Deceptive Cookies: Consent by Design -- A Mixed Methods Study

TL;DR

This study investigates how cookie consent banners influence user behavior, revealing that deceptive designs often lead users to consent unintentionally, raising concerns about user autonomy and privacy.

Contribution

It provides empirical evidence on how cookie banner design impacts user decisions, highlighting issues with current consent mechanisms and legislation.

Findings

Users tend to accept cookies despite wanting to reject them.

Deceptive banner patterns influence user consent decisions.

Withdrawing consent is significantly more time-consuming than giving it.

Abstract

While companies increasingly rely on data, especially when it comes to targeted advertising, adapting content to users, selling data and training machine learning models, the collection of data raises privacy concerns. One way of collecting data is by using HTTP cookies when interacting with a website. Legal regulations require service providers to collect consent for some forms of cookie collection, which is often acquired through \emph{cookie consent banners}, but their effectiveness has been debated. This study aims to understand what influences users' experience and behaviour when managing their cookie consent, by investigating the gap between their stated privacy preferences and their actual actions. A mixed methods approach was used, collecting data from a usability test and a survey (N=20). The results showed that although participants generally want to reject cookie collection, they often end up accepting because of deceptive patterns in the cookie consent banner design. It also showed that they were more willing to consent to websites they trusted and if they expected it would improve their user experience. Although the current EU legislation states that withdrawing consent must be as easy as giving it, withdrawing consent took on average more than 20 times longer than giving it. This suggests that cookie consent banners in their current form are not ideal with respect to user autonomy, often leading users to \emph{consent by design}.