I Refuse if You Let Me: Studying User Behavior with Privacy Banners at Scale

Privacy Banners are a common experience while surfing the Web. Mandated by privacy regulations, they are the way for users to express their consent to the usage of cookies and data collection. They take various forms, carry different wordings and offer different interaction mechanisms. While several works have qualitatively evaluated the effectiveness of privacy banners, it is still unclear how users take advantage of the options offered and if and how the design of the banner could influence their choice. This work presents a large-scale analysis of how the Privacy Banner options impact on users' interaction with it. We use data from a global Consent Management Platform serving more than 400 websites with visitors from all countries. With this, we observe more than 4M interactions collected over three months. We find that only 1–4% of visitors opt out of cookies when more than one click is required. Conversely, when offered a Reject All button to deny consent with a single click, the percentage of users who deny consent increases to about 21%. We further investigate other properties, such as the visitor's country, device type, banner position, etc. While the results confirm some common beliefs, to the best of our knowledge, this is the first work to accurately quantify how people interact with Privacy Banners and observe the effect of offering a single-click refusal option. We believe our work improves the understanding of user behaviour and perception of privacy, as well as the implications and effectiveness of privacy regulations.