PaperlayerView exact revision on arXiv

Source-linked AI summary

(Un)informed Consent: Studying GDPR Consent Notices in the Field

Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, Thorsten Holz

arXiv:1909.02638v2cs.HCcs.CY

TL;DR

Cookie consent notices have become widespread, raising concerns that users may fatigue and make choices that are not meaningful. The paper catalogs notice designs and tests them with more than 80,000 visitors, finding that position, choice structure, nudging, and wording affect interaction and consent behavior.

  • Problem

    The paper addresses limited systematic evidence about how consent-notice design affects whether website visitors make free and informed choices.

  • Method

    The authors cataloged 1,000 notices and conducted a four-month field study with 82,890 visitors to test notice position, choices, nudging, and wording.

  • Results

    Notice position, choice structure, nudging, and wording affected consent behavior, with bottom-left placement receiving the most attention and privacy-default opt-in yielding less than 0.1 % acceptance for all purposes.

  • Takeaways & Limitations

    The findings support opt-in notices organized by purposes and indicate that regulation should guide how consent is obtained, not merely require consent.

  • Takeaways & Limitations

    The experiments used one German-language e-commerce website, whose visitors may not represent the general public, and exact dwell time was unavailable.

Abstract

from arXiv · show

Since the adoption of the General Data Protection Regulation (GDPR) in May 2018 more than 60 % of popular websites in Europe display cookie consent notices to their visitors. This has quickly led to users becoming fatigued with privacy notifications and contributed to the rise of both browser extensions that block these banners and demands for a solution that bundles consent across multiple websites or in the browser. In this work, we identify common properties of the graphical user interface of consent notices and conduct three experiments with more than 80,000 unique users on a German website to investigate the influence of notice position, type of choice, and content framing on consent. We find that users are more likely to interact with a notice shown in the lower (left) part of the screen. Given a binary choice, more users are willing to accept tracking compared to mechanisms that require them to allow cookie use for each category or company individually. We also show that the wide-spread practice of nudging has a large effect on the choices users make. Our experiments show that seemingly small implementation decisions can substantially impact whether and how people interact with consent notices. Our findings demonstrate the importance for regulation to not just require consent, but also provide clear requirements or guidance for how this consent has to be obtained in order to ensure that users can make free and informed choices.

1 INTRODUCTION

The paper studies how consent-notice design shapes whether visitors make meaningful choices about tracking. Using a large field study, it examines notice position, choice structure, nudging, and wording.

  • Research approach: 82,890 real website visitors participated in a four-month between-subjects field study on consent-notice interaction.The study used passive clickstream data and a voluntary follow-up survey.
  • Research questions: Notice position, choice structure, nudging, and wording substantially affected visitors’ consent behavior.The experiments tested position, number of choices, emphasis or pre-selection, privacy-policy links, and technical versus non-technical language.
  • Position: Bottom-left notices received the most interaction, whereas notices at the top of the screen yielded the lowest interaction rates.The authors attribute this mainly to the importance of the website content obscured by the notice.
  • Choice and nudging: More choices increased cookie refusals, while privacy-invasive defaults increased acceptance; under privacy-by-default, fewer than 0.1 % allowed cookies for all purposes.The findings indicate a trade-off between providing detail and overwhelming visitors, and show that nudging affects consent choices.
  • Language and information: Technical wording increased notice interaction but decreased the chance that users allowed cookie use, while privacy-policy links did not increase interaction.The study found that wording and links had weaker effects than notice position and choice structure.
  • User preferences and implications: Survey respondents favored category-based choices and transparent mechanisms, while some reported assuming that access required consent.The authors recommend opt-in notices organized by purposes and a unified solution offering more control than a simple yes–no choice.

2 CONSENT NOTICES

This section describes the legal context, prevalence, and interface properties of cookie consent notices. It catalogs common notice designs and shows that many provide limited meaningful choice while using nudging techniques.

