(A rule of thumb approach towards developing best privacy practices in the IdM industry)
Legally, privacy(rights) are not an agreement (contract) and consent is not a not created through a company permission.
Privacy rights refer to mature laws that govern the shared state of society in which we all live.
Governance for how to define power and control in relationships.
A contract is about collaboration or engaging with each other and transacting day to day
The dis/agreement(s) we engage in with on a one on one basis is about the maintenance of the identity relationship, not defining the state.