Forced consent: unreadable terms and the ritual of agreeing

What it is

Every clickwrap agreement makes the same implicit claim: that the person pressing the button has read and understood what they are agreeing to. Three separate strands of research say that claim is false at a scale that is hard to overstate. McDonald and Cranor calculated in 2008 that if an American internet user read the privacy policy of each site they visited once a year, it would take roughly 201 hours — with a median policy running about 2,514 words, ten minutes at a normal reading pace. Bakos, Marotta-Wurgler and Trossen tracked the browsing of 48,154 households across ninety software retailers and found that only one or two shoppers in every thousand opened the licence agreement at all, and that most of those who did read only a fragment. Obar and Oeldorf-Hirsch put 543 people through sign-up for a fictitious social network and found 74% skipped the privacy policy entirely; the ones who did open it spent an average of 73 seconds on a document that would take about half an hour to read, and 51 seconds on terms that would take about sixteen minutes. Clauses assigning the user’s firstborn child and sharing their data with employers and a national security agency went almost entirely unremarked.

Given that, the interesting design question is not why people do not read. It is what the interface does with the gap. The usual answer is a proof-of-reading ritual: a scroll container you must reach the bottom of, an agree button that stays disabled until you do, a checkbox affirming that you have read and understood. None of these measure reading. They measure whether a scrollbar reached a coordinate, which is a thing a person can accomplish by holding a key down.

“Terms of Eternal Service” makes that ritual the entire obstacle. The document scrolls down at a third of the speed it scrolls up, so every attempt to reach the bottom is three times the work of losing your place. Reaching the bottom does not unlock agreement: it causes a confirmation control to appear at the top of the document, which you have to travel back up to press, after which you have to travel back down again to reach the “I Agree” button. A “Maximize” control, which looks like it should make the reading easier, appends an addendum of further clauses. The joke is that the game has removed the pretence — it is honest about the fact that the scroll gate was the point and the text was scenery.

Brignull’s taxonomy files this shape under “forced action”: the user wants to do something and is required to do something else undesirable in return. What makes terms of service the purest case is that the undesirable thing is not merely tedious. It is a legally operative act performed without the information that would make it meaningful.

Why it works on people

Habituation does most of the work, and it has been measured directly on this exact interface. Böhme and Köpsell ran a consent dialog past 80,000 users of a privacy tool in a factorial field experiment and found something counterintuitive: the more the dialog resembled a licence agreement, the more readily people accepted it. Polite phrasing and button text signalling a genuinely voluntary decision reduced consent rather than increasing it. Their reading is that people have been trained by ubiquitous EULAs to treat a coercive-looking interception dialog as a formality to be dismissed, and process it heuristically rather than actually reading it. A dialog that looks like a real question gets treated like one; a dialog that looks like a EULA gets clicked.

Second, the economics are unarguable from the user’s side. A person cannot read every agreement, so they must adopt a policy. The rational policy is to accept, because the alternative — not using the service — is usually not a real option, and because the terms are non-negotiable anyway. Reading changes nothing about the outcome, so reading is not an investment; it is a cost with no return. Once that is true, the agreement has stopped functioning as a document and started functioning as a gate.

Third, the length is self-reinforcing. Every clause a lawyer adds costs the company nothing in conversion, because conversion is not sensitive to length past the point where nobody was reading anyway. There is no feedback loop pushing terms shorter, which is why they trend in one direction.

Fourth, the ritual is genuinely useful to the party imposing it — not as evidence that anyone understood, but as a record that a mechanism was completed. That asymmetry is the heart of the pattern: the friction produces something valuable to one side and nothing at all to the other.

And the scroll gate adds a specific injury on top. Overriding native scrolling breaks the browser behaviour people rely on, including keyboard navigation, assistive technology and any device where the interaction model is different from a mouse wheel. The people most obstructed by a scroll gate are the ones who were most likely to be reading carefully.

Where you meet it

• Sign-up screens where a pre-checked box asserts you have read and understood documents you have not opened, bundled with unrelated marketing consent in the same sentence.
• Agree buttons disabled behind a scroll-to-bottom check on a document too long to read, so the gate rewards scrolling fast rather than reading at all.
• Terms presented in a fixed-height iframe a few lines tall inside an already small modal, on a screen where the document runs to tens of thousands of words.
• Updates announced with “we have updated our terms; continued use constitutes acceptance”, with no diff, no summary and no indication of what changed.
• Material commitments — binding arbitration, class-action waivers, a broad licence to user content, automatic renewal — disclosed only inside the long document and not at the point where they take effect.
• Installers that make the licence text selectable but not copyable, or that offer no route to the document at a stable public URL for reading before installation.
• Consent to optional data processing folded into acceptance of the contract, so declining the processing means declining the service.

