Consent is not a checkbox

There is a version of consent that lives entirely in the legal department: a disclosure is posted somewhere, a regulation is satisfied, a box can be checked, and the data flows accordingly. That version is necessary and we take it seriously at ExecLeads. It is also, on its own, an insufficient answer to a deeper question that the law does not fully address: whether the people described in our data would consider the way we hold and use it to be reasonable, if someone sat down and explained it to them plainly.

Much of executive data is built from information that was never directly handed over by the person it describes. It is assembled from public professional activity, inferred from patterns, aggregated from many small signals that, individually, nobody would object to sharing, but that add up, collectively, to a fairly detailed picture of someone's career. That aggregation is legal in the way it is typically done across the industry. Whether it is fair is a separate question, and I think it is the question that actually determines whether this is a business worth being proud of.

The test we apply internally

The test we try to apply, imperfectly, is to imagine explaining our data practices directly to the person described in a given record, in plain language, and asking whether they would consider the arrangement reasonable. Not whether they would be thrilled about it — most people are naturally uneasy about any company holding information about them — but whether a fair-minded person, hearing the explanation, would conclude the use was reasonable rather than exploitative. That is a higher bar than legal compliance, and it is also a vaguer one, which is exactly why it requires ongoing judgment rather than a policy document that gets written once and filed away.

The legal bar is the floor. The honest bar is whether the person described would consider the arrangement fair, if someone explained it to them plainly.

What this looks like in practice

In practice it means we decline to hold certain categories of information even when they are technically available and would make our dataset more detailed, because the use case for holding them does not clear the fairness bar even though it would clear the legal one. It means we have built mechanisms for people to see what we hold about them and have it corrected or removed, not because a regulation requires the specific mechanism we built, but because the absence of such a mechanism would fail the test on its own. It means we periodically reconsider practices that were defensible when we adopted them, because what counts as reasonable shifts as the broader data landscape shifts, and a standard that does not get revisited eventually falls behind the world it is supposed to answer to.

None of this is required by any specific statute, which is precisely the point. A business that only does what the law requires is, by definition, doing the minimum that someone else decided was acceptable. I would rather ExecLeads hold itself to a standard we chose because we believe in it, even where it costs us some data we could otherwise have kept. That standard is harder to maintain than compliance, and it is the only version of this business I am interested in owning for the long run.