PaperlayerView exact revision on arXiv

Source-linked AI summary

Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR

Dominique Machuletz, Rainer Böhme

arXiv:1908.10048v2cs.HCcs.CRcs.CY

TL;DR

Websites have incentives to reduce consent friction, raising questions about whether multi-purpose dialog design steers users toward choices they did not intend. A controlled experiment examines default-button and purpose-count designs, finding more acceptance and poorer recall with the highlighted default, but no significant effect from presenting one versus three purposes.

  • Problem

    Websites may optimize consent interfaces for positive decisions, creating a need to examine how multi-purpose dialog design affects users’ behavior and perceptions.

    Source: §1 · pp. 1–2

  • Method

    A controlled classroom experiment examined consent-dialog responses, including a highlighted select-all button and dialogs presenting different numbers of purposes.

    Source: §1 · p. 2, §4.1 · p. 6, §6.1 · p. 13

  • Results

    Participants exposed to the highlighted default accepted more purposes, recalled their choice less accurately, and more often regretted it and perceived deception; one versus three purposes had no significant effect on decisions or perceptions.

    Source: §6.1 · pp. 12–13

  • Takeaways & Limitations

    The findings suggest that consent-dialog design on popular websites might lead users to agree to more data-processing purposes than intended, informing interface and policy recommendations.

    Source: §7 · p. 14

    The experimental setup may not fully reflect users’ actual behavior regarding consent dialogs.

    Source: §6.2 · p. 13

Abstract

from arXiv · show

The European Union's General Data Protection Regulation (GDPR) requires websites to ask for consent to the use of cookies for \emph{specific purposes}. This enlarges the relevant design space for consent dialogs. Websites could try to maximize click-through rates and positive consent decision, even at the risk of users agreeing to more purposes than intended. We evaluate a practice observed on popular websites by conducting an experiment with one control and two treatment groups ($N=150$ university students in two countries). We hypothesize that users' consent decision is influenced by (1) the number of options, connecting to the theory of choice proliferation, and (2) the presence of a highlighted default button (``select all''), connecting to theories of social norms and deception in consumer research. The results show that participants who see a default button accept cookies for more purposes than the control group, while being less able to correctly recall their choice. After being reminded of their choice, they regret it more often and perceive the consent dialog as more deceptive than the control group. Whether users are presented one or three purposes has no significant effect on their decisions and perceptions. We discuss the results and outline policy implications.

1 Introduction

GDPR consent for data processing is purpose-specific, while websites have incentives to reduce friction and secure positive consent decisions. This study asks how users respond to multi-purpose consent-dialog design in their behavior and perceptions.

1 Introduction

  • Consent is one legal basis for processing personal data, and users agree to processing for specific purposes.Source: §1 · p. 1
  • GDPR enforcement prompted many operators to rethink cookie practices or seek consent before using cookies for purposes lacking another legal basis.Source: §1 · p. 1
  • Websites may seek to minimize friction and maximize positive consent decisions; observed dialogs use purpose checkboxes and buttons for selecting all purposes or confirming a manual selection.Source: §1 · pp. 1–2
  • The study asks how users react to design features of multi-purpose consent dialogs in their behavior and stated perceptions.Source: §1 · p. 2

2 Background

The background covers the legal requirements for purpose-specific consent and the varied technical and interface approaches used to seek privacy preferences. It also notes the practical and economic tensions surrounding those approaches.

2 Background

  • The illustrated real-world dialogs are blocking and begin with all items unchecked, implementing opt-in.Source: Figure 1 · p. 2

2.1 Legal Requirements for Consent Dialogs

  • GDPR consent must be freely given, unambiguous, informed, and withdrawable; when processing serves multiple purposes, users need distinct opt-in choices for each.Source: §2.1 · p. 2
  • Cookie purposes are commonly grouped into categories, but purpose models vary, leaving privacy-aware users to navigate each site’s specific model.Source: §2.1 · pp. 2–3

2.2 Technical Solutions for Seeking Consent

  • Privacy-notice research classifies design by timing, channel, modality, and control, while proposed privacy profiles aim to reduce the effort of choosing settings.Source: §2.2 · p. 3
  • Privacy-management systems propose advance preferences and consent forms, but broad applicability can be complex and usability testing found some users distrusted one system.Source: §2.2 · p. 3
  • Prior work also explored privacy tooltips, machine-readable preference languages, and reducing runtime permission requests to limit user attention demands.Source: §2.2 · pp. 3–4
  • The related field experiment studied non-blocking cookie banners, whereas this study examines blocking dialogs and stated attitudes; prior literature largely overlooks economic interests.Source: §2.2 · p. 4

3 Theory

The paper uses choice-proliferation research and theories of deception and social norms to motivate tests of purpose count and a highlighted default button. It defines effective consent by what the website records, not by whether it matches user intent.

