The Business Model Runs on Nonconsent
Written with legal analysis by Heath Morgan, Attorney and Corporate Counsel
The full cases are listed at the end.
Meta has dropped the price of its camera glasses to 299 dollars and attached Kylie Jenner's name to them, and the coverage has gone back to asking whether people are ready to wear a computer on their face. Seven million units sold in 2025. Guess that answers the question. I honestly don’t care about who bought them. I’m more interested in the person who didn’t.
Every sale involves two people and only of them agreed. The buyer clicked through the terms, accepted the policy, and knows roughly what the device does. However thin that agreement is, it was his to give. The other person is across from him in a coffee shop, or next to her on a train, or even living in the same house. That person signed nothing. There is no checkbox that would have reached them, no interface that could have been declined, no moment at which anyone was asked. This person is not a user. Rather, the input.
Meta's answer, when the question is put to the company, is that it falls to individuals not to actively exploit the technology. That is a claim about character, and it is the wrong kind of claim, because the value of the device does not depend on the wearer's intentions. It depends on the people around not knowing. A phone announces itself. You watch it come up, and you can step out of the frame or ask to stop being recorded. Glasses are built so that no such moment occurs. The indicator is a small light most people miss or read as Bluetooth, and recording starts with a gesture or a spoken word rather than the visible act of raising something to eye level. Covertness is the feature. A version of these glasses that reliably announced itself would be a worse product.
Film production has dealt with recording people who did not ask to be recorded for much of the century. In this situation, crowd release notices are often posted at the entrance, individuals sign releases for extras, notifications are required for residents near a location, and there’s a general doctrine that protects an incidental face in a crowd as long as no individual is singled out.
This is the floor for a bounded production with a known purpose and a visible camera. The glasses have none of it. No notice, no release, no defined production, no purpose with a terminus, no way to decline a device indistinguishable from eyewear. Film's consent machinery at least concedes that the person in the frame has a claim to be asked. The glasses start from the premise that asking would ruin the product.
What the Footage Becomes
Capture is the front end of something else. In March 2026 a class action, Bartone v. Meta Platforms, alleged that footage from the Ray-Ban glasses, sold under language promising privacy and user control, was being transmitted to third-party contractors for AI training review. Swedish reporting the previous year had already identified a Kenya-based subcontractor reviewing unredacted first-person footage, including footage of children and of intimate activity inside people's homes. So the sequence runs capture, transmission, human review on another continent, model training, behavioral profiling in an advertising system. The bystander appears nowhere in it as a party. She appears as material.
And the injury is not that a moment of her life was recorded, since strangers have been recording moments of other people's lives since the snapshot. The injury is what the recording feeds. A photograph asserts that a person was in a room. An inference asserts what she is, and increasingly what she will do, in a form that can be retained, compared against a population, revised as the models improve, and acted on by parties she will never identify. That is the architecture the business model actually needs, and consent was never going to be its constraint, because the thing being collected was never the thing the consent form you click ‘yes’ to describes.
Morgan’s account of the legal position comes down to two findings, one of which reorganized how I think about the whole problem.
The statutes that exist are aimed at the wrong act. Twelve states require every party's agreement before a conversation is recorded, and glasses with continuous audio can breach those rules without difficulty, though no published decision has yet applied a wiretap statute to a worn device. Illinois's biometric statute is the strongest instrument in the field and has produced the largest settlements anyone has seen. Right-of-publicity cases have established that a face captured without permission and fed into a revenue-generating system is a commercial asset taken without payment. But each of these was written for a discrete, intentional act by an identifiable actor against an identifiable person, and none of them contemplates a device worn by millions, recording continuously, processed by contractors, monetized through profiling, where the person in the frame is never named and is nonetheless read.
In Carpenter, the Supreme Court accepted that aggregated observations of a person's public movements expose her associations, and that she keeps a privacy interest in the aggregate even though each observation happened in public. Carpenter binds government actors. Nothing has carried the aggregation principle across to private parties, and Morgan's statement of the consequence is the sentence I keep returning to: a bystander recorded once has no recognized claim, and a bystander recorded a thousand times by a thousand devices, with the results aggregated and profiled and sold, has no recognized claim either, because no doctrine yet distinguishes the two. The business model does not run on any single recording. It runs on volume, and the law is built for individuals.
