“But they Consented to Getting Conquered!”
Comparing Consent Banner to Methods of Spanish Conquistadores
While studying the Spanish Conquista of Mexico, I kept coming across the “Requerimiento”, a self-absolving legalistic practice that asked the natives to “consent” to being conquered… Sounds absurd? Well, that’s why it immediately reminded me of a post-modern practice that often feels just as Kafkaesque: Consent Banners!
Prelude
First, let me get one thing out of the way: It is obvious to me that the damage done by conquest and enslavement is a million times worse than the damage done by consent malpractice! But there are similarities in terms of the methods used. As a history fan, I believe that we can see the absurdity of today’s reality with different eyes when we compare it to historical events from another era.
Second, I am aware that there are vast differences in how organizations both present consent choice and to which degree they respect that choice. Many really do mean well and undertake great care in ensuring legal and ethical compliance. But for many, the consent “choice” is a mere self-absolving fig leaf.
The most fascinating culture clash in history
One of my private interests is Spanish history. One episode that has long fascinated me is the Conquista, which started in 1492 with Columbus “discovering” America. Not even 30 years later, it culminated with the submission and ensuing destruction of the empire of the Mexica (later known as Aztecs) in 1521. The collision of maybe the most “advanced” cultures of Europe and the Americas (apart from maybe the Inca) bore fruit to so many breathtaking stories, stories which read like fairy tales or chivalric romance — just that they really happened.
Last year, I felt the urge to read up on many of these stories. I made my way through Conquistador Bernal Díaz’s—at first breathtaking but ultimately rather repetitive—True History of the Conquest of New Spain. I read native accounts collected and translated by Miguel León-Portilla, as well as some recent literature to put it all in perspective. I mention this just to show that what follows is not just based on some ChatGPT + Wikipedia “research”.
“Advanced” Cultures?
I wrote “advanced” cultures (in quotation marks), because it feels wrong to call a culture advanced which publicly sacrificed thousands of humans, including children, every year. While human sacrifice was common throughout the area, nobody sacrificed as much as the Mexica in their capital Tenochtitlan (now Mexico City). While the sacrifices were originally a religious ritual, the Mexica took them to another level as a means of oppression. No wonder the Conquistadores found plenty of native allies: the many enemies of the Mexica. The tiny “Christian” force of roughly a thousand soldiers would have not stood a chance against the millions of natives otherwise.
But calling the Spaniards an “advanced culture” feels even less appropriate given the countless accounts of excruciatingly bloody massacres of the native population. These, combined with the even more devastating introduction of smallpox, led to the deaths of up to 90% of the natives.
The Requerimiento: “It’s your choice, dear Indios”
A particularly absurd aspect of the annihilation the invadors brought upon the natives was the Requerimiento. This was a declaration by the Spanish monarchy that was read aloud to the natives (and this reading was officially protocolled). It informed them of the monarchy’s “divine” rights to conquest. It asked the natives to “consent and give place that these religious fathers should declare and preach to you”, in other words: They should submit themselves to the Spanish Crown and allow Catholic priests to spread Christianity.
If the natives did not consent (i.e., if they did not submit themselves immediately, but instead started hostilities — like taking to arms, keeping up their “pagan” traditions or refusing to replace their “idols” by statues of Mary (no kidding🤐), the Spaniards had legal ground to fare with them at will (e.g., kill them or enslave them). Quote:
”We emphasize that any deaths that result from this [rejection of Christian rule] are your fault…”.
Need I mention that the Requerimiento was read to the natives in Castilian (Spanish)😵? But even for the later years when there was a translator, I doubt they understood much.
From Wikipedia:
“A member of the conquistador’s force would read El Requerimiento in Castilian before a group of Indians on the shore, who, with or without translation, remained uncomprehending. All the region’s inhabitants were thus considered to have been advised of Spain’s religious and legal rights to conquest and forewarned of the consequences of resisting. The true nature of the [Requerimiento], however, was one of absolution; the symbolic act of reading the document relieved the crown and its agents from legal and moral responsibility for the conquest, enslavement and killing of Native Americans. Readings were often dispensed with prior to planned attacks.”
