Consent is an interface
What comprehension research says about how people actually read consent screens, and what that means for anyone writing terms.
The arithmetic was always impossible
In 2016, Jonathan Obar and Anne Oeldorf-Hirsch built a fake social network called NameDrop and asked 543 people to join it. The terms of service included a clause requiring the user to provide their first-born child as payment, and another permitting data to be shared with the NSA and with the userโs employer.
Ninety-eight per cent agreed without noticing.
Seventy-four per cent skipped the privacy policy altogether by taking the โquick joinโ option. Among those who did open it, the average time spent was 73 seconds on a document that would take around half an hour to read. Ninety-seven per cent accepted the privacy policy; ninety-three per cent accepted the terms.
The paper is called The biggest lie on the Internet, and the lie in question is โI have read and agree to.โ
McDonald and Cranor worked this out in 2008, before the cookie banner existed in its current form. They took the privacy policies of the 75 most popular websites, median length around 2,500 words, and calculated what it would cost an average American internet user to read the policy of each new site visited in a year.
- 244 hours
- per year. Roughly forty minutes a day.
- $781 billion
- in national opportunity cost, valuing that time at leisure rates.
And that assumes each policy is read once, never compared against a competitorโs, and never re-read when it changes. So when a consent rate comes back at 94%, the number is not measuring agreement. It is measuring the cost of the alternative.
The 22 points that belong to the button
Nouwens, Liccardi, Veale, Karger and Kagal (2020) scraped the consent pop-ups of the five most popular consent management platforms across the top 10,000 UK websites, 680 sites in the sample, and found that only 11.8% met the minimal requirements the authors derived from European law. Then they ran a field experiment on the design variables.
- +22 to +23 pts
- Consent when the opt-out button is removed from the first page.
- โ8 to โ20 pts
- Consent when more granular controls are put on the first page.
Those two findings, taken together, are the whole argument. A quarter of the agreement in a typical consent rate is attributable to where a button sits. Whatever else that number is, it is not a stable preference being expressed.
Healthcare has been running this experiment for longer
Clinical and research consent has the same comprehension problem with higher stakes and a much older literature. Paasche-Orlow, Taylor and Brancati (2003) collected the consent form templates published by 114 US medical school review boards. Sixty-one of those institutions had set an explicit readability standard, most commonly eighth grade. Their own templates averaged a Flesch-Kincaid grade level of 10.6.
Eight per cent met the standard the institution itself had written.
Not a failure of intent. A failure of the process that produces the document, in which every legal review adds a clause and none removes one, the same mechanism that produced the 2,500-word privacy policy.
What has been shown to move comprehension, rather than length:
- Test and feedback. Ask the person to explain the procedure back in their own words, then correct what they got wrong. In Schenker and colleaguesโ review of 44 studies (2011), all three that tested this approach found improved understanding. Three is a thin evidence base, but it is the only category in that review with no failures in it.
- Layered disclosure, with the material terms in the first layer rather than the summary of the summary.
- Just-in-time consent, asked at the moment the data is used rather than bundled at account creation.
- Plain language, with the caveat that readability formulas count syllables and sentence length, not whether the concept landed.
The uncomfortable part
Improving comprehension will, in most cases, reduce the consent rate. That is the point, and it is also why the work is hard to fund.
It is worth granting the opposing case. A team that shortens a notice to improve comprehension may end up omitting a material term, and a layered notice can bury something in layer three quite as effectively as a wall of text buried it in paragraph forty. Brevity is not the same as disclosure. There is also a reasonable argument that some consent decisions are genuinely low-stakes; Obar and Oeldorf-Hirschโs participants were not behaving irrationally, only economically.
Saudi Arabiaโs Personal Data Protection Law came into force on 14 September 2023, with enforcement following the end of the grace period a year later. It requires consent to be specific, informed, freely given and revocable, and it does not permit one consent to be bundled across unrelated purposes. Those requirements have design consequences, and most of them land in exactly the place the Nouwens experiment identified: what is on the first screen, and whether the two buttons are the same size.
Obar and Oeldorf-Hirsch also recorded how long the people who declined spent reading. Thirty seconds longer on the privacy policy, ninety seconds longer on the terms. That was the whole difference between agreeing to hand over a first-born child and not.
Research ยท Privacy ยท PDPL
Disagree? Good, tell me on LinkedIn.
Next thought: Card sorting tells you less than you think All thoughts