  • 2.1 Background: The ePrivacy Directive requires consent before storing non-necessary information, while the GDPR requires consent to be freely given, specific, informed, and unambiguous.The GDPR also requires a clear affirmative act for agreement to processing personal data.
  • 2.1 Background: After the GDPR took effect, 62.1 % of 6,579 popular European websites displayed cookie consent notices, versus 46.1 % in January 2018.The increased prevalence contributed to consent fatigue and browser-based workarounds.
  • 2.2 Properties of Consent Notices: The study analyzed a random sample of 1,000 notices drawn from 5,087 notices collected from popular European websites.Researchers manually inspected the notices to identify eight user-interface variables.
  • 2.2 Properties of Consent Notices: Notice positions included four viewport corners, top, bottom, and center; bottom bars were most common at 57.9 %.On smartphones in portrait mode, limited space reduces the available positions to top, bottom, and middle.
  • 2.2 Properties of Consent Notices: Consent notices range from informational banners to confirmation-only, binary, category-based, and vendor-based mechanisms with increasing control granularity.Category-based notices let visitors allow or disallow cookie categories individually, while vendor-based notices provide finer-grained control.
  • 2.2 Properties of Consent Notices: In the sample, 86 % offered only a confirmation button, 57 % used nudging, 92 % linked to a privacy policy, and 39 % specified data-collection purposes.Only 21 % mentioned who could access the data, while 93 % did not block interaction with the underlying website.

3 METHOD

The paper studies how consent-notice design affects visitors’ interactions and consent behavior through three field experiments, while omitting several design parameters from evaluation.

  • 3 METHOD: The study investigates notice position, number of choices, nudging, privacy-policy links, and technical versus non-technical wording.The experiments vary position, choices and nudging, then wording and privacy-policy links.
  • 3 METHOD: The study did not evaluate blocking, formatting, or notice size because of partner-site constraints or difficulty varying them consistently.Blocking was excluded at the website owner’s request, formatting was held constant, and size was difficult to vary across devices.
  • 3 METHOD: Three between-subjects experiments tested notice variants while keeping other parameters constant within each experiment.Position was tested in Experiment 1, choices and nudging in Experiment 2, and wording and privacy-policy links in Experiment 3.
  • 3 METHOD: The field study ran on a German-language WordPress e-commerce website with real visitors.The partner website received 15,000–20,000 unique visitors per month, most arriving from search engines for product information and reviews.
  • 3 METHOD: The researchers modified the Ginger plugin to block cookies before opt-in, log consent, and support checkbox-based and no-option notices.Notice assignment was performed round-robin, and a browser cookie preserved each visitor’s assigned condition across visits.
  • 3 METHOD: Notice interactions, privacy-policy and survey clicks, page loads, and automatic survey replacement were recorded as log events.Non-interacting visitors received the survey invitation 30 seconds after page load, based on an assumption about typical interaction timing.

4 RESULTS

The cleaned dataset contained event logs from 82,890 unique visitors, and a small survey sample reported expectations about website data collection.

  • 4 RESULTS: 82,890 unique visitors contributed event logs across the three experiments.The experiment counts were 14,135, 36,530, and 32,225 visitors, respectively.
  • 4 RESULTS: 110 survey responses were received from 29,712 visitors who interacted with the notice or stayed longer than 30 seconds.The survey link was clicked 804 times, and 0.37 % of the relevant visitors participated.
  • 4 RESULTS: Survey participants most commonly expected the website to collect links clicked on the site (78 %), IP addresses (65 %), posts read (61 %), and device information (59 %).Only 5 % thought the website collected no data about them.

4.2 Experiment 1: Banner Position

Notice position strongly affected interaction: bottom-left notices received the most interactions, while the small top and bottom bars commonly observed in practice received few.

  • 4.2 Experiment 1: Banner Position: 37.1 % of visitors interacted with notices shown at the bottom-left, the highest rate across tested positions and device types.The bottom-left position was used in Experiments 2 and 3 after receiving the most attention on both desktop and mobile.
  • 4.2 Experiment 1: Banner Position: 2.9 % and 9.6 % interacted with the commonly observed small bars at the top and bottom, respectively.These positions resulted in low interaction compared with the bottom-left position.
  • 4.2.1 Interaction rates.: Banner position had the largest overall effect size among analyzed properties (Cramér’s V=.31).The analysis also considered ad blocker use, screen resolution, browser, operating system, and device type.
  • 4.2.1 Interaction rates.: 15.8 % of visitors without an ad blocker interacted with a notice, compared with 12.6 % of ad blocker users (CV=.11).Screen resolution had a larger desktop effect (CV=0.33) than mobile effect (CV=0.16).
  • 4.2.1 Interaction rates.: Only 5.5 % of visitors with desktop resolutions of 1,920 by 1,080 pixels or higher interacted, versus 25.6 % for smaller screens.Across all conditions, more users accepted cookies than declined them.
  • 4.2 Experiment 1: Banner Position: All six survey respondents who said the notice prevented them from reading the content had seen a notice positioned at the bottom or left.The qualitative evidence came from 16 Experiment 1 survey responses.

