Notice and choice has been the backbone of American privacy practice for decades. Tell people what you collect and why, and let them decide. It is a reasonable idea, and it was failing long before anyone deployed a large language model.
In 2008, Aleecia McDonald and Lorrie Faith Cranor estimated that reading the privacy policies a typical American encounters would take about 201 hours a year. They valued that time at roughly $781 billion annually. Nobody reads them, and nobody could.
Regulators said so too. In its 2012 privacy report, the Federal Trade Commission wrote that the notice-and-choice model had “led to long, incomprehensible privacy policies that consumers typically do not read, let alone understand.” Two years earlier, an FTC commissioner told an IAPP audience that the theory “seems sound on its face, but it has proven unworkable.”
AI did not create this problem. It made it impossible to ignore.
A notice describes purposes known at the time of collection. AI systems generate purposes after the fact. A model trained for one task is reused for another. An assistant draws conclusions about a person that nobody designed it to draw. An agent combines data from systems that were never meant to meet.
No notice written at collection can describe those uses, because nobody knew them yet. A notice that tried would either be so broad it says nothing, or so long that it repeats the 2008 problem many times over.
The law still requires notice, and it should. California requires a business to inform consumers “at or before the point of collection” of the categories of personal information, the purposes, and whether the data is sold or shared. The regulations describe the purpose of that notice as giving consumers “a tool to exercise meaningful control.”
But California has also started to move weight off notice and onto accountability. Its risk assessment rules took effect on January 1, 2026. Before certain processing begins, including selling or sharing data, processing sensitive data, using automated decisionmaking for significant decisions, and some model training, a business must assess the benefits and the risks. Where the risks outweigh the benefits, the processing should be restricted.
Processing that was already running before 2026 must be assessed by December 31, 2027. Businesses submit information about their 2026 and 2027 assessments to the regulator by April 1, 2028. That is a different model of protection. It does not depend on whether anyone read anything.
The practical shift for a privacy office is to stop asking notice to do two jobs.
Notice should be honest and readable about what the organization knows today. That is its job, and it still matters, because a misleading notice is a deception problem.
Protection has to come from somewhere else: decisions recorded before data is used in a new way, assessments that weigh risk against benefit, and limits that hold whatever a privacy policy happens to say. A person should be protected from a harmful use even if they never read the notice, because almost nobody does.
- Write notices for what is known, in plain language. Resist the urge to future-proof a notice by listing every conceivable use. A notice that covers everything informs no one.
- Add notice where AI meets the person. A short notice at the moment someone uses an AI feature, or is affected by one, does more than a paragraph in a policy they accepted years ago.
- Make the assessment the control. Every new AI use of personal data gets a recorded assessment before it starts, whatever the notice says.
- Track the gap. Keep a list of AI uses that the current notice does not clearly describe. That list is your risk register for deception claims, and your agenda for the next notice revision.
I hold my own AI operation to this standard, and it does not always meet it. One known defect in the tooling I use to start and stop agent sessions is, for now, handled by a written instruction: a step a person has to remember before each run. That is notice carrying the weight, and I count it as the weakest safeguard I have.
The opposite failure taught me something too. An agent once read a written instruction as a prohibition it never stated. It took a recorded decision, not a longer instruction, to settle what the words meant. Both failures point the same way: words on a page, read or misread, are a thin safeguard, and the recorded decision is what held.
Notice belongs at collection and at deployment, where people meet the system. Accountability belongs at every stage in between: sourcing, training, deployment and monitoring. The mistake is to treat the notice written at collection as covering everything that happens downstream.
- 1.Which AI uses of personal data are we running today that our notice does not clearly describe?
- 2.Where does a person actually encounter our AI systems, and what do they see at that moment?
- 3.For each AI use, is there a recorded assessment that would hold up even if no one had read the notice?
Notice and choice was always more of a promise than a protection. With AI, the honest move is to keep the notice truthful and put the protection where it belongs.