Cookie consent notices are actually unusable, according to science

“ACCEPT ALL COOKIES,” reads a bright, shiny button on a lot of websites you visit these days. Though your eyes may not notice it before clicking that button, there’s another, perhaps smaller and less bold button that reads, “Cookie settings.” Clicking that button often gives you the ability to customize which cookies you’d like to accept, but only if you click it first.

“A common reaction is to dismiss the interface as quickly as possible,” says CyLab’s Hana Habib, a postdoctoral researcher. “This suggests that these interfaces have usability problems.”

Last month, Habib presented a new study titled, “‘Okay, whatever’: An Evaluation of Cookie Consent Interfaces,” at the ACM CHI conference in New Orleans.

In the study, Habib and her co-authors reviewed ~ 200 cookie consent banners from five consent management platforms and used them to identify common design parameters. They then developed 12 different cookie consent banners spanning a range of usability from what they believed to be “best practices” to “worst practices.”

A common reaction is to dismiss the interface as quickly as possible.

Hana Habib, postdoctoral researcher, CyLab

Seven different aspects of usability in cookie consent interfaces the team considered were:

• Whether the choice interface meets user needs
• The ability and effort required to use the choice interface
• Awareness of the interface and available choices
• Comprehension of choices
• Users’ sentiments towards the interface
• Their ability to reverse or change their decisions
• The presence of dark or nudging patterns

The researchers asked over 1,300 user study participants to complete a shopping task on a website prototype, during which they were exposed to one of the 12 consent interface designs the researchers developed. After completing the task, participants were asked to fill out a survey about their experience.

“We observed that some of the design parameters we explored had a significant impact on one or more usability aspects, while others did not have much impact,” Habib says.

The researchers found that if a consent interface wasn’t prominent enough, users exhibited poor awareness of available choices, measured by the post shopping task survey. Zero participants who were exposed to the interface in which a “Cookie Preferences” button was displayed in the bottom-right corner of the browser window actually interacted with the button at all.

“Compared to those in best practices, participants were significantly less aware that there was a privacy decision on the website, and were less aware of available cookie options,” says Habib.

Related to user sentiment, the researchers found that the absence of inline options in the initial screen of the interface led to lower investment in decision making. Participants presented with this consent design, where options were available through a link embedded in the text, were more likely to report choosing the easiest option and not at all carefully compared to those in best practices.

The researchers suggest that browser-based consent management mechanisms, including browser extensions that could automatically communicate users’ preferences, have the potential to alleviate some of the burden users face with cookie consent interfaces. However, they argue that until these mechanisms become widely adopted, it remains important to improve the usability of existing schemes.

Habib's co-authors included CyLab director Lorrie Cranor and two undergraduate students who participated in CMU's Research Experience for Undergraduates in Software Engineering (REUSE) program in Summer 2021.

Paper reference

“Okay, whatever”: An Evaluation of Cookie Consent Interfaces

• Hana Habib, Carnegie Mellon University
• Megan Li, Harvey Mudd College
• Ellie Young, New College of Florida
• Lorrie Cranor, Carnegie Mellon University