4.3 Experiment 2: Choices & Nudging

Experiment 2 found that consent choices were strongly shaped by the number of options and by nudging through highlighted or pre-selected defaults. More detailed notices generally produced more declining, while pre-selection substantially increased acceptance.

  • 36,395 participants completed Experiment 2, with each of nine conditions shown to 4,044 visitors on average.
  • Interaction rates: 55% was the highest interaction rate, measured for binary notices on mobile devices.Overall interaction ranged from 13.8% to 55.3%, with higher rates especially on mobile devices.
  • Nudging: CV=.50 measured the overall effect size between nudging and consent choice.Highlighted “Accept” buttons increased acceptance in confirmation-only notices, and pre-selected versions led around 30% of mobile and 10% of desktop users to accept all third parties.
  • Nudging: Less than 0.1% of visitors allowed cookies for all purposes in privacy-by-default opt-in conditions.In contrast, pre-selected versions led around 30% of mobile users and 10% of desktop users to accept all third parties.
  • Specific choices: 10.0% unchecked one or more vendors, compared with 6.9% who unchecked one or more categories.Few visitors selected specific categories or vendors when they were not pre-selected, although more selected vendors than categories.
  • Interaction time: 4–5 seconds was the median submission time for no-option, confirmation, and binary-choice notices, versus 7–8 seconds for category- or vendor-based notices.The authors report medians because interaction start times could not be measured reliably and submission times had high variability.

4.4 Experiment 3: Language & Privacy Policy Link

Experiment 3 tested whether wording about cookies versus data, and the presence of a privacy-policy link, affected consent behavior. Language had only a minor influence, while linking the policy was associated with more declines; position and choice mattered more.

  • Consent behavior: 0–0.1% of visitors accepted all categories, while 0.3–1.4% explicitly allowed one or more categories.Interaction rates were higher for mobile visitors.
  • Discussion: Mentioning cookies had a minor influence on consent behavior, and differences between conditions were small.More visitors declined cookies when a privacy-policy link was present.
  • Discussion: Position and choice had a more pronounced effect on consent behavior than notice language or pointers to additional privacy information.

4.5 Survey Results

The survey examined why visitors interacted with consent notices and how they understood accepting or declining cookies. Annoyance and misconceptions were common, while participants valued transparent, privacy-by-default choices but often found complex notices unclear or overwhelming.

  • Reasons for interaction: 44 of 61 participants who clicked the notice said annoyance motivated their interaction.Other reported motivations included expected site functionality, habit, privacy protection, security, and seeing fewer advertisements.
  • Reasons for non-interaction: 49 participants did not interact with the notice, including 20 who reported not seeing it.Others believed clicking would have no effect, did not care about cookies or data collection, or thought the notice offered too few choices.
  • Perception of complex notices: Participants valued selecting options directly and having non-necessary categories deactivated by default.One participant also said that having options made them feel secure.
  • Understanding consent: 28 of 94 responses expected declining cookies to prevent website access, while 29 of 94 expected accepting cookies to collect or process personal data.These responses show partial understanding alongside substantial uncertainty about consent consequences.
  • Understanding consent: Almost a quarter of participants thought they had to accept cookies before accessing a website.The authors connect this expectation to negative experiences on some sites and call for notices to explain which functionality may not work.

5 RELATED WORK

Related work documents the prevalence, design variation, usability problems, and dark patterns surrounding consent notices and privacy controls. Earlier studies also report limited understanding of cookies and only partial study of consent choice architectures.

