Users Stop Reading Privacy Policies, Leading to Consent Fatigue

Digital users are repeatedly asked to make decisions about their personal data. Cookie banners, app permissions, newsletter sign-ups and account settings all require some form of consent.

The intention is to give people greater control. In practice, the volume and design of these requests often produce the opposite result: systematic disengagement.

A Pew Research Centre survey found that 97% of US adults had been asked to approve a privacy policy. However, only 22% said they always or often read privacy policies before accepting them, while 36% said they never read them. Even among people who read policies at least occasionally, only 22% said they read the entire document.[1]

Research into cookie consent behaviour shows that these decisions are also made very quickly. In field experiments involving more than 80,000 website visitors, users typically interacted with consent notices within four to eight seconds.[2] That leaves little time to understand what data is being collected, why it is needed or how it may be used.

This is not simply user negligence. It is a predictable response to consent fatigue, and it represents a significant failure in contemporary UX design.

The Gap Between Regulatory Intent and User Experience

Regulations such as the General Data Protection Regulation were designed to give users greater visibility and control over their personal data.

However, many organisations responded by adding more banners, dialogues and legal explanations without reconsidering how people make decisions in real digital environments.

The result is an avalanche of consent requests that transforms privacy decisions into obstacles. Instead of supporting meaningful choice, consent interfaces often interrupt users while they are trying to read an article, complete a purchase or access a service.

When the fastest way to continue is to press “Accept”, consent becomes less an expression of preference and more a method of removing friction.

This creates a fundamental mismatch between regulatory intent and implementation. Users technically receive a choice, but the surrounding interface may discourage them from understanding or exercising it.

The Psychology of Repeated Decisions

Repeated decision-making can increase mental effort and encourage people to rely on defaults, familiar behaviours and the simplest available option.

Early research by Kathleen Vohs, Roy Baumeister and their colleagues proposed that making repeated choices could temporarily reduce persistence and self-control.[3] However, later large-scale replication studies found much weaker evidence for the idea that willpower operates as a single, finite resource.[4]

The exact psychological mechanism remains debated, but the practical UX outcome is clear. People facing repeated, low-context decisions are unlikely to evaluate every option with the same level of attention.

A user encountering another consent dialogue may already have made dozens of decisions about emails, meetings, purchases and notifications. Faced with additional legal text and several unfamiliar controls, they are likely to choose the quickest route forward.

Consent design should therefore not assume that every user approaches every request with unlimited time, attention and motivation.

How Interfaces Manufacture Consent

Consent rates are influenced not only by user preferences but also by how choices are presented.

A study of consent-management platforms across 680 popular UK websites found that only 11.8% met the researchers’ minimum legal requirements. The study also demonstrated how strongly interface design affected behaviour.[5]

Removing the option to reject consent from the first screen increased consent by approximately 22 to 23 percentage points. By contrast, presenting more detailed controls on the first screen reduced consent by between 8 and 20 percentage points.

These findings demonstrate that users are not simply expressing pre-existing preferences. Their decisions are being shaped by visual hierarchy, interaction cost and the availability of alternatives.

Common examples include:

• A prominent, high-contrast “Accept all” button next to a less visible rejection option
• A one-click acceptance process that requires several steps to refuse
• Vague button labels such as “Continue” or “Got it”
• Preselected settings that favour maximum data collection
• Rejection controls hidden behind menus such as “Manage preferences”

These patterns create asymmetric choice architecture. One option is designed to be immediate and effortless, while the alternative requires additional attention and work.

This is not meaningful consent. It is consent produced through interface pressure.

Habituation and Banner Blindness

Repeated exposure also changes how users visually process consent requests.

A 2024 eye-tracking study comparing several cookie-consent interfaces found that participants did not meaningfully read the explanatory text. Most skipped directly towards the controls required to complete or dismiss the dialogue.[6]

This behaviour is a form of habituation. When people repeatedly encounter similar interruptions, they develop automatic responses. The consent request becomes part of the interface noise rather than a meaningful decision point.

Users may stop asking:

• What information is being collected?
• Why is it required?
• Who will receive it?
• What happens if I refuse?

Instead, they ask:

• Which button removes this banner?

The industry has trained users to ignore the very information it is legally required to communicate.

What More Effective Consent Design Looks Like

Better consent design begins by accepting that additional information does not automatically create greater transparency.

Transparency is not the amount of text presented. It is the user’s ability to understand the relevant information and make a genuine choice.

Several design principles can support this goal.

Request Consent at the Point of Need

Permissions are easier to understand when they are connected to an immediate action.

Instead of requesting access to a microphone, camera, location and contacts during onboarding, products should ask for each permission when the user activates the feature that requires it.

