In many AI mental health tools, the moment of consent is a single tap on "I agree." The app opens, the conversation begins, and the question of what was actually agreed to often goes unasked. For someone reaching out at a vulnerable moment, that tap is doing a great deal of work. Research published this year shows that agreeing is not the same as understanding, and the difference shows up in three places: how data is used, who knows the tool is being used at all, and what the consent process is really asking of the person.

The terms of service problem

A commentary published in npj Digital Medicine in June 2026 takes aim at a quiet practice in digital mental health. Companies developing AI for mental health are increasingly training their models on transcripts of conversations with both human and AI therapists, and they often rely on lengthy terms of service to obtain the user's assent (Larrauri et al., 2026).

The authors argue that assent through terms of service lacks what informed consent requires. They separate three frameworks that tend to get blended together: informed consent for clinical research, which rests on disclosure, voluntariness, and comprehension; authorisation regimes for secondary use of data, which can dispense with individual consent altogether; and contractual assent embedded in terms of service. Because AI systems generate inferences from data and enable secondary uses nobody anticipated at the point of sign-up, the paper concludes that existing consent models do not adequately protect autonomy or confidentiality (Larrauri et al., 2026).

Their proposed remedy is specific. Consent to use patient data for model training should be separate and explicit, an opt-in that is clearly distinguished from consent to receive treatment, alongside patient-led governance over how that data is used (Larrauri et al., 2026). For a product team, the implication is practical: permission to use someone's data for training has to be requested on its own.

What young people are leaving unsaid

Consent depends on people being able to talk about what they are doing. A nationally representative survey published in JAMA Pediatrics in 2026 suggests that, for many young people, that conversation is largely absent. Among US adolescents and young adults who used AI chatbots for mental health advice, the majority, 63.3%, had not disclosed that use to anyone (McBain et al., 2026).

That finding changes what consent can mean in practice. When a young person's use is invisible to parents, clinicians, and friends, there is no one positioned to ask what the tool is, what it collects, or whether it is the right fit. The product's own consent flow becomes the only moment anyone considers the question.

The pattern extends beyond young people. A 2026 preprint surveyed adults with lived experience of mental health conditions, recruited through the National Alliance on Mental Illness. It found that only 14.7% of those who had a mental health provider had openly discussed their AI use with them (Notsu et al., 2026). The study is awaiting peer review, so the figure is a preliminary signal that later work may revise. The direction matches the other findings: AI use in mental health is happening largely outside the view of the people who might help someone make sense of it.

When the language is clear but the consent is thin

A bioethical evaluation published in Frontiers in Psychiatry in August 2026 examined four widely used AI mental health apps: Wysa, Youper, Amaha and Yuna. The authors argue that people should be transparently told about the existence and extent of AI's role in their care and that explicit consent should be obtained to protect their autonomy. In the apps reviewed, the consent language was generally understandable, but information about risks and limitations was often thin, and only Yuna explained them clearly during setup (Deveci and Ekmekci, 2026).

Plain language is where informed consent starts, and the standard asks for much more. A clearly worded notice cannot give someone a meaningful choice if data use is bundled into a single agreement, as the training-data commentary describes, or if the person has no one to talk it through with, as the disclosure research shows.

A study presented at the 2026 Designing Interactive Systems Conference adds another layer. Analysing app store reviews of four AI mental health chatbots, the researchers found that the roles and responsibilities of these tools remain ethically ambiguous in everyday use, with users actively interpreting, negotiating, and contesting what the systems should and should not do (Rahman and Chaudhry, 2026). Consent is hard to give when the thing being consented to is unclear, including to the people using it.

What this means for the field

Mental health tech has made real progress on access, and AI tools are good at being available. The research published this year puts a harder question to founders: when people reach these products, do they understand what they are agreeing to?

Read together, these studies point to a short list of questions worth asking before a product ships. Is consent to receive support separated from consent to have data used for training? Would a person who agreed to the first be surprised to learn about the second? What happens for a young person whose use no adult is aware of? And does the product describe its own role clearly enough that a user in a difficult moment could explain it back?

These are design decisions, and they are made well before anyone taps "I agree." The evidence now exists to make them deliberately. If you are working through these questions, join us on 12 November for the nest session on evaluating AI safety in digital mental health.

🪺

If you are finding this topic difficult on a personal level, support is available globally at findahelpline.com.