Consent Without Comprehension: Agreement in AI Products

TLDR: As AI becomes more and more embedded in everyday products, consent should involve meaningful understanding. In 1947, the Nuremberg Code treated knowledge & comprehension as part of informed consent, but 80 years later, we think a button as enough.

Consent Is Key

Table of Contents

1. Talk is cheap, …until money talks?

2. To read or not to read?

Think about the last thing you signed up for. You scrolled through the T&C’s, clicked “I agree”, and moved on with your life. That was exactly how 7,500 people were pranked to sell their souls(thankfully, it was only April Fools. lol)

You are no wierdo because in a study involving 543 participants, 74% skipped the privacy policy entirely, while 97% agreed to it.

Most privacy consent is a fiction, and most privacy policies have become longer and harder to read over time, and when you want the product, and the convenience, you (almost blindly) accept the terms.

Is a checkbox sufficient to establish meaningful consent?

I mean, I may make a terrible bowl of custard, but not knowing its chemical constituents does not automatically put me at risk.

In the same way, my comprehension of policies should depend, at least partly, on what is at stake, because it is unreasonable to expect a user to follow the mechanics of an AI model before using it.

There are serious consequences are great, much greater, if a chatbot is processing conversational data, influencing a healthcare decision, making financial recommendations or acting on my behalf.

Disclosure isn’t enough if it doesn’t lead to understanding.

Quick definition of terms

• Informed consent is agreement given with knowledge and comprehension of what is being agreed to. The Nuremberg Code of 1947 set it as a requirement for research on people.

• Privacy policy is the document in which a company states what personal data it collects and how it uses and shares that data.

• Opt-out is a setting that withdraws permission for a particular use of your data.

Talk is cheap, …until money talks?

Companies are pretty good at getting paying users. Matter of fact, in a study by Zuora, subscription businesses in its index experienced 11% faster revenue growth than the S&P 500. In a Global Digital Report, Adyen explained that 77% of businesses surveyed claimed to be investing in their subscription services, and 44% expanding the model into new products and services.

These guys already treat the relationship between subscriber and product as a journey. They test pricing, experiment with onboarding, send reminders, and surface upgrade prompts. When someone ignores a subscription offer, they show it to them again, and again.

It may piss you off, but when their game works, they get your goood money.

Unlike subscriptions, consent is treated as something you accept during onboarding, and may never revisit. Well, a user journey is beyond payments, and personalization.

• If an app or service is learning from, or acting on user’s information, then explaining how that data is handled should also be part of that process.

• And when a company changes how a feature works, introduces a new AI capability, or changes how data is processed, the user’s understanding should have a place in that journey(we are looking at you, vibe-coders).

Same point. Consent has to be baked in, with priority almost comparable to subscription walls.

As capabilities expand, features and data practices change, it is not enough that I clicked ‘yes, I approve’ two months ago. Moreso, agreement (I agree) can be recorded without the user grasping what they agreed to(I understand).

Consent is a form of moral magic
Heidi M. Hurd

To read or not to read?

Of course, nobody is asking users to be forced to read pages of legal text every time they use a product. Neither are we saying we should oversimplify, lest we lose substance, as Professor Solvove says. It was proven in a 2026 study that presentation shapes how well people take in privacy policies. Of the participants, those not required to show comprehension, and 97.3% of those who failed the study’s threshold still chose to consent. Funny huh?

To balance fatigue and still ensure clarity, different means can be used:

• plain-language explanations of policy changes,

• visual summaries of policy during onboarding,

• short explanations at the point of use, or even

• push notifications, reminders when something materially changes.

Methods can change, but the goal is to help users digest what has happened, or what could go on.

Are we asking for irresponsible use?

People are accountable for what they agree to, as well as the (sometimes questionable) choices they make. Also true that they may not always grasp the all details. Even so, technical literacy is not a prerequisite for adequate protection.

Must you understand machine learning, data processing, governance before you are protected by default?

In 2023, researchers found that Xiaomi continued transmitting detailed app-usage data even after they had opted out of diagnostic and analytics sharing. Yes, even after they configured the device to reflect a privacy-conscious user’s choices.

I’d leave you to be the judge of that, but consent is definitely NOT a single event, and for AI, where consequences are significant, we need to ask:

Does the user understand(not just read) what they were consenting to, and are we doing enough to get them there?

This piece is part of my efforts to understand how policies shape technology, especially AI. Or how AI shapes policy? Well, both. Subscribe to get every new publication in your inbox.