For example, a podcast application can request microphone access when the user attempts to record audio. At that moment, the relationship between the permission and its value is clear.

The interface should explain:

• What permission is required
• Why the feature needs it
• What happens if the user refuses
• Whether the decision can be changed later

Context reduces ambiguity and makes the request feel relevant rather than procedural.

Use Layered Disclosure

Most users will not read a full privacy policy during a product interaction. Designing as though they will only creates the appearance of transparency.

Layered disclosure provides essential information first, followed by optional detail.

The initial layer should answer the most important questions:

• What data will be collected?
• Why is it being collected?
• Who will it be shared with?
• Is the data required for the feature?
• What happens if the user declines?

Users who need more information should be able to expand the explanation or access the complete privacy policy.

This approach supports different levels of interest without forcing everyone through the same volume of legal material.

Use Plain, Specific Language

Legal completeness does not require confusing language.

Compare these statements:

Data may be processed by third-party service providers for promotional purposes.

We share your email address with marketing partners so they can send you promotional messages.

The second version is more direct. It identifies the data, the recipient and the purpose.

Consent copy should avoid vague terms such as “enhance your experience”, “trusted partners” or “legitimate business purposes” unless those terms are clearly explained.

Users cannot make an informed decision when the consequences of that decision are hidden behind abstract language.

Make Choices Visually Equal

Accepting and rejecting optional data collection should require comparable effort.

This means:

• Giving accept and reject options similar visual prominence
• Avoiding preselected optional permissions
• Using clear labels rather than ambiguous language
• Providing a direct way to refuse from the first screen
• Avoiding additional confirmation steps for rejection
• Making it easy to change a decision later

A genuine choice should not punish the user for selecting the privacy-protective option.

Standardise Privacy Information

Standardised formats can make privacy practices easier to scan and compare.

Apple’s App Store privacy information is one example of presenting categories of data collection in a more consistent format. It does not replace a complete privacy policy, but it gives users an initial overview that is easier to process than a long legal document.

Similar patterns could help users compare products based on:

• Types of data collected
• Whether data is linked to their identity
• Whether data is used for tracking
• Whether information is shared with external organisations
• Whether collection is required or optional

Consistency reduces the mental effort required to understand a new privacy interface.

Measure Understanding, Not Acceptance

Consent acceptance rates are often treated as evidence of a successful interface.

However, a high acceptance rate may indicate that the interface is persuasive, confusing or difficult to reject. It does not prove that users understood the request.

Teams should measure indicators such as:

• Whether users can explain what they agreed to
• Whether they understand the consequences of refusing
• Whether they later change or review their permissions
• Whether support requests reveal confusion about data practices
• Whether users can locate privacy controls after onboarding
• Whether acceptance changes when options are presented equally

The goal should not be to maximise consent. It should be to improve the quality of the decision.

Moving Beyond Compliance Theatre

Consent should be treated as a product-design problem, not merely a legal requirement.

A banner can satisfy a compliance checklist while still failing the user. A privacy policy can contain every required disclosure while remaining functionally unreadable. A consent dialogue can technically offer a rejection option while making it difficult to find.

These interfaces create compliance theatre: the appearance of user control without the conditions required for meaningful choice.

Designers should ask a more demanding question:

Does this interface help users understand and control what happens to their data?

If the answer is no, adding more text will not solve the problem.

The path forward requires fewer unnecessary consent requests, clearer explanations, better timing and equal treatment of available choices. Users should receive relevant information when it matters, in language they can understand, through an interface that does not pressure them towards one outcome.

Consent is meaningful only when users can understand the decision, refuse without unnecessary friction and continue using the product wherever consent is genuinely optional.

Anything less is not informed choice. It is interruption disguised as control.

References

1. Pew Research Center, Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information, 2019.
   https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/
2. Christine Utz and others, Uninformed Consent: Studying GDPR Consent Notices in the Field, 2019.
   https://arxiv.org/abs/1909.02638
3. Kathleen D. Vohs and others, Making Choices Impairs Subsequent Self-Control: A Limited-Resource Account of Decision Making, Self-Regulation, and Active Initiative, 2008.
   https://pubmed.ncbi.nlm.nih.gov/18444745/
4. Martin S. Hagger and others, A Multilab Preregistered Replication of the Ego-Depletion Effect, 2016.
   https://pubmed.ncbi.nlm.nih.gov/27474142/
5. Midas Nouwens and others, Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating Their Influence, 2020.
   https://discovery.ucl.ac.uk/id/eprint/10088400
6. Norwegian University of Science and Technology, eye-tracking research into cookie-consent interface design, 2024.
   https://ntnuopen.ntnu.no/ntnu-xmlui/handle/11250/3136164