You can still consider it unauthorized, if you do not consider the authorization to be valid in the first place. I can also get people to sign away their life on a contract, that's not going to mean anything, because signing away your life is not possible in the first place.
> If people actually read these clickthrough agreements
I would live in such a world too, but that is a fairy tale. In a lot of situations, you don't get to see the contract before you have signed it. I had the situation in a bank contract. The bank clerk tells me it's mandatory, to sign that waiver, I tell her it's not. She won't sign the main contract, until I signed that waiver. I tell her that's illegal. Doesn't matter. After I signed it, I get to read the waiver, it clearly states, that it is not mandatory, and whether it gets signed does not have any effect on the main contract, as is required by law (with citation).
Because of these things, the laws says some things can't be established and most other things must be established with informed consent. It's on the company to ensure that this is collected. No, a tick on "I have read and understand the Terms and Conditions" is not informed consent.
Honestly, we don't need any law changes actually, because most of these things the tech companies do is plain illegal in every step.
-----
On the first page of a web search: https://www.legal500.com/intelligence/germany/privacy/german...
The Regional Court of Berlin held in a judgment of 16 January 2018 (docket no. 16 O 341/15, German language version of the judgment available here) that Facebook's default privacy settings and parts of their terms and conditions were invalid. This judgment provides important guidance on consent and transparency.
Background
The Federation of German Consumer Organizations (Federation) sued Facebook and requested cease and desist regarding some of its default settings and terms and conditions.
The Federation argued that Facebook's default settings violated the requirement of explicit consent. For example, the default settings included a location service in Facebook's mobile app revealing the location of the person that the user is chatting to. In addition, boxes were pre-activated allowing search engines to link to the user's timeline.
The Federation also argued that various clauses in the terms and conditions of Facebook were invalid, including clauses that provide consent of the user (i) to transferring personal data to and processing personal data in the U.S. and (ii) using the name and profile picture of the user for commercial, sponsored or related content.
Judgment of the Regional Court of Berlin
First, the Regional Court of Berlin found that five default settings were invalid because the requirements of informed consent were not fulfilled. The court stated that informed consent requires that an organization must provide comprehensive information about the background and the scope of the consent in order for the consent to be based on an entirely free decision of the user. Default settings cannot be regarded as informed consent if the user is not explicitly and actively notified of the default settings in the registration procedure. Facebook did not sufficiently ensure that the user was aware of the default settings. The court noted that a "virtual privacy tour" that Facebook offered, but that was not mandatory, did not change this. Not every user would make use of this privacy tour and "realistically", most of the users would not further review the privacy settings.
Next, the court held that the consent declarations in the terms and conditions were not transparent and therefore the users were not able to give informed consent. With regard to the consent to the transfer of personal data to the United States, the court observed that the user was not informed about which categories of personal data were transferred, why they were transferred, how they are further used in the U.S. and which standards of data security are applied. Further, the court concluded that the consent language for using the name and profile picture for commercial, sponsored or related content was not transparent. The extent of the usage of the name and profile picture was not clear for the user and not further explained. The court noted that the example that was provided in the consent wording (i.e., use for a brand that the user likes) was not sufficient information about the scope of the consent.