The first case argues for stronger consent controls. The second shows they would not have helped, because nothing about the authorisation was wrong.