Do People Read Terms and Conditions? 98% Agreed to Give Up a Child, in a Median of Fourteen Seconds

No. And the interesting part is not that nobody reads them - you already assumed that. It is that the obvious fixes have been tested and mostly failed, and that the two statistics everybody quotes about this are both misdescribed in circulation.

The experiment

Obar and Oeldorf-Hirsch (2020), in Information, Communication & Society, built a fake social network called NameDrop and asked 543 undergraduates to join it.

Two paths were offered: read the privacy policy and terms of service, or take a clickwrap shortcut. Seventy-four per cent took the shortcut.

For those who did open the documents:

Document	Average time	Median time	Time it should have taken
Privacy policy	76 seconds	14 seconds	about 30 minutes
Terms of service	51 seconds	14 seconds	about 16 minutes

A median of fourteen seconds on a document that takes half an hour to read.

Inside those documents the researchers had planted what they called gotcha clauses. One required users to “immediately assign their first-born child to NameDrop.” Another stated that NameDrop “may be required to share data with government agencies, including the U.S. NSA,” and that this “could impact eligibility in the following areas: employment, financial service… criminal justice system.”

Ninety-seven per cent agreed to the privacy policy. Ninety-three per cent agreed to the terms of service. Ninety-eight per cent missed the gotcha clauses.

The replication, which found older adults slightly worse

The same authors ran it again in 2022 in the International Journal of Communication, with 500 participants aged 50 and over (mean 58.7, range 50 to 86).

They replaced the first-born clause - feedback suggested it be modified for this population - with an organ-assignment clause requiring users to “immediately assign one of their human kidneys to NameDrop, Inc.,” with surgical extraction “within six months of signup” and “All surgical costs to be paid by the NameDrop account holder.”

77.6% took the clickwrap shortcut - slightly more than the students. Median time on the privacy policy 24.24 seconds, on the terms 31.63 seconds, against required reading times of 26 to 44 minutes and 16 to 27 minutes.

Detection was close to total failure. One participant out of 500 mentioned the device-access clause. Four (0.8%) mentioned the organ clause. And zero - none of the 500 - mentioned the NSA data-sharing clause.

Note that this is the same author pair, so it is a self-replication rather than an independent one.

The behavioural evidence, and the number everyone gets wrong

The laboratory studies show what people do when watched. Bakos, Marotta-Wurgler and Trossen (2014), in the Journal of Legal Studies, watched what they do when not.

They analysed clickstream data covering 48,154 monthly visitors to the websites of 90 online software companies. Their published finding: only one or two of every 1,000 retail software shoppers access the licence agreement.

Here is the correction, because the more famous version of this statistic is wrong in two ways.

The figure usually quoted is 0.05% - and it is described as a share of shoppers. It is not. It is a share of visits: 55 EULA accesses out of 120,545 visits to software retailers. And that figure appears in the 2009 working paper, which had a different and smaller sample than the published article. The published, shopper-level number is one to two per thousand, i.e. 0.1% to 0.2%.

One more clarification. The working paper counts a page as “accessed” if it was open for at least one second. That is a threshold for counting a visit, not a definition of reading. The authors separately observe that a full read would take eight to ten minutes, against an observed mean time on the EULA page of 47.7 seconds and a median of 29 seconds.

The 244 hours, and what it actually is

McDonald and Cranor (2008), in I/S: A Journal of Law and Policy for the Information Society, produced the most-quoted figure in this entire area: roughly 244 hours a year to read the privacy policy of every site you visit.

That number is an economic model, not a measurement of anyone’s behaviour. Its stated assumptions: a median of 2,514 words per policy across 75 popular websites, a reading rate of 250 words per minute, and 1,462 unique sites visited per person per year, scaled from 2008 audience data. Their own framing is explicitly counterfactual - what would people’s time be worth if they read each policy once a year.

Scaled nationally, they estimated about 53.8 billion hours and put the value of the lost time at roughly $781 billion annually, using $35.86 an hour for work time and $4.48 for leisure.

The paper also gives a separate skimming estimate of 6.3 minutes per policy, from a study of 212 participants.

Print 244 hours and attribute it to McDonald and Cranor. Do not print “76 work days,” a framing that came from later journalism and does not correspond to their figure - 244 hours is closer to 30 eight-hour days.

