Since the GDPR went into effect in May 2018, there’s been a noticeable surge in the display of cookie consent notices (or cookie banners), with large variations in text, the choices presented to users, and even the position of the notice on the webpage.
But how are users actually interacting with these cookie banners, if at all? And more importantly, which cookie notice format ensures that users can make free and informed choices under the law?
A study conducted last Fall by the University of Michigan and the Ruhr-University Bochum in Germany (available here) examined how EU users interact with and respond to cookie consent notices. In summary, the study found the following:
- Position: Users are most likely to interact with a cookie consent notice when it is in the form of a cookie banner displayed on the bottom of the screen (for mobile devices) or bottom left of the screen (for desktop computers).
- Choice Mechanism: Users are more willing to accept cookie tracking given a binary choice (accept or decline), as opposed to selecting or deselecting the types of cookies in checkboxes (e.g., necessary, personalization & design, analytics, social media, marketing) or the types of vendors who may use the tracked cookies (e.g., FB, YouTube, Google Analytics, Google Fonts, Ionic, Google Ads).
- “Nudging” (or using pre-checked boxes or highlighted “accept” buttons) has a large effect on the choices users make and increases acceptance rates.
- Language: The use of technical language such as “cookies” in the notice (as opposed to “your data” or other) is more likely to result in a user declining cookie tracking.
To obtain valid consent for the processing of personal data, Recital 32 of the GDPR requires “a clear affirmative act” that is “freely given, [purpose-]specific, informed and unambiguous indication of […] agreement to the processing of personal data.” The regulation further specifies that “pre-ticked boxes or inactivity should not…constitute consent” and that “the request must be clear, concise, and not unnecessarily disruptive to the use of the service for which it is provided”…“When the processing has multiple purposes, consent should be given for all of them.”
According to the study, and pending further regulation or guidance on how to obtain clear, freely-given, and purpose-specific consent, “opt-in” cookie banners presenting users with a number of informed and unambiguous choices (which are not pre-selected) are predicted to be the trend for both multinational and US companies.
Thus, if you give a user a cookie notice, make sure it presents a clear and meaningful choice. If the cookie notice presents a clear and meaningful choice, is the user more likely to accept cookies? Possibly. But that’s another story.