Consent as a defence is meanwhile eroding from several directions at once, and Morgan is careful that no court has yet held it void where a system's purpose is to make the consenting party more predictable. Courts have refused to enforce terms buried where a reasonable person would miss them, and have voided oppressive take-it-or-leave-it terms as unconscionable. The FTC has treated manipulative interface design as unfair whether or not anyone clicked agree, and has extracted settlements large enough to change behavior. Three states now legislate that agreement obtained through a design that subverts a user's autonomy is not consent at all, with the test turning on the effect rather than the company's intent. The scholarship arrived earlier and went further, holding that consent is structurally unavailable once a system is built to locate and trigger an individual's specific frailties.
Where This Reaches Children
The FTC's unfairness test asks, at its second prong, whether the injury was reasonably avoidable by the consumer, and smart glasses are a stronger case on that prong than any interface manipulation the Commission has ever pursued. A subscriber trapped in a cancellation flow can, with enough patience, get out. The maze is hostile, but it exists, and one can theoretically follow a string to get out. A person sitting in a restaurant has no maze. No interface, no setting, no notice, no knowledge that anything is occurring. The unavoidability is structural rather than the residue of a badly built checkout. There is nothing she could have done differently.
A child cannot avoid the injury either, and she has one more layer of nothing between her and the pipeline: the adult who might have acted for her cannot validly do it.
The question that decides this one belongs to her parent. Many things fall inside a parent's authority. She authorizes surgery, anesthesia, vaccination, schooling, religious formation, and the removal of her daughter's tonsils, without asking and often over objection. Invasiveness is plainly not the line, since a surgeon opens a body. But there is a short list sits outside parental authority entirely. The age of sexual consent is not waivable by proxy, and a parent's agreement there is an aggravation rather than a defence. The drinking age and the smoking age cannot be signed away. Most jurisdictions will not let a parent authorize a tattoo. There are floors under marriage and paid labor that no permission lifts. Those acts are barred even with parental consent.
What unites them is that each reaches past the child in front of you and takes something from the adult she is going to be. Joel Feinberg called these rights in trust, held on behalf of the future adult, exercisable by nobody in the interim and extinguishable by nobody either, and argued that parental authority runs out where a decision would close options belonging to the person the child becomes. Dena Davis applied the reasoning to genetic testing of children for adult-onset conditions, where the striking feature is that nothing is done to the child at all. A cheek swab is trivial. What gets generated is information about a person who will one day have views about whether she wanted to know, by which point the knowing has happened and cannot be undone.
This is why the appendectomy is not a counterexample. That is a duty owed to the child for their current self, exercised in her interest, and the surgeon acquires nothing that outlives the operation. Designating a company the controller of a decade of behavioral inference about her is a different act, and control rather than ownership is the right word for what changes hands, since that data is not owned in most jurisdictions.
The paid version of this is now a consumer category. Nanit has cameras in about a million homes, mounted above the crib and pointed straight down, and has raised fifty million dollars to extend the observation into speech, language, and motor development, and to keep the camera in the room into early adolescence. Its chief executive describes the company as the children's counterpart to the rings and bands adults wear, like an Apple Watch. Its chief technology officer told the New York Times this month that he wonders whether a child's introversion at four might be readable in the way she moved in her crib as an infant, and that this "doesn't have to be a bad thing." The kit runs four hundred and seventy-four dollars with about a hundred a year after that, which I find particularly odd…The parent is paying, and is still supplying the asset. The company says the data is not sold, and I have no reason to dispute that, yet the record does not have to be sold to be the substrate that the fifty million was raised against.
Continuous observation during the years when a person is assembling her habits of attention and inquiry is not the same event as continuous observation of an adult who already has them, and the developmental research on how being watched changes exploratory behavior is where that case gets built. The violation is complete at the transfer, whatever the developmental evidence eventually shows, because an interest belonging to a future adult was assigned to a third party by someone with no standing to assign it. What the developmental case adds is the reason the interest is worth protecting at all: the freedom to think without being read is the precondition for the mental self-determination the adult will need, and it is being traded away during the window in which it is still being built.
What We’re Asking For
The Children's Online Privacy Protection Act runs almost entirely on verifiable parental consent. Its enforcement machinery, its safe harbors, and its operating logic all begin from the premise that a child cannot agree to the collection of her own information, and the answer it supplies is that her parent will agree instead. The statute identifies the precise incapacity and resolves it by handing the authority to the one party whose interests align with the child's in every respect except this one. A parent who badly wants to sleep is not a disinterested guardian of her daughter's future informational autonomy, and no statute should have assumed otherwise. COPPA is the mechanism of proxy authorization.
