Source-linked AI summary
Dark and Bright Patterns in Cookie Consent Requests
Paul Graßl, Hanna Schraffenberger, Frederik Zuiderveen Borgesius, Moniek Buijzen
TL;DR
The authors examine whether design nudges in cookie consent requests affect users’ consent decisions and perceived control, given concerns that dark patterns may undermine EU privacy law. Two experiments tested default, aesthetic-manipulation, and obstruction nudges toward the privacy-unfriendly option, then reversed their direction toward the privacy-friendly option. In Experiment 1, dark patterns had no clear choice effects attributable to them, while obstruction increased perceived control; in Experiment 2, two of three nudges substantially affected consent choices in the hypothesized direction.
Problem
The authors examine whether design nudges in cookie consent requests affect users’ consent decisions and perceived control, given concerns that dark patterns may undermine EU privacy law.
Source: §1 · p. 2, §2.3 · p. 16Method
Two experiments tested default, aesthetic-manipulation, and obstruction nudges toward the privacy-unfriendly option, then reversed their direction toward the privacy-friendly option.
Source: §1.1 · p. 4, §3.3 · p. 23Results
In Experiment 1, dark patterns had no clear choice effects attributable to them, while obstruction increased perceived control; in Experiment 2, two of three nudges substantially affected consent choices in the hypothesized direction.
Source: §2.3 · p. 16, §4.1 · p. 24Takeaways & Limitations
The findings suggest that many current cookie consent implementations do not enable meaningful choices, and the authors discuss possible policy responses.
Source: §4.4 · p. 28The privacy-calculus account of rational choice excludes small time differences between options, although such differences can be central to a design nudge.
Source: §4.3 · p. 27
Abstract
from arXiv · showhide
Dark patterns are (evil) design nudges that steer people's behaviour through persuasive interface design. Increasingly found in cookie consent requests, they possibly undermine principles of EU privacy law. In two preregistered online experiments we investigated the effects of three common design nudges (default, aesthetic manipulation, obstruction) on users' consent decisions and their perception of control over their personal data in these situations. In the first experiment (N = 228) we explored the effects of design nudges towards the privacy-unfriendly option (dark patterns). The experiment revealed that most participants agreed to all consent requests regardless of dark design nudges. Unexpectedly, despite generally low levels of perceived control, obstructing the privacy-friendly option led to more rather than less perceived control. In the second experiment (N = 255) we reversed the direction of the design nudges towards the privacy-friendly option, which we title "bright patterns". This time the obstruction and default nudges swayed people effectively towards the privacy-friendly option, while the result regarding perceived control stayed the same compared to Experiment 1. Overall, our findings suggest that many current implementations of cookie consent requests do not enable meaningful choices by internet users, and are thus not in line with the intention of the EU policymakers. We also explore how policymakers could address the problem.
1 INTRODUCTION
Cookie consent requests are meant to support informed privacy choices, yet EU privacy law and privacy-calculus theory assume deliberation despite evidence that users often rely on heuristics. The paper tests whether dark and bright design nudges affect consent decisions and perceived control.
1 INTRODUCTION
- Consent requests combine information asymmetry, ambiguous language, and cognitive biases, conditions that may encourage heuristic decisions targeted by dark patterns.The introduction contrasts System 1’s quick, heuristic judgments with System 2’s slow, conscious reasoning.Source: §1 · pp. 2–3
- Prior research on dark patterns in privacy settings was limited by nonrepresentative samples or contexts, and did not resolve how to address repeated consent requests.The authors frame their experiments as addressing this gap and examining whether users perceive control through consent requests.Source: §1 · pp. 3–4
1.1 Experiment 1: Dark patterns in cookie consent requests
- Experiment 1 asks whether nudges toward the privacy-unfriendly option affect consent choices and perceived control when the privacy-friendly option is rationally superior.It focuses on default, aesthetic manipulation, and obstruction, and explores whether deliberation moderates their effects.Source: §1.1 · pp. 4–5
1.2 Experiment 2: Bright patterns in cookie consent requests
- Experiment 2 reverses the nudges toward the privacy-friendly option to test their effects on consent behavior and perceived control.The paper calls these privacy-friendly nudges “bright patterns” and asks whether they change the default behavior observed in Experiment 1.Source: §1.2 · pp. 5–6
2.1 Method
The authors ran a within-subjects online study using cookie consent requests embedded in mock news websites, then measured consent choices and perceived control. They recruited UK adults and analyzed outcomes with Bayesian mixed-effects models.
2.1.1 Procedure and Design
- Participants reviewed eight news websites in random order, each presenting a two-option cookie request, and later rated perceived control and deliberation for each request.The study used a cover story about first impressions of website design; participants’ consent choices were recorded.Source: §2.1.1 · pp. 6–7
2.1.2.1 Web application
- The study application used adapted news templates and a pilot test to check whether its cover story was credible.The application was built with Flask and included functionality for multi-step consent requests.Source: §2.1.2.1 · p. 7
2.1.2.2 Consent requests
- Consent requests preserved core text while varying design details and the presence of default, aesthetic-manipulation, and obstruction nudges.Obstruction replaced “Do Not Agree” with “Manage options”; the baseline had none of the nudges.Source: §2.1.2.2 · pp. 7–8, Figure 1 · p. 8
2.1.2.3 Measures
- Perceived control was measured with five adapted scale items; participants also reported deliberation, privacy concerns, whether they read requests, and whether they recalled their choice.For 40.3% of consent decisions, participants reported not reading the information at all.Source: §2.1.2.3 · p. 9, Table 1 · p. 10
2.1.3 Participants
- Experiment 1 recruited 228 UK-based adults aged 18–65 through Prolific Academic, and all participants’ data were retained for analysis.Thirty-five participants dropped out between study parts, but the authors found no prevalent missingness pattern.Source: §2.1.3 · pp. 10–11
2.1.4 Data Analyses
- The analyses used Bayesian mixed-effects models for consent decisions and perceived control, with participant-level random effects and privacy concerns as a control.Experiment 1 was rerun using Bayesian modeling for consistency with Experiment 2; the reported pattern did not differ from the frequentist analysis.Source: §2.1.4 · pp. 11–12
- Exploratory models added deliberation as a moderator of each design nudge, with participant-level random slopes for deliberation and its interactions.The models used weakly informative priors because prior literature offered little guidance on expected effect sizes.Source: §2.1.4 · pp. 11–12
2.2 Results
In Experiment 1, most participants agreed to the consent requests, and the three dark-pattern nudges showed no substantial effect on consent decisions. Obstruction unexpectedly increased perceived control, while deliberation did not substantially alter the effects of the nudges.
2.2.1 Main Analyses
- 93.8% of participants agreed to the requests, and only 4.0% changed their consent behaviour between conditions.Most participants chose the same consent option for each news website.Source: §2.2.1 · pp. 12–13, Figure 3 · p. 13
- Default, aesthetic manipulation, and obstruction showed no substantial effect on consent decisions.The reported odds ratios were 1.64 for default, 1.45 for aesthetic manipulation, and 2.47 for obstruction.Source: Figure 2 · p. 13, §2.2.1 · p. 14
- Obstruction slightly increased perceived control, whereas default and aesthetic manipulation showed no supported effects.Obstruction: β = 0.11 (0.03), CrI 95% [0.05, 0.17], OR = 1.11.Source: §2.2.1 · p. 14, Figure 4 · p. 14
- Perceived-control scores showed a floor effect, with many observations at the scale’s lower boundary.The authors note that the slider’s default position (“Not at all”) may have contributed to generally low scores.Source: §2.2.1 · p. 15, Figure 5 · p. 15
2.2.2 Exploratory Analyses
- Deliberation did not substantially change the effects of the three dark patterns on consent decisions or perceived control.Participants reported low deliberation (M = 20.99, SD = 25.33), and the authors caution that the slider’s default position may affect these scores.Source: §2.2.2 · pp. 15–16
2.3 Discussion
Most participants agreed to all requests and reported little control, but the analyses did not clearly attribute those patterns to the dark nudges. The authors suggest habitual consent behaviour as one possible explanation and tested reversed nudges in Experiment 2.
2.3 Discussion
- Obstruction increased perceived control, but generally low scores mean more evidence is needed to interpret this association.This pattern appeared despite the majority choosing the privacy-unfriendly option and reporting a lack of control across conditions.Source: §2.3 · p. 16
- Participants often agreed without reading or deliberating much, which the authors say does not match the deliberate decision-making assumed by EU privacy law.They suggest routine exposure to consent requests and tracking walls may condition users to choose their usual option.Source: §2.3 · pp. 16–17
- Experiment 2 reversed the nudges toward the privacy-friendly option to test whether this changed the behaviour observed in Experiment 1.The follow-up also further investigated obstruction’s unexpected association with increased perceived control.Source: §2.3 · p. 17
3.1 Method
Experiment 2 retained the original study’s general procedure and design while reversing the nudges toward the privacy-friendly option. It added privacy-fatigue measurement and used the same analysis approach for one-to-one comparison.
3.1 Method
- The paper reports the differences from Experiment 1 rather than repeating the original study description.Preregistration, study materials, data, and analysis scripts were made available on the Open Science Framework.Source: §3.1 · p. 17
3.1.1 Procedure and Design
- The preregistered follow-up retained Experiment 1’s general procedure and design, with privacy fatigue added to the second part of the study.The privacy-fatigue questionnaire preceded the assessment of general privacy concerns.Source: §3.1.1 · p. 17, §3.1 · p. 17
3.1.2.1 Consent requests
- The nudges targeted “Do Not Agree”: a preselected option, a blue button, or an obstructive “Manage options” step.Avision was the baseline without any of the three nudges; Figure 6 shows a Webmag example.Source: §3.1.2.1 · pp. 17–18, Figure 6 · p. 18
3.1.2.2 Measures
- Experiment 2 retained Experiment 1’s measures and added a six-item privacy-fatigue scale as a control variable.Privacy fatigue had acceptable internal consistency (raw Cronbach’s α = 0.71); perceived control had raw α = 0.98.Source: §3.1.2.2 · pp. 18–19
3.1.3 Participants
- The researchers recruited 255 Prolific Academic participants, using Experiment 1’s sample-size basis and inclusion criteria.Fifty-eight participants dropped out after reviewing the websites; their data were eligible for analysis, and no prevalent missingness pattern was detected.Source: §3.1.3 · p. 19
3.1.4 Data Analyses
- The analysis followed Experiment 1’s approach and model structures to enable one-to-one comparison.Two additional exploratory models used privacy fatigue instead of privacy concerns as the control variable.Source: §3.1.4 · p. 19
3.2 Results
In Experiment 2, privacy-friendly defaults and obstruction shifted consent decisions toward “Do Not Agree,” while aesthetic manipulation had no notable effect. The perceived-control pattern persisted, and exploratory analyses found no substantial moderation by deliberation or change when privacy fatigue replaced privacy concerns as a control.
3.2.1 Main Analyses
- Obstruction had a small positive effect on perceived control (β = 0.06, OR = 1.06), whereas default and aesthetic manipulation had no notable effects.The pattern replicated Experiment 1: obstruction led participants to report more, rather than less, perceived control.Source: §3.2.1 · p. 21, Figure 9 · p. 22
3.2.2 Exploratory Analyses
- Deliberation did not substantially influence the effects of the three bright patterns on consent decisions or perceived control.Participants again reported generally low deliberation (M = 20.99, SD = 25.33).Source: §3.2.2 · p. 22
- Replacing privacy concerns with privacy fatigue as a control variable did not change the pattern of results.Higher privacy concerns were associated with lower likelihood of agreeing, while higher privacy fatigue was associated with greater likelihood of choosing “Agree”.Source: §3.2.2 · pp. 22–23
3.3 Discussion
Reversing the nudges toward privacy-friendly options was accompanied by substantially more changes in consent behavior, with defaults and obstruction shifting choices toward “Do Not Agree.” Perceived control remained generally low, and obstruction again coincided with reports of greater control.
3.3 Discussion
- Reversing the nudges coincided with about ten times more participants changing consent behavior between conditions than in Experiment 1.The authors note that the direction of the design nudges was the only change between experiments.Source: §3.3 · p. 23
- Privacy-friendly defaults and obstruction made participants more likely to choose “Do Not Agree,” while many participants in Experiment 1 had agreed by default.The authors suggest that repeated exposure to ambiguous or take-it-or-leave-it cookie requests may have conditioned automatic agreement.Source: §3.3 · p. 23
- Perceived control was generally low in both experiments, but obstruction led participants to report more rather than less control.The authors suggest that the “Manage options” wording may have conveyed a feeling of control.Source: §3.3 · p. 23
4 GENERAL DISCUSSION
Across experiments, design nudges affected consent choices asymmetrically, while perceived control remained low and responded unexpectedly to obstruction. The discussion weighs possible remedies and identifies limitations of the experiments.
4.1 Summary and theoretical implications
- Dark patterns did not appear to change consent choices in Experiment 1, while two of three bright-pattern nudges shifted choices toward the privacy-friendly option in Experiment 2.Because the experiments differed only in the direction of the nudges, the authors suggest that design nudges influence privacy choices after all.Source: §4.1 · p. 24
- Across both experiments, participants reported low perceived control, yet hiding an option behind “Manage options” was associated with higher perceived control.The authors suggest that the wording may have conveyed an unjustified feeling of control, an “illusion of control.”Source: §4.1 · p. 24
4.2 Practical implications
- Bright patterns can steer users toward privacy-friendly choices without requiring motivation, but may still encourage unreflective defaults or reduce perceived control.The authors distinguish nudging through choice architecture from boosting users’ competence.Source: §4.2 · p. 25
- Educative nudges such as choice-consequence feedback depend on company implementation, which may be undermined by firms’ incentives to collect data.The authors note that companies could sabotage required pro-privacy nudges.Source: §4.2 · p. 25
- Long-term boosts could build decision skills, but they cost more than changing defaults and work only when users are motivated to learn.One proposed procedural rule is to read the information in a consent request before choosing.Source: §4.2 · p. 25
- User-focused approaches seem unrealistic for cookie consent because motivation to deliberate may be low and companies with tracking interests may not implement effective pro-privacy nudges.The authors also caution that banning dark patterns alone may not resolve the problem: most participants agreed to tracking even in Experiment 1’s baseline condition.Source: §4.2 · pp. 25–26
- The proposed ePrivacy Regulation’s “Do Not Track” signals could reduce repeated consent requests, although adoption remained uncertain in the paper’s account.The proposal also bans tracking walls; the authors suggest that additional rules may be needed to prevent companies from asking users to override a do-not-track setting.Source: §4.2 · p. 27
4.3 Limitations and suggestions for future research
- The experiments had design and measurement limits, including option placement, omitted time costs in the rational-choice calculation, radio-button interfaces, and delayed perceived-control ratings.The Agree option was nearer the Continue button; the radio buttons enabled preselection, and the control measure followed review of all eight websites. The choice setup also balanced ecological validity against experimental control, and some request details were adapted to fit the websites.Source: §4.3 · pp. 27–28
APPENDIX A
Appendix A lists the software and R packages used for the analyses and reporting.
APPENDIX A
- The analyses and reporting used R version 4.0.2 and the brms package version 2.13.5.The passage also lists packages for data manipulation, visualization, reporting, and other analysis tasks.Source: Appendix A · p. 36
- The listed toolkit includes packages such as dplyr, ggplot2, and tidybayes.The full list also includes colorspace, gridExtra, kableExtra, knitr, and others.Source: Appendix A · p. 36
- The passage gives package versions and bibliographic references for the software used.Source: Appendix A · p. 36
APPENDIX B
Appendix B presents examples labeled as the baseline and default conditions.
APPENDIX B
- Figure B1 is labeled Example Condition 1, Baseline, for website Avision.Source: Figure B1 · p. 37
- The examples correspond to different websites: Avision for the baseline and Quitelight for the default condition.Source: Figure B1 · p. 37, Figure B2 · p. 37
- Figure B2 is labeled Example Condition 2, Default, for website Quitelight.Source: Figure B2 · p. 37
APPENDIX C
Appendix C provides the example consent-request text for website Avision.
APPENDIX C
- The example tells users to review their privacy settings to comply with European laws.Source: Appendix C · p. 38
- It states that Avision and third parties use cookies that may collect information about users and their behavior.The text says collection may occur within and possibly outside the website.Source: Appendix C · p. 38
- Users are asked to choose “Agree” or “Do Not Agree” to accept or refuse tracking cookies.Source: Appendix C · p. 38