Imagine that you are navigating your hospital’s online patient portal for the first time. Before you can view your test results, you are presented with a consent form that runs for several pages. It references legitimate interests, sub-processors, and secondary use of of your health data for research and innovation purposes. There is also a link to the full privacy notice with more detailed information. You click “Accept”, not because you have read and understood what you are agreeing to, but because you need to see your results, and that is the only way forward.
This is not an unusual phenomenon. It is the designed experience of most digital health consent across the European Union. The GDPR’s promise of informed, freely given, and meaningful consent is frequently unkept in practice. It is not because organizations are acting in bad faith, but because the consent architecture is built for a user who does not reflect the full range of people it governs.
What the Law Promises
The General Data Protection Regulation (GDPR) sets a high standard for consent. It must be informed, meaning that individuals must be provided with key information in clear and plain language; it must be specific, providing the data subject with detailed information on data processing activities instead of vague or blanket approvals; it must be freely given, respecting the autonomy and free choice of all the data subjects; it must be unambiguous, meaning that pre-ticked boxes and inferred consent do not suffice. These requirements reflect a genuine commitment to individual autonomy and self-determination grounded in the EU Charter of Fundamental Rights. The problem is not the standard itself. It lies in whether the infrastructure of consent, as currently designed in digital health settings, can deliver it, particularly for those who rely most on the healthcare system.
The Dual Literacy Gap in Digital Health
Meaningful consent in digital health does not require one form of literacy, but two distinct literacies simultaneously. The first is digital literacy: the capacity to understand how digital systems work, how data flow between platforms, and how to navigate an opt-out mechanism. The second is health literacy: the capacity to understand the clinical significance of one’s health data, and to make an informed judgement about the trade-offs involved in secondary data use. Together, these form what this post calls the dual literacy requirement embedded in the structure of digital health consent.
A patient may possess one without the other. A person may be highly digitally capable but have no understanding of what their health data contributes to a commercial diagnostic model. Another may have deep health knowledge through years of managing a chronic condition but lack experience navigating digital health systems and online consent interfaces. Genuine consent requires both, and current data protection law assumes their presence without specifying how they are to be ensured.
This is not a marginal issue. According to the European Commission, approximately only one in three adults over 65 possess basic digital skills. Health literacy deficits are widespread across all age groups and socioeconomic backgrounds. The population with simultaneously low digital and health literacy is large, demographically predictable, and disproportionately composed of people most dependent on healthcare systems. For this group, the digital health consent architecture fails completely.
A Regulatory Architecture that Compounds the problem
Other EU instruments governing digital health data rest on the same foundational assumption and extend its consequences.
The European Health Data Space Regulation (EHDS) grants individuals the right to opt out of secondary use of their health data, a mechanism described as “simple, reversible, and transparent.” (Article 71) Different from the consent mechanism, opt-out operates as a default-in system, where data is processed unless the individual actively objects. In practice, exercising the opt-out requires a state-issued electronic ID, access to a national digital health portal, and sufficient comprehension of what secondary use means in the context of health research. For a significant number of EU citizens, none of these conditions are met. The right is formally universal, but its exercise is structurally conditional.
The EU AI Act classifies certain AI systems used in health settings as high-risk and mandates transparency and human oversight obligations. This framework, this framework similarly assumes that patients and clinicians can meaningfully engage with explanations of algorithmic decision-making. Transparency requirements that generate information no one in the room can interpret deliver procedural compliance without substantive protection.
Taken together, the emerging architecture of EU digital health law is technically sophisticated yet practically fragmented. Those with the literacy to navigate it are formally empowered. Those without it receive only the appearance of protection.
What the Literacy Gap Produces in Practice
Consent without Comprehension. When patients click ‘Accept’ on a form they cannot fully understand, GDPR consent becomes a procedural formality. Studies have found that patients routinely agree to terms they cannot adequately explain. The result is that consent satisfies legal requirements while failing to realise the autonomy it was designed to protect. The dual literacy gap also undermines the exercise other data subject rights: access, rectification, erasure, and the right to object. The populations most in need of protection encounter data law as a system that governs their information before they can engage with it meaningfully.
Defensive Withdrawal and the Erosion of Trust. Research distinguishes “informed withdrawal,” a considered decision based on a genuine understanding of the trade-offs, from “defensive withdrawal,” a retreat driven by confusion or institutional distrust, a pattern that biobank participation research consistently documents. The EHDS opt-out is particularly susceptible to the latter. Patients who do not understand what secondary use means may opt out without knowing what they are declining. The clinical consequence is silent: a physician working from a shared health record does not know which patient has opted out or why, and data gaps appear without explanation. Trust between patients and healthcare professionals is eroded by a mechanism designed to build it.
The Research Gap that Perpetuates Health Inequity. The EHDS secondary use framework depends on a representative population dataset. However, structural exclusion from consent and opt-out processes creates systematic gaps. The population most likely to withdraw defensively, including older adults, people with low digital literacy, and those from minority language communities, are precisely the groups most in need of targeted research. When these groups are absent from datasets at disproportionate rates, research findings are built on a sample that does not represent the population most affected. As a result, marginalized populations are excluded not only from the benefits of research but also from the knowledge-production process itself.
A Failure of Regulatory Philosophy, Not Just Implementation
Some arguments frame this issue as an implementation problem that could be solved with clearer privacy notices, simpler interfaces, or better designed opt-out portals. These improvements are important and should be pursued, but they do not address the root of the issue.
The deeper problem is that data protection law is built around a model of individual autonomous choice that presupposes that the choosing subject is already equipped to choose. When this assumption fails, as it does systematically for a significant and identifiable group of the population, the law does not protect those people but processes their data.
This has consequences beyond individual patients. For healthcare professionals, it raises questions about the quality of consent being obtained in clinical settings. For the research community, it raises questions about the demographic representativeness of datasets and the reliability of their research findings. For industry, it raises questions about the long-term legitimacy and public trust that data use at scale depends upon. For policymakers, it raises the question of whether technical compliance with data protection law is being confused with genuine fulfilment of the human rights obligations that law is meant to serve.
Conclusion
The consent architecture of digital health is producing predictable outcomes for predictable populations. This is not an accident; it reflects choices embedded in how the law was written. Naming it clearly is the starting point for any honest reform agenda. The dual literacy gap is not a practical concern. It sits at the centre of whether digital health governance can deliver on its promises, to patients navigating these barriers in practice, to clinicians managing consent conversations daily, to researchers exploring what literacy deficits mean for their data, and policymakers assessing whether the current framework is doing what it was designed to do.
Cong Yao is a PhD researcher at the Health and Ageing Law Lab (HALL) and Research Groups of Law, Science, Technology, and Society (LSTS) at Vrije Universiteit Brussel (VUB) in Belgium. His research focuses on the issue of digital health divide, exploring how digital health technologies lead to vulnerabilities among certain groups of populations, and how different stakeholders can cooperate together to bridge this gap and make sure that all population groups can benefit from digital technologies in healthcare. His research interests also include health data protection, the right to health, and the European Health Data Space (EHDS). Yao is a member of the Nanopoulos Foundation’s Task Force on Patient Care & Human Rights.
