For adults, I think a legal opt-in-only policy would work well. And require reconsent with every major algorithm change.