  • Prevalence: Van Eijk et al. found that a website’s top-level domain was the primary factor in whether a consent notice appeared, rather than visitor location.
  • Functionality: 92% of 2,000 manually visited websites set at least one high-entropy cookie before showing any notice, while only 4% of notices provided…The supplied passage truncates the latter finding; it also reports that some consent libraries cannot block or delete cookies without substantial modification.
  • Notice design: Previous classifications covered notice information, offered choices, access blocking, and basic dimensions such as size, location, and word or button counts.
  • User perceptions: Kulyk et al. found that notice text did not significantly influence decisions to continue using a website, which instead depended on perceived trustworthiness and relevance.
  • Choice architectures: In Dutch panel data, 16% reported declining cookies often and 17% very often when given the opportunity.When acceptance or leaving was the choice, 12% and 13% reported refraining from using the site often and very often, respectively.
  • Understanding and control: Prior studies identified misconceptions about cookies and found that users value tools that help them understand and configure browser cookie settings.
  • Alternative controls: Users have found targeted-advertising opt-out tools difficult to locate, configure, and understand.
  • Dark patterns: Mathur et al. classified dark patterns as “sneaking,” “misdirection,” and “forced action.”

6 DISCUSSION

The discussion links consent outcomes to notice design, emphasizing position, choice architecture, wording, and unresolved limits in the study and wider ecosystem.

  • Position: A lower-left desktop or lower-screen mobile position significantly increases the chance that visitors make a consent decision.Experiment 1 found a substantial position effect on notice engagement.
  • Choices: Nudging accept buttons or pre-selecting checkboxes substantially affects cookie acceptance and interferes with consent decisions.The effect was especially pronounced for category- and vendor-based notices.
  • Choices: More visitors accepted cookies under a binary choice than declined, while rejection required additional effort in more granular notices.The authors connect this pattern to possible adverse effects of consent bundling.
  • Text: Mentioning “cookies” made more users reject data collection, whereas adding a privacy-policy link showed no effect in Experiment 3.The authors note that the negative effect may relate to users’ generally negative feelings about cookies.
  • Recommendations: The current consent ecosystem provides no real improvement for user privacy compared with pre-GDPR times, while regulatory and industry guidance remains unsettled.The authors note that GDPR has only partially affected how companies process personal data.
  • Limitations: The study’s German-language e-commerce sample may not represent the general public, and the field design lacked detailed visitor, notice-size, and dwell-time measures.The authors also report that the sample appeared more inclined to reject cookies.
  • Limitations: Many visitors did not interact with the notice and stayed briefly, while exact site dwell time could not be measured.The authors included users with fully loaded pages, producing many “no action” visitors.
  • Limitations: Voluntary survey responses are likely affected by self-selection, because respondents may have had stronger technical understanding or privacy interest.The authors considered this bias when interpreting the survey results.

7 CONCLUSION

The conclusion reports that cookie-notice design substantially shapes consent behavior and argues that meaningful privacy-by-default, purpose-based notices would sharply reduce active consent to third-party cookies.

  • 7 CONCLUSION: The field study found that position, offered choices, nudging, and wording substantially affect people’s consent behavior.Many current implementations do not use the available design space to offer meaningful choice.
  • 7 CONCLUSION: Less than 0.1 % of users would actively consent to third-party cookies under privacy-by-default and purpose-based consent principles.This conclusion is presented as an implication of the GDPR’s data-protection-by-default and purpose-based-consent principles.

A TIMING IN EXPERIMENT 2

This appendix section identifies Table 3 as reporting the average time until users submitted a decision in Experiment 2, restricted to decisions made within three minutes.

  • A TIMING IN EXPERIMENT 2: Table 3 reports average decision-submission time in seconds for Experiment 2 decisions made within the first three minutes.

B SURVEY AND RESPONSES

The survey appendix documents how participants’ notice perceptions, motivations, and expectations about cookie decisions were collected and coded.

  • Survey Measures: Participants explained their motivations for interacting with notices through free-text responses coded by two authors.
  • Survey Measures: Participants rated the displayed notice’s number of choices, control over website behavior, and difficulty of selecting an option.
  • Survey Responses: The motivation coding included transparency, privacy focus, clarity of options, and notice clarity among its categories.
  • Survey Responses: The survey included 94 participants: 60 from Experiment 2 and 34 from Experiment 3.
  • General Understanding: Participants were asked what they thought happened after clicking “Decline” or “Accept” on another cookie notice.
  • General Understanding: Among coded decline responses, 29.8 % believed the site would be blocked, while 11.7 % believed no personal data would be collected.
  • General Understanding: Among coded accept responses, 30.9 % mentioned personal-data collection, 24.5 % advertising, and 22.3 % continued site access.
Loading 1909.02638v2…