3 Theory

  • The study derives predictions about purpose count from choice-proliferation theory and about a default button from social-norm and deception research.Source: §3 · p. 4

3.1 Choice Proliferation

  • Choice proliferation describes potential downsides of more alternatives, though more options may also better match preferences; this study varies purpose count and measures difficulty and regret.Source: §3.1 · pp. 4–5

3.2 Deception and Social Norms

  • Defaults can signal a descriptive social norm, yet privacy defaults may disclose more than users prefer; deceptive or asymmetric design can steer decisions through interface cues.Source: §3.2 · pp. 5–6

3.3 Hypotheses

  • The study tests whether a highlighted select-all default increases effective consent and subsequent regret and perceived deception, and whether multiple purposes increase response time and perceived difficulty.Source: §3.3 · p. 6
  • “Effective consent” means the consent recorded by the website, regardless of whether it matches the user’s true intention.Source: §3.3 · p. 6

4 Method

The study used a controlled experiment with three consent-dialog conditions, followed by an exit questionnaire, to examine participants’ choices and perceptions. Data were collected from 150 valid cases in classroom sessions at two universities.

4.1 Instrument

  • The instrument compared a three-purpose dialog with a highlighted “Select all and confirm” button, a one-purpose dialog, and a three-purpose control without a highlighted default.The highlighted button accepted all purposes regardless of checkbox selections; the other button confirmed only actively selected settings.Source: §4.1 · pp. 6–7
  • Participants completed a flight-search task on a mock-up website, then recalled their cookie settings and answered questions about the dialog and their perceptions.The questionnaire measured perceived deception, difficulty, privacy attitudes, and regret; regret was assessed both before and after participants were reminded of their effective settings.Source: §4.1 · p. 7

4.2 Pretests

  • 20 Austrian undergraduates tested the survey in a computer lab, prompting changes to instructions, quiet-work guidance, and timestamp collection.Two earlier one-on-one think-aloud pretests also led researchers to rearrange the instructions so participants focused on flights before seeing the website.Source: §4.2 · pp. 7–8

4.3 Survey Administration

  • Participants at the Austrian and German universities received the German-language instrument and were randomly assigned a dialog during the flight-search task.They began the questionnaire almost simultaneously after a classroom prompt; completion took an average of 6 minutes 34 seconds.Source: §4.3 · p. 8

4.4 Research Ethics

  • The study used approved deception by withholding its cookie-notice focus until debriefing, while participation remained voluntary and anonymous.The researchers also avoided storing cookies and transmitted only data relevant to the research purpose.Source: §4.4 · p. 9

4.5 Descriptive Statistics

  • After deleting 8 records with more than four missing critical-construct responses and replacing 20 missing values across 13 remaining records by observed-item means, the analysis used 150 valid cases.Source: §4.5 · p. 9
  • 68.0% of participants correctly explained browser cookies, and the measured constructs had Cronbach’s α values above 0.7.The authors judged parametric t-tests suitable after inspecting normality and reporting that no Kolmogorov–Smirnov test rejected normality at the 1% level.Source: §4.5 · p. 10

5 Results

The hypothesis tests found that the highlighted default increased the number of purposes participants accepted, while the number of purposes offered did not significantly affect perceived difficulty. Post-hoc analyses also found differences in recall accuracy, declined-all choices, and the relationship between privacy attitudes and consented purposes.

5.1 Hypothesis Tests

  • On a 0–3 count of effectively accepted purposes, deceptive-dialog participants consented to more than controls (Kruskal–Wallis χ2(1) = 7.2, p < 0.01); they were also more likely to accept all three (χ2(1) = 9.05, p < 0.005).The deceptive default’s effect on agreeing to no or all purposes was about 20 percentage points.Source: §5.1 · p. 10
  • Regret increased significantly after participants learned their choice in the deception group, and perceived deception was significantly higher than in the control group.The before/after regret difference was not significant in the control group.Source: §5.1 · p. 11, Figure 4 · p. 12
  • Default-button clickers reported significantly higher post-notification regret than other T1 participants, but perceived deception did not differ significantly.The authors suggest some participants recognized the button’s deceptive effect before clicking it.Source: §5.1 · p. 11
  • χ2(1) = 8.89, p < 0.005: the reduced-choice group spent about five seconds less responding than the deception group; the reduced-choice and control groups also differed significantly.The deception and control groups, which offered the same number of purposes, did not differ significantly in response time.Source: §5.1 · p. 11, Figure 5 · p. 12
  • Perceived difficulty did not differ significantly between the treatment groups presented with different numbers of purposes (t(95.99) = 0.16, p = 0.88, d = 0.07).The authors therefore rejected H4.Source: §5.1 · p. 11