Funding note: the work was supported in part by a US Army Research Office contract to Carnegie Mellon’s CyLab, and the paper acknowledges Nielsen Company staff - relevant, because Nielsen data supplied the 1,462-sites assumption.

Would simpler terms help? The evidence conflicts

This is the part that should trouble anyone who has proposed plain-English terms as the solution.

Against. Ben-Shahar and Chilton (2016) randomised 1,484 nationally representative Americans across six disclosure formats. Median time on the disclosure screen was 4.5 to 6.0 seconds across every treatment, for documents of 499 to 970 words. Comprehension was below chance - 0.77 to 0.91 correct out of five. No treatment differed from a blank control on subsequent risky behaviour. A warning-label version raised comprehension to 1.53 correct, but “this small improvement did not translate into any detectable difference in behavior.”

For. A 2019 literature review conducted by the Behavioural Insights Team for the UK’s Department for Business, Energy and Industrial Strategy reports that shortening and simplifying terms increased both reading rates and understanding; that an end-user licence summary raised installation cancellations from 17% to 56%; and that making scrolling the default raised self-reported scanning from 9.4% to 77.9%.

Those are secondary reports and we did not open the primary studies behind them, so we present them as a government-commissioned review’s summary rather than as verified findings.

What both sides agree on is instructive: the things that move behaviour are structural - forcing a scroll, showing a summary - rather than better prose. Nobody has shown that writing the same obligations more clearly makes people read them.

The same review notes that self-reported reading rates across studies range from 1% to 65%, a spread wide enough to tell you that asking people whether they read the terms is close to worthless.

The stunts that are not evidence

Two stories circulate as though they were research. Neither is.

The “Herod clause” London WiFi experiment (2014), in which a public hotspot’s terms required users to surrender their eldest child, was run by the security company F-Secure with a research institute as a publicity exercise. We found no peer-reviewed publication, no preprint, no methods document and no dataset - only press coverage.

The GameStation “immortal soul” clause (1 April 2010) was an April Fools’ marketing stunt by a retailer. The figure of 7,500 shoppers comes from the retailer’s own announcement.

Both are memorable. Neither is a study, and neither should be cited as one. The same applies to the “91% accept without reading” figure that traces to a consultancy’s marketing survey, and to “only 1% read terms and conditions,” which traces to a commercial report we could not locate.

What this leaves you with

Nobody reads them, and the best evidence is behavioural rather than self-reported. One to two shoppers per thousand open a licence agreement when they do not know they are being watched.

The consent is real but the comprehension is not. In a laboratory, 98% of people agreed to hand over a child. In a replication, not one person in 500 noticed a clause about sharing their data with a national intelligence agency.

Age does not help. Adults over 50 took the shortcut slightly more often than students did.

Simplification, on the best randomised test, did not work. People spent four to six seconds on the text whatever its form and scored below chance on comprehension.

The two famous numbers need care. The 0.05% is a share of visits from a working paper, not a share of shoppers from the published article. The 244 hours is a model with stated assumptions, not a measurement.

For what a consent banner is actually doing and what accepting it does, see should I accept cookies. For friction built into leaving, see the roach motel dark pattern. For decline options framed to shame you, see confirmshaming. For the wider pattern, see the persuasive design guide.

Limitations of this article

The replication is by the same authors as the original, not an independent team.

We read the 2020 study’s figures in the authors’ own 2022 paper quoting them, plus a preprint, because the publisher denied access to the version of record. The preprint and published version disagree slightly on two numbers - the preprint gives 73 seconds for the privacy policy against the published 76, and slightly different required reading times. We print the published values as quoted by the authors. See the source-resolution record.

We could not open the published version of the Bakos article and have therefore attributed the 0.05%-of-visits figure explicitly to the 2009 working paper, and the one-to-two-per-thousand figure to the published article.

Ben-Shahar and Chilton is a working paper. We found no evidence it was published in a peer-reviewed journal, and we label it accordingly.

We did not open the primary studies behind the UK review’s simplification statistics, and present them as that review’s summary.

We could not extract the experimental sample sizes from the European Commission’s 2022 behavioural study on unfair commercial practices, which reported that 97% of the most popular websites and apps used by EU consumers deployed at least one dark pattern. We have not printed its experimental figures. See the withheld-figures record.