Three Systemic Problems With the Privacy Notice Ecosystem

Privacy notices have become ubiquitous across digital platforms, yet they consistently fail to enable informed user choice about data collection and sharing practices. Despite decades of research and regulatory intervention—from GDPR to CCPA to industry privacy labels—users continue to ignore or misunderstand these notices. We identify three systemic problems that explain this persistent failure. First, the privacy notice ecosystem suffers from terminological chaos, where identical functions are described using inconsistent language, creating confusion rather than clarity. Second, privacy notices now serve conflicting masters: they must simultaneously inform users and provide legal cover for organisations, with compliance objectives consistently winning over usability. Third, the complexity of modern data practices has outpaced what any notice can meaningfully communicate, yet regulators and industry continue expanding the paradigm to new domains like IoT. These problems compound to create “regulatory theatre”— performative compliance that legitimates data extraction while failing to empower users. Rather than proposing solutions, we argue that these structural contradictions reveal fundamental questions about whether the notice‐and‐choice paradigm can function in contemporary digital ecosystems. Future research should prioritise designing privacy communication tools based on actual user behaviour— quick decisions using heuristic cues—rather than comprehensive technical disclosure.