While many strategies for protecting personal privacy rely on regulatory frameworks, consent, and anonymizing data, they are not always effective. Terms and Conditions often lag behind advances in technology, software, and user behaviours, and consent to use data for a range of unclear purposes may be provided unwittingly. As the commercial market for (student) data expands, so does the number of brokers who move, share and sell data across continents and legislative environments. This paper reviews four Massive Open Online Course (MOOC) providers from different geopolitical and regulatory contexts. It explores how consent to collect and use data is described to potential users, and how that consent applies at micro, meso, and macro levels. This paper proposes a need for greater transparency around the implications of users granting consent at the point of registration. Further, it highlights that though MOOC providers have a responsibility to make clear the potential uses and sharing of user data, users themselves should also be more aware and consider how meaningful student agency can be achieved.