And it gets even more absurd:
“In some instances, it was read to barren beaches and empty villages long after the indigenous people and communities had left, to prisoners after they were captured, and even from the decks of ships once they had just spotted the coast.”
Before invading America, the Spanish had fought a war against the Muslims during the so-called “Reconquista” of the Iberian Peninsula (concluded in 1492). That war had been seen as “just” because the “Moors” had known and “chosen” to reject Christianity. But the Native Americans, so the Spaniards believed, resisted conquest and conversion for one of two reasons: malice or ignorance. The Requirement was meant to make sure ignorance wasn’t the reason.
Get Lukas Oldenburg’s stories in your inbox
Join Medium for free to get updates from this writer.
While Consent Banners arose from the need to justify the long-standing collection and abuse of personal data, the Requerimiento arose because of the need to legally justify long-standing abuse of natives that had started with Columbus setting foot on the Caribbean (Columbus was one of the most brutal enforcers of slavery, by the way). The Spaniards kinda understood though that this treatment was not exactly the most “Christian” thing to do, just like modern Marketers kinda know that what they are doing is not the most ethical thing in the world. So both were searching for a “save-my-ass-in-court-and-ideally-from-hell-too” practice.
Requerimiento vs. Consent Banners
And here we are at our comparison with Consent Banners. While the consequences of “choosing” to “accept all” is by no means comparable to what the natives faced when “choosing” to reject the Requerimiento, there are many parallels in the absurdity of the methods:
1. It is in a language nobody understands
While the Spaniards read the Requerimiento in Spanish to people who did not know any Spanish, today’s privacy statements at least pretend to be in my language. Pretend! Because I guess anybody who has tried to actually read a privacy statement — even lawyers! — will agree that it is usually impossible to understand what really happens to their data.
2. It pretends to be in your best interest
“Your privacy is important to us” must be the most frequent internet lie after “I have read and understood the terms & conditions”. Similarly pseudo-benign, the Requerimiento details the wonderful world that the Spaniards want to bring to the “pagans”:
If you do [consent], you will do well, […] and we […] shall receive you in all love and charity, and shall leave you, your wives, and your children, and your lands, free without servitude, that you may do with them and with yourselves freely that which you like and think best […]. And, besides this, their Highnesses will award you many privileges and exemptions and will grant you many benefits.
The reality could have not been further from the truth, of course. And unfortunately, anyone working in the Digital Marketing industry knows what really happens when somebody “chooses” to click “Accept All”. Few of which can be justified as being in the best interest of the user. Or can sharing everything you do on a website with the likes of Meta, Tiktok, Google, Criteo & and even data brokers or national security agencies be in the interest of anybody?
To be fair, much like Consent Banners, the Requerimiento originated from humanist concerns aimed at protecting natives from excessive exploitation and mistreatment. However, as with Consent Banners, the practical realities of the time — then driven by the demands of conquest and now by the relentless pursuit of data for monetization — reduced its implementation to little more than a farce.
3. Blank check consent — “choosing” without knowing what
I write “choice” in quotation marks because, while it is legally a choice, I have a hard time considering it an actual choice when I don’t have any clue what I “choose”. The Indians had no clue what was being read to them (if they were lucky enough to hear it at all).
Similarly, today, even if a privacy statement is written in a reader-friendly manner, it’s impossible to predict where your data will ultimately end up or how it will be used. The most glaring examples are those consent banners that ask you for “consent to cookies”, but you are consenting to far more than just that.
