reading

AI systems sharpen the consent problem because they move platform power from hosting and ranking into interpretation and action. An answer engine may compress sources before the user sees them. A workplace assistant may summarize colleagues, tickets, records, and policies. A browser agent may read pages, choose tools, submit forms, and spend money. A personal agent may hold calendar, email, document, location, payment, and identity permissions at once.

The old approval screen was already thin. The agentic approval screen is thinner unless it decomposes authority by action. "Connect your account" can hide read access, write access, memory retention, downstream tool calls, data export, model-improvement terms, third-party connectors, and delegated authority to act later. Consent becomes theater when a friendly modal grants a system the practical ability to publish, purchase, message, delete, modify permissions, or leak private context through a tool chain.

This is where the book connects to the site's work on agent identity, agent tool permissions, AI browsers, agent stores, and the agent-native internet. The civic question is no longer only "who can remove my post?" It is also "who can act through my credentials, interpret my world, record my preferences, route my choices, and make a decision look like mine?"

The practical answer begins with agent architecture. Identity, authentication, authorization, revocation, logging, tool provenance, short-lived credentials, and scoped permissions become civil-liberties infrastructure once software can act through a person or institution. NIST's 2026 AI Agent Standards Initiative points in this direction by treating secure, interoperable agent systems as standards work around identity, trust, protocol security, and evaluation. That is MacKinnon's problem translated from platforms that host speech to agents that exercise delegated power.

Governance and Safety

The 2026 context is more concrete than the one MacKinnon wrote into. The European Union's Digital Services Act now supplies one version of platform accountability: rules for online intermediaries, special obligations for very large online platforms and search engines above 45 million monthly EU users, transparency around advertising, recommender systems, and content moderation, systemic-risk duties, and statements of reasons for moderation decisions. The Commission's DSA Transparency Database is an attempt to make those statements searchable and inspectable rather than private correspondence between platform and user.

As reviewed on June 19, 2026, the DSA Transparency Database displayed more than 2.3 billion statements of reasons submitted over its 180-day window, 331 active platforms, and a reported 40 percent share of fully automated decisions. Those numbers will change, but the snapshot shows the scale of the evidence problem: platform governance is no longer a handful of famous takedown disputes. It is an industrial record system for speech, commerce, accounts, and automation.

The Digital Markets Act attacks the neighboring bottleneck problem. The Commission describes gatekeepers as large digital platforms that provide core platform services such as search engines, app stores, and messaging services; the DMA's purpose is to make digital markets fairer and more contestable through obligations and prohibitions on those gatekeepers. That is competition law, not a bill of rights, but it reinforces MacKinnon's diagnosis: when an intermediary becomes a route to users, its private rules can become public infrastructure.

The Digital Services Terms and Conditions Database adds a quieter but important layer. It monitors platform contract and policy changes, including past versions, so researchers, regulators, businesses, and users can see when the rulebook shifts. That matters because consent can be defeated not only by a bad one-time choice, but by a dependency relationship in which the terms can change after the user has built a business, archive, identity, audience, or workflow around the service.

Digital-rights governance also has a mature civil-society vocabulary. Ranking Digital Rights evaluates companies against governance, freedom of expression, and privacy indicators, including human-rights due diligence, algorithmic-system disclosure, remedy, appeal, government-demand transparency, data collection, retention, and control. The Santa Clara Principles press the same procedural core for moderation: clear rules, notice, appeals, transparency, cultural competence, and attention to state involvement.

The accountability gap remains current. Ranking Digital Rights' 2025 Big Tech Edition evaluated 14 major digital platforms across 43 services and reported that no company scored above 50 percent overall. That finding is not a law, but it is a useful diagnostic: disclosure, appeal, due diligence, advertising transparency, government-demand transparency, and policy-enforcement evidence still lag behind the public role these systems play.

The DSA's newer transparency machinery shows both progress and limits. Statements of reasons, risk assessments, independent audits, researcher data access, ad repositories, and terms-and-conditions monitoring can turn platform power into inspectable records. But a record is not automatically a remedy. The democratic question is whether those records let affected users, researchers, regulators, journalists, and civil-society groups identify a pattern, challenge a rule, and force a change before the harm becomes normalized.

The EU AI Act adds a separate risk-based framework, with the main regulation applying from August 2, 2026 subject to staged exceptions. It does not turn every interface into a civil-rights tribunal, but it matters here because it treats transparency, high-risk uses, provider duties, deployer responsibilities, and governance as legal objects rather than product courtesy. For platform consent, the lesson is that AI rights impact must be attached to a deployer, provider, use case, record, and remedy path.

For AI systems, the closest operational translation is risk governance with a record. NIST's AI Risk Management Framework organizes AI governance around govern, map, measure, and manage functions. Applied to MacKinnon's problem, that means a platform or AI vendor should be able to answer practical questions: what system is deployed, whose rights can be affected, what data and permissions it uses, what decisions are automated, what evidence supports the risk assessment, who can appeal, who audits, how incidents are reported, and how a user or institution can leave without losing everything.