None of this is a defect the next privacy update corrects. The capture is what is being sold, and manipulation is an accurate description of the engagement optimization that hooks the buyer. Mental self-determination and a business model paid by prediction cannot both be optimized. One of them gives, and the incentive decides which.
So the remedy is not a better consent flow, a clearer disclosure, or an age gate on a settings page, since each refines a permission that should not be on offer. For adults, the missing piece is some translation of the aggregation principle into a framework that binds private parties, so that the thousandth recording is legally different from the first. For children it is narrower. There should be a class of inference about minors that no party may lawfully generate, whoever agrees to it, and parental agreement should be as inoperative there as it is at the age of consent. Parents aren’t careless, yet the consent they are giving was never theirs to give.
The buyer of a pair of glasses agreed to something. So did the parent who mounted the camera above the crib. Neither was in a position to agree on behalf of the person the device was actually pointed at, and in one of those two cases, that person will grow up, and will not get to revisit it. The record will already exist. The inferences will already have been drawn. Who is signing it over?
Timothy Cook is Director of The Cognitive Privacy Project and author of the "Algorithmic Mind" column at Psychology Today. He is Securiti Certified in AI Security & Governance.
Contact: timothy@cognitiveprivacyproject.org Web: cognitiveprivacyproject.org
© 2026 Timothy Cook / The Cognitive Privacy Project. All rights reserved.Licensed under CC BY-NC-ND 4.0. You may share this work with attribution. Commercial use and derivatives require written permission.
Works Cited
Cases
Bartone v. Meta Platforms, Inc., No. 3:26-cv-01897 (N.D. Cal. filed Mar. 4, 2026).
Carpenter v. United States, 138 S. Ct. 2206 (2018).
Fraley v. Facebook, Inc., 830 F. Supp. 2d 785 (N.D. Cal. 2011).
FTC v. Ring LLC, No. 1:23-cv-01549 (D.D.C. May 31, 2023).
FTC v. Rite Aid Corp., No. 2:23-cv-05023 (E.D. Pa. Dec. 19, 2023).
Heckman v. Live Nation Entertainment, Inc., 120 F.4th 670 (9th Cir. 2024).
Hepp v. Facebook, Inc., 14 F.4th 204 (3d Cir. 2021).
In re Clearview AI, Inc., 585 F. Supp. 3d 1111 (N.D. Ill. 2022).
In re Social Media Adolescent Addiction/Personal Injury Products Liability Litigation, MDL No. 3047 (N.D. Cal. filed Oct. 6, 2022).
Keebaugh v. Warner Bros. Entertainment, Inc., 100 F.4th 1005 (9th Cir. 2024).
Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014).
Patel v. Facebook, Inc., No. 3:15-cv-03747 (N.D. Cal. Feb. 26, 2021) (order granting final approval of class action settlement).
R. v. Jarvis, 2019 SCC 10 (Can.).
Sanders v. American Broadcasting Cos., 20 Cal. 4th 907 (1999).
Shulman v. Group W Productions, Inc., 18 Cal. 4th 200 (1998).
Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002).
Statutes and Regulatory Materials
Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (2008).
Cal. Civ. Code § 3344 (West 2024).
California Consumer Privacy Act, Cal. Civ. Code § 1798.140(l) (West 2020).
Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 (1998).
Federal Trade Commission. (2022, September). Bringing dark patterns to light.
H.B. 410, 2026 Reg. Sess., Act No. 965 (La. 2026).
Restatement (Second) of Torts § 652B (Am. L. Inst. 1977).
S.B. 1130, 2025–2026 Reg. Sess. (Cal. 2026).
Video Voyeurism Prevention Act, 18 U.S.C. § 1801 (2004).
Scholarship and Reporting
Calo, R. (2014). Digital market manipulation. George Washington Law Review, 82(4), 995–1051.
Davis, D. S. (1997). Genetic dilemmas and the child's right to an open future. Hastings Center Report, 27(2), 7–15. https://doi.org/10.2307/3527620
Feinberg, J. (1980). The child's right to an open future. In W. Aiken & H. LaFollette (Eds.), Whose child? Children's rights, parental authority, and state power (pp. 124–153). Rowman & Littlefield.
Khan, L. M., Levine, S. A. A., & Nguyen, S. T. (2025). After notice and choice: Reinvigorating "unfairness" to rein in data abuses. Stanford Law Review, 77(6), 1375–1429.
Maheshwari, S. (2026, August 2). Aw, it's baby's first A.I. surveillance system. The New York Times.
Richards, N., & Hartzog, W. (2019). The pathologies of digital consent. Washington University Law Review, 96(6), 1461–1503.