A Rights-First Path to Privacy by Architecture: The Case for Advanced Digital Protection Control (ADPC)

Contemporary digital environments rely heavily on repetitive notice-and-click mechanisms for obtaining consent, despite decades of legal, technical, and human-computer interaction research documenting the limits of banner-centred approaches. For users, this practice is demanding, manipulable, difficult to remember, and exclusionary; for controllers, costly and fragile. The problem is not merely poor graphical user interface design, but missing Internet architecture: there is no widely adopted, legally enforceable, bidirectional layer for communicating privacy information, requests, decisions, and records in machine-readable form. The European Commission's 2025 Digital Omnibus proposal brought this architectural deficit into legislative focus: a provision, initially labelled Article~88b GDPR, proposed automated and machine-readable means for expressing consent and objection online. Whatever the provision’s numbering, wording, scope, legal status, or ultimate fate, the durable question is whether the European Union can move privacy communication from controller-side banners toward standardised, bidirectional, automated and machine-readable mechanisms. This paper argues that Advanced Digital Protection Control (ADPC) provides the closest fit among available mechanisms for implementing such a layer and is sufficiently developed to address technology-readiness concerns: not as another graphical user interface, but as a technology-neutral layer for machine-readable privacy communication across web, mobile-application, AI-mediated, IoT, immersive, pervasive, and future environments. It can support the communication of legally required information, rights-relevant requests, and decisions such as consent, refusal, withdrawal, and objection, as well as the generation of records reflecting the rights grammar of the GDPR and ePrivacy framework. Properly implemented through open, inclusive, and interoperable standardisation in the public interest, ADPC would make privacy the first mature test case for a broader rights-first digital infrastructure: inclusive, enforceable, and capable of supporting human-compatible digital transformation, sustainable economic growth, digital sovereignty, and socio-economic and democratic resilience.