The Web’s Friction Problem Is Coming for AI

SAN FRANCISCO — Users increasingly encounter a web shaped by what software developers and designers call “friction”: security checks, consent pop-ups, and legal agreements that stand between them and online content. These mechanisms are intended to protect data privacy, block automated bot attacks, and shield corporations from legal liability, but industry experts warn that their accumulation is severely degrading the usability of the global web.

Account creation has added another obstacle. Publishers and e-commerce platforms often place content behind registration walls to build direct-to-consumer data pipelines and comply with marketing consent regulations. Users may then have to create passwords that meet complex, non-standardized security criteria.

The same registration flows frequently include sprawling Terms of Service (ToS) and End User License Agreements (EULAs). A 2020 study of popular consumer applications found that reading agreements for platforms such as TikTok or Zoom takes longer than reading classic literary works including Shakespeare’s *Macbeth*.

Under U.S. case law, the landmark ruling in *Specht v. Netscape Communications Corp.* (2002) established that online agreements are enforceable only when users receive “reasonable notice” of the terms. Corporate legal departments have consequently required users to scroll through entire agreements before clicking “accept,” adding friction during app updates and device integrations. Independent organizations such as “Terms of Service; Didn’t Read” (ToS;DR) now analyze and rate user agreements from Class A (very good) to Class E (very bad), with plain-English summaries of complex legalese.

The privacy side of this problem accelerated after the European Union’s General Data Protection Regulation (GDPR) took effect in May 2018. The law requires websites to obtain explicit, informed consent before tracking users or collecting personal data. The United States followed with the California Consumer Privacy Act (CCPA) in 2020 and its expansion, the California Privacy Rights Act (CPRA), in 2023. Similar privacy frameworks have since been enacted in Virginia, Colorado, and Connecticut.

Businesses facing GDPR penalties of up to 4% of global annual turnover rapidly deployed Consent Management Platforms (CMPs), including OneTrust and Cookiebot. The result was the fragmented system of multilayered consent banners and toggle switches now found across the web.

“`
+——————————————————————-+
| THE FRICTION LANDSCAPE |
+————————————+——————————+
| Challenge | Emerging Technical Solution |
+————————————+——————————+
| Fragmented Cookie Banners | Global Privacy Control (GPC) |
| Multi-Factor Authentication (MFA) | FIDO2 Passkeys / Biometrics |
| Image-Based CAPTCHAs | Frictionless Telemetry |
| Complex Click-Wrap Contracts | Standardized Rating Systems |
+————————————+——————————+
“`

Privacy advocates and technology consortia have promoted browser-level standards to reduce those banners. The Global Privacy Control (GPC) lets users set one universal privacy preference in browser settings. California law requires websites to recognize the GPC signal as a valid opt-out request, which could eliminate individual cookie banners on a site-by-site basis if adoption becomes widespread.

Cybersecurity has produced a separate layer of required interaction. Multi-factor authentication (MFA) became an industry standard for account security, generally using one-time passcodes sent by SMS or generated through authenticator apps. Traditional MFA methods, however, introduce significant friction and remain vulnerable to “MFA fatigue” or “push bombing.” Attackers who obtain a user’s password can repeatedly trigger verification requests until the user accidentally approves access, a technique notably used in the 2022 breach of Uber’s internal systems.

The FIDO (Fast IDentity Online) Alliance, an industry consortium founded in 2013 that includes Apple, Google, Microsoft, and Samsung, developed the WebAuthn standard to address those vulnerabilities and reduce user friction. WebAuthn underpins “Passkeys,” which use public-key cryptography and are tied directly to a user’s physical device. Native biometrics, including facial recognition or fingerprint scans, complete authentication without manual inputs and significantly reduce authentication time.

CAPTCHAs created another familiar interruption. The CAPTCHA, or Completely Automated Public Turing test to tell Computers and Humans Apart, was first developed by researchers at Carnegie Mellon University in 2000. Google acquired the prominent reCAPTCHA technology in 2009 and shifted it from a text-deciphering utility to an image-classification system.

For more than a decade, people have been asked to identify traffic lights, crosswalks, fire hydrants, and other objects in gridded images. The system blocked basic automated bots while also helping train machine learning and computer vision models used for autonomous vehicles and other AI applications.

A 2023 study by researchers at the University of California, Irvine, found that modern AI models could solve standard image-based CAPTCHAs faster and with higher accuracy than human test subjects. Traditional CAPTCHAs therefore became less effective as artificial intelligence advanced. Cloudflare’s Turnstile and similar tools now analyze subtle browser behavior, device characteristics, and network signals in the background, using invisible, telemetry-based bot detection instead of interactive puzzles.

Generative artificial intelligence is changing the balance again. OpenAI’s ChatGPT and Anthropic’s Claude have gained mainstream adoption while largely bypassing the traditional barriers of the open web. Their conversational interfaces provide direct, uninterrupted access, although legal experts and industry analysts suggest that this frictionless era may be short-lived as regulatory scrutiny and liability concerns grow.

The European Union officially approved the EU AI Act in May 2024. It is the world’s first comprehensive horizontal legal framework for artificial intelligence and imposes strict transparency, copyright compliance, and risk management obligations on developers of general-purpose AI.

“`
LOOMING REGULATORY PRESSURES ON AI
│
┌─────────────────────────┼─────────────────────────┐
▼ ▼ ▼
EU AI ACT (2024) SECTION 230 DEBATE LIABILITY SHIELDING
Strict transparency and Ongoing legal disputes Explicit medical, legal,
data tracking mandates over platform immunity and financial disclaimers
for foundation models. for AI-generated content. built into UI workflows.
“`

In the United States, debates over Section 230 of the Communications Decency Act of 1996 are examining whether AI-generated responses count as proprietary content created by the platform itself. Section 230 historically shielded internet service providers and platforms from liability for third-party content; a change in interpretation could strip AI developers of that immunity.

Professional liability is another concern for AI platforms. To prevent lawsuits involving medical, financial, or legal malpractice, developers may soon have to add explicit warning screens, verification steps, and customized liability waivers directly to chat interfaces.

Whether generative AI platforms can balance those compliance requirements with their current minimalist design philosophy remains one of the critical operational challenges for the next phase of the digital economy.