5.2 Post-hoc Analyses

  • Recall accuracy differed significantly among all three groups (χ2(2) = 11.01, p < 0.005), though the passage does not report the direction of the differences.Participants were asked to recall their choices at the beginning of the questionnaire.Source: §5.2 · p. 12
  • 50% of control participants declined all purposes, compared with 32% in the deception group; awareness of the decline-all option did not differ significantly between groups.Only 32% of participants who agreed to at least one purpose said they knew they could decline all purposes.Source: §5.2 · p. 12
  • Among participants shown all three purposes, privacy attitudes had a weak negative correlation with the number of purposes consented to (rs = −0.23, p < 0.05, n = 102).Privacy attitudes did not differ significantly between participants who clicked the deceptive button and those who did not.Source: §5.2 · p. 12

6 Discussion

Highlighted all-purpose defaults increased consent for more purposes and were associated with poorer recall, more regret, and greater perceived deception. The discussion also qualifies the findings’ scope and describes practical and research responses.

6.1 Summary and Interpretation

  • Highlighted all-purpose defaults increased accepted purposes, while users recalled their choices less accurately, more often regretted them after disclosure, and perceived the dialog as more deceptive.The authors interpret the recall and regret findings as casting doubt on the morality and legitimacy of the design.Source: §6.1 · pp. 12–13
  • The number of purposes significantly affected response time, but not perceived difficulty; participants handled three purposes without the predicted negative effects, though the critical number and choice structure need study.The authors caution that further research is needed to identify a critical number of purposes.Source: §6.1 · p. 13
  • Users with stronger stated privacy attitudes consented to fewer purposes, but the authors caution that their instrument confounds this link with the default-button effect and measures attitudes narrowly and after recall.They also note that attitude–behavior links are difficult to interpret when behavior may be partly unintentional.Source: §6.1 · p. 13

6.2 Validity and Limitations

  • An August 2018 snapshot found 7% blocking and 8% multiple-purpose notices, shares likely rising in 2019; the study instead targeted under-researched, blocking opt-in controls.The authors say the stimulus was not chosen to represent the most prevalent design, but to study elementary choices in multi-purpose dialogs.Source: §6.2 · p. 13
  • Free-text checks found only one participant showed demand characteristics, but the classroom setup and German-speaking computer-science student sample constrain claims about actual broader-user behavior.The authors replicated the experiment at two geographically distant universities to mitigate disadvantages of convenience sampling.Source: §6.2 · pp. 13–14
  • Two-university results supported H1–H3 in both populations, though German groups could number fewer than 20 and conservative two-sided tests put some p-values above 5%.The robustness table reports p-values by experiment location, but the supplied caption gives no cell values.Source: Table 6 · p. 13, §6.2 · p. 14

6.3 Recent Developments

  • The authors propose changing the button text and function after a checkbox is selected to avoid wasting users’ effort, but say a larger study must test whether it reduces disappointment.The proposed change is from “Select all and confirm” to “Select and confirm.”Source: §6.3 · p. 14
  • Other observed dialogs use pagelong affiliate lists and hide hundreds of options behind “Show purposes,” prompting calls for tailored studies of deception and choice proliferation.One example is a meeting-scheduling service dialog with a prominent “I accept” button.Source: §6.3 · p. 14

7 Conclusion

The conclusion presents evidence that consent-dialog design elements might deceive users into agreeing to more purposes than intended, and proposes privacy-aligned defaults and privacy-agent-based alternatives.

7 Conclusion

  • The study provides empirical evidence that consent-dialog design elements might deceive users into agreeing to more data-processing purposes than intended.Source: §7 · p. 14
  • Defaults should reflect either a privacy-aware safe choice or the majority’s preferences as a descriptive social norm, with best-practice dialogs offered as templates.Source: §7 · pp. 14–15
  • A revisited website’s checkbox logic had changed by fall 2019, illustrating the dynamics of consent-dialog practices.Source: §7 · p. 14
  • Further empirical research is needed before court decisions clarify whether observed practices fail GDPR consent requirements, and dialog mandates may not suit non-customer-facing services.Source: §7 · p. 15
  • The paper proposes shifting dialog design from data controllers to user-agent developers, with interoperability for users’ chosen privacy agents.Source: §7 · p. 15

8 Appendix

The appendix supplies German-language consent-dialog materials and questionnaire-related figures, plus a table of German construct items.

8 Appendix

Loading 1908.10048v2…