Designing around it

• Separate the contract from the consent. If some processing is optional, ask for it separately and let people decline it while still using the service. The GDPR requires that a consent request bundled into a wider written declaration be presented in a manner clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language, and it treats conditioning a service on unnecessary consent as a factor weighing against that consent being freely given. Bundling is where a long agreement does most of its real damage.
• Write a layered disclosure and lead with the layer that matters. A short, plain summary of the commitments a normal person would be surprised by — what you may do with their content, whether disputes go to arbitration, how renewal and cancellation work, what happens to data on deletion — sitting above the full legal text, each item linked to the clause it summarises. The EU’s Digital Services Act moves in this direction: it requires terms and conditions in clear, plain, intelligible, user-friendly and unambiguous language, and requires the largest platforms to publish a concise, easily accessible, machine-readable summary.
• Surface each material term where it operates, not only where it is filed. Auto-renewal belongs on the payment screen. A content licence belongs beside the upload control. An arbitration clause belongs on the sign-up screen in its own sentence. A term that a user meets for the first time when it is enforced against them was disclosed in a technical sense and in no other sense.
• Retire the scroll gate. It does not measure comprehension, it is trivially defeated, and it is an accessibility problem: overriding native scroll and gating a control behind it breaks keyboard operation and assistive technology, which WCAG treats as a baseline requirement rather than a nicety. If you want evidence that someone engaged with a specific term, put that term in front of them as its own explicit choice.
• Let people read at their own pace and on their own terms. Publish the document at a stable, public, linkable URL that can be read before sign-up; make it selectable, copyable and printable; give it real headings and anchor links so a clause can be cited; and version it so that “clause 7.2 of the 14 March 2026 terms” means something specific.
• On every change, publish what changed. A dated changelog, a diff against the previous version, and a short summary of the practical effect of the amendment. “Continued use constitutes acceptance” is a weak basis for agreement when the person has not been told what they are now agreeing to — and the Unfair Contract Terms Directive treats consumer terms that were not individually negotiated as unfair where they create a significant imbalance contrary to good faith, with terms in writing required to be drafted in plain, intelligible language and ambiguity resolved in the consumer’s favour.
• Measure the document like a product. Word count, reading time at 250 words per minute, and a readability score are all cheap to compute in CI, and a threshold that fails the build is more effective than a style guide nobody reads. Track them over time; the useful signal is the direction.
• Keep an honest record of what was agreed. Store the version identifier, the timestamp and the specific consents given, separately from the account record, so that when someone asks what they agreed to you can answer precisely rather than pointing at the current document.
• An honest version of this flow looks like: a one-screen summary of the terms that would surprise someone, in plain language, with the notable clauses called out individually; a link to the full text that opens somewhere readable; an unchecked box that says “I agree to the Terms of Service”, with no other consents attached to it; and an email afterwards containing the version they accepted. It takes longer to write than a scroll gate and it is the version that holds up when it is read.

Questions

Why does nobody read terms of service?

Because reading them is not a rational use of the reader’s time and would not change the outcome. The documents are long — a median privacy policy around 2,514 words in one study, with terms typically longer — the terms are non-negotiable, and reading every agreement a person encounters in a year would take weeks. Clickstream data shows only one or two shoppers in a thousand open a software licence at all.

Does a scroll-to-bottom gate make an agreement more enforceable?

It produces a record that a scroll container reached its end, which is not the same thing as reading. Whether an agreement binds a user is decided under contract law in the relevant jurisdiction, and courts generally look at whether the terms were reasonably conspicuous and whether the user had clear notice that acting meant agreeing — not at scroll telemetry. A gate that people defeat by holding a key down is weak evidence of anything, and it makes the flow harder for keyboard and assistive-technology users.

What is forced consent?

It is a design where getting the thing you came for is conditional on agreeing to something else — typically an agreement you cannot realistically read, often bundled with optional data processing you would decline if it were offered separately. Brignull’s taxonomy calls the general shape “forced action”. Under the GDPR, bundling a consent request into a wider declaration without clearly distinguishing it, or conditioning a service on consent that is not necessary for it, both weigh against the consent being valid.

How can terms of service be made genuinely readable?

Layer them. Lead with a short plain-language summary of the commitments a normal person would find surprising — content licences, arbitration, renewal, deletion — each linked to the clause it summarises, with the full text below at a stable public URL. Surface each material term where it actually operates rather than only in the document, publish a dated diff on every change, and keep word count and reading time as tracked metrics rather than aspirations.

Related patterns

• Cookie consent dark patterns: double negatives and asymmetric choice
• Interruption cost: the work does not resume where it stopped
• Confirmshaming and the confirmation gauntlet: when “are you sure?” is the trap
• Dishonest progress indicators and the wait they are hiding