A UX researcher asked whether users actually understand what they consent to. The answer reshaped the entire data protection programme.