OAuth solved the mechanics beautifully: a user grants an application scoped, revocable access without handing over a password. That is a genuine achievement and the API economy depends on it.
But the mechanics are not the substance. Real consent requires that the person understands what they are agreeing to, that the grant is specific, that it is revocable in practice and not just in theory, and that they can find out later what actually happened with their data. Most consent screens fail every one of those tests. Scopes are named for engineers. The grant is effectively permanent. Revocation is buried. And nobody can tell you afterwards which applications read what.
Cambridge Analytica was the moment this became undeniable — the consent was formally present and substantively meaningless, and the platform could not say what its API consumers had done with the data it handed them.
What better looks like is not complicated: scopes described in language a normal person can evaluate, granular and revocable grants, an access log the user can inspect showing which application read what and when, expiry by default, and a real interface for withdrawing consent. Some of that is starting to appear as consent becomes something you can expose and manage through an API in its own right.
Until then, be honest about the difference between having a consent flow and having consent.
