Why you accept terms you would refuse when fresh

A mobile-app onboarding placed the permissions request after five setup screens. Seventy-eight percent of users granted all permissions. When the same request appeared first, only forty-one percent granted them. The permissions were identical; the user’s capacity to read and refuse was not.

What everyone sees

Users believe they granted permissions because the app needed them. They describe the request as “standard” rather than intrusive. The five preceding screens — name, email, preferences, avatar, tutorial — are perceived as onboarding, not as a depletion ramp designed to exhaust the critical faculty before the privacy question arrives.

What is actually happening

Baumeister’s ego-depletion model explains that evaluating and refusing a request requires active self-regulation, which is finite and consumed by prior acts of deliberation. Acquisti and Grossklags’s privacy-fatigue research showed that users’ willingness to scrutinise privacy terms declines with the number of prior consent decisions they have made in the session. The permissions screen is placed where the scrutiny budget is lowest.

Why it stays hidden

The flow hides because onboarding feels welcoming. Each step is framed as personalisation, not as a willpower tax. The user experiences the sequence as helpful setup and does not connect their permissive behaviour at screen six to the five screens of cognitive work that preceded it.