What really happens when you accept terms and conditions without reading them?

When you accept terms and conditions without reading them, you are signing a contract of adhesion with real legal effects: you are typically authorizing the processing of your personal data, sometimes its transfer to third parties, licenses over the content you upload, automatic renewals, and limitations on your claims. In Colombia, Law 1581 and the Consumer Statute set limits on what those clauses can require from you.

It is the most repeated lie on the internet: 'I have read and accepted the terms and conditions.' We say it several times a week, we have said it hundreds of times in our lives, and it is almost never true. It is not about laziness:

A study by Carnegie Mellon University calculated that reading the privacy policies of all the services used by an average person would take more than 200 hours a year, the equivalent of a full month of working days dedicated exclusively to the fine print.

Companies know this, the lawyers who draft those documents know this, and yet every click on 'Accept' constitutes a contract with real legal effects. In this article, we explain exactly what those agreements are, what you are authorizing without knowing it, what protections Colombian law provides you, and how to safeguard both your personal information and your company's.

Terms and conditions (also called terms of use, end-user license agreement, or EULA) are a contract of adhesion: an agreement drafted unilaterally by one party, which the other can only accept or reject as a whole, without the possibility of negotiation. By checking the box or pressing the button, you manifest your consent and become bound by its clauses, exactly as if you were signing a paper document before a notary.

Did this happen in your company? If the problem is with your organization, write to us on WhatsApp and a specialist will respond during office hours.

Alongside them, the privacy or data processing policy usually appears, which describes what information the service collects, for what purpose, with whom it shares it, and for how long it retains it. Both documents operate together: one defines the rules of the service and the other, the destination of your data.

The design of these documents is not innocent. Their length, technical language, and the timing of their appearance (just when you want to start using the application) are designed for the user to accept quickly. The industry even has a name for the design techniques that push the user to decide against their own interest: dark patterns.

At T.I. RESCUE, we audit your Shadow IT and safeguard your data under ISO 27001. Write to us and we will find out together.

Several companies have publicly demonstrated how blindly we sign. In 2010, the British video game store GameStation added an 'immortal soul clause' to its terms: upon completing the purchase, the customer ceded to the company the rights to their soul in perpetuity. It was an April Fools' joke. That day, 7,500 people accepted it without noticing.

In 2017, the public Wi-Fi company Purple inserted a 'community service clause' in its connection terms: whoever accepted it committed to 1,000 hours of work such as cleaning portable toilets at festivals and unclogging sewers. 22,000 people accepted it. Only one read the complete document and claimed the prize the company had hidden for whoever did so.

And in 2014, a cybersecurity firm installed a free Wi-Fi point in London whose terms included the so-called 'Herod clause': in exchange for the connection, the user handed over their firstborn son. Several people accepted it within minutes.

None of those clauses was legally enforceable, but the experiment proves the central point: the consent we give on the internet is, in practice, blind consent. And while joke clauses are not enforced, real ones are.

Behind the 'Accept' button, authorizations with very concrete consequences are often hidden:

• License over your content. Many social networks and applications reserve a worldwide, free, transferable, and sublicensable license over everything you upload. Your photos and videos remain "yours" on paper, but the platform can use, reproduce, modify, and transfer them to third parties. In recent years, this license has expanded to a new use: training artificial intelligence models with your content. • Sharing your data with "third parties and commercial partners." This elastic phrase can cover hundreds of companies: advertisers, data brokers, subsidiaries, and "strategic partners." Your email, location, browsing history, purchasing habits, and even your contact list may circulate far more than you imagine. • Disproportionate permissions. The flashlight app that demands access to your contacts, the game that requests the microphone, the photo filter that requires your precise location. By accepting the terms, you authorized the entire package, whether the application needs it to function or not. • Unilateral modification. Most of these contracts include a clause allowing the company to change the terms at any time. What you accepted today may be something different in six months, and your only notification will be an email that you probably won't read either. • Waiver of legal action. Many platforms incorporate mandatory arbitration clauses or foreign jurisdiction: if a conflict arises, you waive your right to sue before your natural judges and agree to resolve it on the company's chosen ground, language, and rules.

Schedule a free information security diagnostic with our experts.

Here is the good news: in Colombia, accepting terms and conditions does not eliminate your fundamental rights over your personal data. Law 1581 of 2012, known as the habeas data law, along with its regulatory decree, establishes that the data subject always retains the right to know, update, rectify, and request the deletion of their data, as well as to revoke the authorization granted, unless a legal or contractual obligation prevents it.

The law also requires that authorization for data processing be prior, express, and informed: the company must clearly tell you what data it collects and for what purpose. Generic or open-ended purposes do not constitute valid authorization. The Superintendency of Industry and Commerce (SIC), the authority in this matter, has sanctioned companies for collecting data without proper authorization, using it for purposes different from those informed, or failing to respond to data subject requests.

In other words: the click on "Accept" is not a blank check, although many companies treat it as such. But exercising those rights requires two things that most users do not have: knowing they exist and knowing what they signed.

So far we have talked about the individual user, but the problem scales dangerously in the corporate environment. Think about how many "free" tools employees of an organization use without anyone reviewing their terms: the online PDF converter where someone uploaded a confidential contract, the free artificial intelligence where they pasted the customer database "to have it organized," the browser extension that reads everything that passes on the screen.

Each of those clicks on "Accept" can mean that sensitive company information (customer data protected by habeas data, financial information, intellectual property, credentials) was authorized to travel to servers in another country, under the laws of another country, for purposes that no one read. This phenomenon is known as Shadow IT: technology adopted by employees outside the IT department, and it constitutes one of the most common and least visible information leaks in organizations. The serious part is that, under Colombian law, the company remains responsible for the processing of its customers' data, even if the leak occurred due to an individual employee's decision.

The solution is not to read every document in full, but to read strategically:

• Look for keywords. Before accepting, use the browser's search function (Ctrl+F) on the document: "third parties," "share," "transfer," "license," "advertising," "international." In two minutes, you can identify the clauses that affect you the most. • Question the permissions. If an app requests access it does not need for its main function, that is all the reading you need: do not install it or deny the permissions from the device settings. • Exercise your rights. Remember that in Colombia you can request any company to delete your data or revoke the authorization, and file a complaint with the SIC if they do not respond. • In the company, turn the click into a process. Define which tools are approved, what type of information can never be uploaded to external services, and who reviews the terms and data policy before adopting any software. This transforms hundreds of individual blind decisions into a single informed and documented decision.

Terms and conditions exist because consent matters, but the current system has turned that consent into an empty formality. Between licenses on your content, data traveling to third parties, and employees accepting terms on behalf of entire organizations, the 'Accept' button has become one of the most underestimated risk surfaces in digital life. Next time you see it, remember: 7,500 people sold their soul on April Fools' Day for not dedicating two minutes to it. Your data, your photos, and your company's information are worth much more than that.

Subscribe to Our Blog: Stay up to date with the latest news and tips in cybersecurity. Subscribe now.