S0035RS3-T07-S0035-Z · Full risk code

Implicit Collection and Opaque Consent

隱含式蒐集與同意不透明

Design & Development
Risk Description

When an organization's application collects user behavioral data through background components for model training, with consent terms expressed only in general language; due to unmitigated control gaps, when the practice becomes public, users assert they were not adequately informed, triggering external stakeholder impacts and causing although formal consent exists, the organization still faces criticism over insufficient transparency and a loss of trust.

Framework Mappings

EU AI ActArt.10
NIST AI 600-1Data Privacy
ISO/IEC 42001Annex A.7.2、A.8.2
ISO/IEC 5338設計與開發
MIT AI Risk RepositoryDomain 2

Risk Treatment & Implementation Guidance

Replace blanket clauses with layered consent, listing training use separately with individual choice; Disclose in the interface which behavioral data background components collect and why, avoiding implicit collection; Periodically review consent language for comprehensibility, holding to substantive rather than formal notice