Most unicorns disallow this nowadays to prevent the headache Facebook had when IPOing (very explicit you cannot transfer shares without the companies consent clauses in contracts). Some do controlled tender offers which allow employees to sell some shares, but these happen at the behest of the company, not the employee.

Don't most options include right of first refusal and more, to prevent you from selling them on the private market?

Yes, but ROFR doesn't necessarily hurt you - it just slows down the deal. Also, the VCs who do this also structure the deal in certain ways to make the ROFR price unclear and therefore negotiable.

But, you're right, some start-ups are explicitly putting in an explicit "consent" clause into the ISO. Which I think is unfair, and kind of BS - certainly if such a clause were valid, that would drastically reduce the value of non-publicly-tradeable shares, and it would be nice if the IRS agreed =)

I was at a start-up -- that I co-founded, so I take some of the blame here in not realizing what another co-founder was baking into the cake, but at least I can warn others now -- where the company interpreted "right of first refusal" as "the person trying to sell shares must hire an outside auditor to determine FMV," and refusing to answer any further questions about whether the auditor would actually be given access to the company's books.

Many private companies, e.g. Uber, doesn't allow unapproved secondary selling of their shares.

can't you sell a future security on your shares though? This is a "promise" to sell at some point in the future, can't see how can this be prohibited.