How do I prevent observation or access from silently becoming unrestricted use?
A wellness app you granted step-count access for fitness tracking quietly begins sending behavioral inference from that same data to a third-party advertiser.
The situation
Months ago you approved an app's request to read your step count, to track fitness progress. The app now derives sleep and activity patterns from that same data stream and forwards them to an ad-targeting partner.
What the system knows
- The original access grant and the purpose it was made for (fitness tracking).
- Your raw step-count data.
- A newly derived behavioral profile (sleep/activity pattern inference).
- A pending request to forward that profile to an advertiser.
What the system wants to do
Share the derived behavioral profile with a third-party advertiser for ad targeting.
Who has authority?
The app has authority to read step data for fitness tracking — that grant is real and current. It has no standing for advertising use: that purpose was never presented, and nothing you approved extends to it. Access for one purpose is not the same as permission for another.
- Principal / subject
- You, the app user
- Consent / delegation
- Granted: step-count read access, fitness tracking only
- Purpose (original)
- Fitness tracking
- Purpose (attempted)
- Third-party ad targeting
- Scope
- Step-count data only — does not extend to derived behavioral profiles for a different purpose
- Standing
- NOT ESTABLISHED — for the advertising use
- Proposed action
- Forward derived behavioral profile to an advertiser
- Requested consequence
- Third-party ad delivery based on inferred behavior
What Genesis checks
- Whether the current action's purpose matches the purpose consent was actually given for.
- Whether "access" is being quietly read as "unrestricted use."
- Whether a new, separate authorization exists for the new purpose.
This is a design principle this project applies to its own systems, not a claim about what the law currently requires of any particular system. See Rights in a Machine-Speed World — Fourth Amendment for the civic question this mirrors, and its own limits.
What happens next
Your original fitness-tracking access is untouched and keeps working. Only the unmatched secondary use is blocked, pending a real, separate request you could approve or decline.
Inspect why
See the reasoning
Access ≠ permission, and purpose is not decorative — it is the boundary a grant is actually scoped to. A system can hold real, valid access for one purpose while having no standing at all for a different one, even when the underlying data is identical.
Explore the architecture
Genesis components involved: