The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions

Today most websites in the EU present users with a consent banner asking about the use of cookies or other tracking technologies. Data Protection Authorities (DPAs) need to ensure that users can express their true preferences when faced with these banners, while simultaneously satisfying the EU GDPR requirements. To address the needs of the French DPA, we conducted an online experiment among 3,947 participants in France exploring the impact of six different consent banner designs on the outcome of users' consent decision. We also assessed participants' knowledge and privacy preferences, as well as satisfaction with the banners. In contrast with previous results, we found that a "bright pattern" that highlights the decline option has a substantial effect on users' decisions. We also find that two new designs based on behavioral levers have the strongest effect on the outcome of the consent decision, and participants' satisfaction with the banners. Finally, our study provides novel evidence that the effect of design persists in a short time frame: designs can significantly affect users' future choices, even when faced with neutral banners.

The work was primary carried out while Nataliia Bielova was a Senior Privacy Fellow at the LINC lab of the CNIL in 2021-2022.

† The views and opinions expressed in this paper do not necessarily reflect the views of the CNIL or any individual Commissioner.

‡ The work was carried out while Estelle Harry was a designer at the LINC lab of the CNIL before May 2023.

1 ePrivacy Directive was last amended in 2009 (ePD) and is known among computer scientists and website developers as "cookie law". The upgrade of the ePD into an ePrivacy Regulation is currently under discussion.