sure, but it’s essentially a social/legal problem, not a technical one. the onus is on the company holding data to show the chain of consent, which doesn’t require anything fancy outside a purpose-built database.

So how does that work then? How does Google prove that I clicked that accept-EULA button? Or that I approve of them keeping track of my information? I never put my signature anywhere and still there are companies holding or even trading my information.

> it’s essentially a social/legal problem, not a technical one

And ironically, it's the tech companies who are getting away with it.

right, that’s the social/legal problem, that consent is assumed, and i’d argue, coerced. bundling like this is actually an anti-trust concern, because it’s using power in one market (for instance, search) to exert control in another (data brokerage), but we’ve collectively lost sight of this being a problem.

but yes, they should be required to get your unambiguous consent for data sharing separate from any other transaction, otherwise it shouldn’t be considered consent.

For software that doesn't require you to click a EULA button or change a value in a EULA file to acknowledge you agree to the EULA, they can just make it part of the Terms Of Service that you inherently agree to by using their software/service.

There is no technical solution to this problem. First parties can just lie or use dark patterns to gain permission.

Look, if some authority finds your personal information on some server, and they can't produce your digital signature on a contract which says that the company can keep the information from some date to some other date, then they are in violation. It is simply not possible to lie about it.

https://en.wikipedia.org/wiki/Digital_signature

Now every person needs to have a government-verified signing key, and suddenly consent given on disparate sites can be trivially linked to the same public key that verifies it...

Why does there need to be only one public key per user?

The authorities only have to look at the leaked information, contact you, and ask you to generate proof that you signed the contract.