(Un)informed Consent: Studying GDPR Consent Notices in the Field
By Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, Thorsten Holz. Conference on Computer and Communications Security, 2019
451 citations recorded by the source corpus.
Since the adoption of the General Data Protection Regulation (GDPR) in May 2018 more than 60 % of popular websites in Europe display cookie consent notices to their visitors. This has quickly led to users becoming fatigued with privacy notifications and contributed to the rise of both browser extensions that block these banners and demands for a solution that bundles consent across multiple websites or in the browser. In this work, we identify common properties of the graphical user interface of consent notices and conduct three experiments with more than 80,000 unique users on a German website to investigate the influence of notice position, type of choice, and content framing on consent. We find that users are more likely to interact with a notice shown in the lower (left) part of the screen. Given a binary choice, more users are willing to accept tracking compared to mechanisms that require them to allow cookie use for each category or company individually. We also show that the wide-spread practice of nudging has a large effect on the choices users make. Our experiments show that seemingly small implementation decisions can substantially impact whether and how people interact with consent notices. Our findings demonstrate the importance for regulation to not just require consent, but also provide clear requirements or guidance for how this consent has to be obtained in order to ensure that users can make free and informed choices.
Subfields: Clinical Psychology, Computer Science Applications, Sociology and Political Science
View Paper: https://www.semanticscholar.org/paper/44c6417b7ca4f12a778c063451c1c142e62eb836
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Clinical Psychology
In Computer Science Applications
In Sociology and Political Science
Citations in the corpus
- Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence (2020, background): “Utz et al [53] analysed a random sample of 1,000 CMPs and manually categorised them along different design dimensions (e.”
- What Makes a Dark Pattern... Dark?: Design Attributes, Normative Considerations, and Measurement Methods (2021, background): “The majority of this discussion has resulted from studies [33, 39, 47, 56] examining whether the consent management platforms that have emerged on websites as a result of the GDPR are compliant with the law.”