A useful platform-governance standard is therefore procedural, not utopian. It should require readable policies, rights-impact assessment, data minimization, meaningful opt-outs where feasible, interoperability and portability, independent audit access, researcher access where lawful and safe, public transparency reports, clear government-request channels, notice and appeal for restrictions, provenance for automated decisions, incident records, and vendor exit plans. For agents, add granular scopes, short-lived credentials, tool logs, revocation, human approval for consequential actions, and separation between read, write, send, publish, spend, delete, and change-permission authority.

The safety implication is that remedy is part of system design. A platform or agent that can affect rights, livelihoods, reputation, or access to services should preserve evidence for appeal, distinguish automated and human decisions, explain the rule applied, support independent review, and avoid turning user safety into a pretext for surveillance or forced identity collection. Under-governed systems leave people to private rule; overbroad controls can become censorship, lock-in, or monitoring. The democratic line is procedure with limits.

Where the Book Needs Friction

Consent of the Networked can sound too clean if it is read as a simple warning against governments and corporations. The harder lesson is that both under-governance and over-control can harm rights. A platform that refuses to moderate abuse can drive people out of public life. A platform that moderates without procedure can erase lawful speech, suppress organizing, or comply too quickly with state pressure. A state that ignores platform power leaves users to private rule. A state that overreaches can turn safety language into censorship, surveillance, or forced localization.

The book also predates the DSA, DMA, the EU AI Act, modern trust-and-safety practice, large-scale recommender regulation, generative-AI assistants, and agentic tool use. Some country examples and company names have aged. The structural question has not. In fact, the book's older frame is useful because it resists present-day hype: platform governance does not depend on speculative claims about machine minds. The problem is delegated power, dependency, opacity, and weak remedy.

The other limit is that consent can become a burden shifted onto the least powerful user. A worker, student, patient, applicant, tenant, creator, activist, or migrant may technically agree to a system while lacking any realistic alternative. In those settings, the right question is not "did the person click yes?" It is whether the institution had authority to demand the choice, whether the system was necessary and proportionate, whether a human path remains, and whether refusal is punished.

What This Changes

The practical reading is that consent must be made operational. If a system controls visibility, identity, access, memory, moderation, payment, model routing, or delegated action, then consent is not a banner, a checkbox, or a long policy document. It is a set of institutional affordances: know what is happening, restrict what is necessary, challenge what is wrong, export what is yours, inspect what is consequential, and revoke authority when the relationship changes.

That is why this review belongs beside The Master Switch, Cloud Empires, cyberlibertarianism, and The Net Delusion. The recurring pattern is not a mystical cycle. It is institutional displacement: publics move speech, work, records, and trust into a system; the system's owner then becomes a rulemaker.

The book's best question for the AI era is simple: where has consent been replaced by dependence? If the answer is an app store, model API, cloud region, social graph, identity provider, enterprise connector, content filter, recommender, agent marketplace, or vendor contract, then the work is not finished until there is governance, safety, contestability, and a path out. That is also an institutional rule: do not build an archive, chapter, care practice, or public record around a platform whose exit path, evidence trail, and rights process you have not tested.

The practical institutional version is a consent register. For any platform or AI vendor treated as infrastructure, record the system owner, data categories, permission scopes, affected rights, refusal path, appeal path, export path, retention rule, audit contact, incident process, and shutdown plan. A community cannot defend agency through vibes about openness; it needs an inventory of where authority actually sits.

Source Discipline

This article separates three evidence classes. Book facts come from the publisher, the official book site, and Ranking Digital Rights' author page. Current regulatory claims come from official European Commission, EUR-Lex, and DSA Transparency Database materials. Governance recommendations draw from Ranking Digital Rights, the Santa Clara Principles, the UN Guiding Principles on Business and Human Rights, and NIST AI RMF; they are not claims that any one law already requires every listed control in every jurisdiction.

The legal context is jurisdiction-specific. The DSA and DMA apply through EU categories and designation processes, not to every website in the same way. The AI Act adds a separate EU risk-based framework for AI systems. NIST AI RMF is voluntary guidance. Civil-society principles are standards and advocacy tools, not statutes. Keeping those categories distinct is part of the governance lesson.

Database and dashboard claims need snapshot discipline. A DSA database count, designated-gatekeeper list, company transparency report, or platform policy can change after review. Use the date, URL, jurisdiction, covered service, and source category when making claims from those materials. Do not convert a regulator's inquiry, a civil-society benchmark, a company disclosure, or a database entry into a finding of illegality unless the source actually says that.

This review makes no claim that any AI system is conscious, divine, or AGI. It treats AI agents, assistants, recommenders, and answer engines as institutional systems that route information and delegated action. Claims about their rights impact should be tied to deployment records, permissions, logs, policy documents, affected users, and appeal outcomes rather than marketing copy or abstract capability claims.

Sources

Book links are paid affiliate links. As an Amazon Associate I earn from qualifying purchases.

Buy on Amazon Browse Books

Return to Blog · Return to Books