So consent is usually a blank check, one that can later be exploited to justify almost anything. For example, a representative of Converto (an ad network) cited “consent to cookies” as the basis for a marketing scheme by them and agency Rocket Mountain where people’s cookies were synchronized with cookies from other websites until they found a match to a postal address (check minute 7:35 and following, podcast in German). This allowed them to send physical advertisements — like one featuring a witch on the cover — to promote the Swiss discounter Denner. Of all things, a witch...🤐
4. Using every loophole possible to get consent
Just as the Spaniards read the Requerimiento in an unknown language to the natives, delivered it on empty beaches, in abandoned villages, or even while still on ships, today we exploit many loopholes to obtain consent — or simply force it. In Switzerland, most sites still use a mere “Hi, we’re using cookies” info banner, and consent for the Converto/Rocket Mountain scheme in the previous paragraph was partially obtained through the typical “by visiting the website, you are giving consent” scheme.
Moreover, we’re all familiar with dark UX patterns in Consent Banners designed to make users accept as much as possible (I am not without guilt here either).
5. Nearly impossible to control or enforce legally
Even though the Conquistadores did as they pleased, Cortés showed a shrewd ability to make everything appear legally sound. Some of them, including Cortés, were later put on trial later for their massacres and law-bending, but only long after their damage had been done (which feels a bit like the default behavior of American Big Tech). Few were reprimanded seriously even then.
Even when the Spanish laws were “humanized” on paper later, enforcing them on the other side of the ocean was near-impossible. While the natives eventually learned to voice their grievances — even appealing to the Spanish king directly — their complaints were largely in vain. Ever tried to file your GDPR complaints to an American company? You can be happy if you even get any response at all.
Thus, enforcement is the biggest problem of all the privacy frameworks. Yes, there have been a few heavy GDPR fines, but there are also many countries which do next to nothing. All in all, fines are rare — just 2248 fines in total since GDPR was introduced in 2018 (as of Jan 25, 2025). Contrast that to the roughly 32 million businesses in the EU, and the average chance that you get fined in seven years is almost zero. As long as you are not under special scrutiny, because you are a really big enterprise or a government institution, it is unfortunately often the economically better strategy to do as little as possible (just so much to not raise a fuss).
To this comes the intransparency that has arisen with Server-Side Tag Management. If you really want to disrespect user’s privacy, Server-Side — ironically often heralded as “better for privacy” — makes just that possible. Other than through whistleblowing or outright spying, there is no way for a law enforcer to see what is really going on in your Server-Side Tag Manager. No wonder Google, Meta and other “benign” actors have been pushing clients to move to Server-Side implementations.
There are many more similarities, like the fact that the conquest of America was literally the “Wild West”, while the privacy practices (or the lack thereof) on the internet were figuratively often called the “Wild West”, before some activists and growing legal concerns finally forced some legality. But let’s keep it at that little list above. It is sarcastic enough.
So what should we do now?
The whole consent situation is absurd. The lack of enforcement makes it economically less attractive to be compliant for way too many. I frequently hear: “Why should we be the model student for privacy if our competitors aren’t doing that?” My belief is that this will only change if we find a way to actually enforce the laws, but that has become a severe problem not only in the privacy sector. Many laws are more reflective of what lawmakers think should be enforced, and not whether it actually could be enforced.
The other question what that means for our economies in the global competition, because Europe seems to be falling behind to the rest of the (less privacy-interested) world, and part of that could be due to overregulation. Privacy does not seem like the only well-meant legal concept that has a hard time actually getting enforced. So as much as I wish we could drown out consent malpractice, I do understand why many organizations engage in it. And again, with consent malpractice I don’t just mean sharing personal data without consent — that has indeed improved. My main problem is with what happens if you do click “Accept All”, and the strange concept of “choice” at the root of that.
For now, we should at least try to keep the damage to a minimum by using technologies that compromise as little personal user data as possible (an example could be matching Google Ads via gclid uploads instead of donating all your email hashes of all your conversions to Google or keeping Criteo real), and we should at least double-question the stuff our clients want to implement because the Microsoft, Google, or Facebook Ads account manager told them so.
Subscribe to read first, and free
Thanks for reading, and do subscribe to get my new articles right into your mailbox. No Medium paywall. 😉
