What Cookie Consent Notices Do Users Prefer: A Study In The Wild

What Cookie Consent Notices Do Users Prefer: A Study In The Wild
Ashutosh Kumar Singh, Nisarg Upadhyaya, Arka Seth, Xuehui Hu, Nishanth Sastry, Mainack Mondal
EuroUSEC ’22: Proceedings of the 2022 European Symposium on Usable Security, 29 September 2022; pp 28 – 39
Abstract
Laws like GDPR in the EU mandated all websites operating in their jurisdiction to obtain users’ informed consent before tracking those users and collecting their data. Today, this is achieved by showing users cookie consent notices. These notices are ubiquitous (often permeating the geographical boundaries of GDPR enforcement), even though their exact user interface (UI) designs vary. These designs are provided by Consent Management Platforms (CMPs) to different websites, effectively resulting in a handful of cookie consent notice designs being shown to a majority of internet users. Naturally, not all designs are uniformly liked by the users. Thus the first step of improving cookie consent notice UI design and moving to a better consent mechanism is to understand whether users prefer one design over another in the wild and why. To answer these questions, in this work, we conduct an in the wild comparative survey with 98 participants where 64.3% of the participants were from the EU (i.e., GDPR is applicable), and the rest were self-reported to be located outside of the EU. In this within-subjects study, our participants ranked five different popular cookie consent UI designs (leveraged by CMPs used in Alexa UK Top500 websites) and gave rationale for their choices. Our analysis found that the slider design is statistically significantly better ranked (and thus most liked) than all other designs. Our further qualitative analysis identifies and unpacks five key design factors which impacted our participants’ liking/disliking of consent notice UI designs (as captured by the ranks given to these designs by our participants) – ease of use, amount of information, customisability, decision-making time, and clarity/transparency. We conclude this work by discussing the implications of our findings on future cookie consent notice UI designs.