Should You Accept Cookies? What the Banner Is Designed to Make You Do

You are ten times a day being asked a question you did not want, in a box you cannot dismiss, with one button that is large and coloured and another that is small and grey.

There is a practical answer to what you should click, and there is a much more interesting body of research on why the box looks the way it does. Both are below, in that order.

The practical answer

A cookie banner is normally asking about two different things at once.

Essential cookies keep the site working - your login session, your shopping basket, your language setting. You cannot meaningfully decline these, and no banner offers to; sites that ask are asking about the other kind.

Non-essential cookies are mostly analytics and advertising, and a large share are set by third parties rather than the site you are on. This is the category "Accept all" is really about. Consenting lets those third parties recognise you across other sites that use the same networks.

So: "Accept all" is not about the site you are visiting. It is about everyone else the site has arrangements with. Declining non-essential cookies almost never breaks anything, because the site's own functionality does not depend on them. If you have no particular reason to want cross-site tracking, "reject" costs you very little.

That is the whole practical answer, and it takes one paragraph. The reason the banner takes up half your screen to ask it is a separate matter.

The banners are mostly not compliant

Before the design effects, the baseline. Nouwens and colleagues (CHI 2020) scraped the five most widely used consent management platforms across the top 10,000 UK websites - 680 banner instances - and assessed them against the minimum requirements of European law.

11.8% met those minimum requirements.

A separate crawl by Matte, Bielova and Santos (IEEE S&P 2020) examined 560 sites in detail out of nearly 23,000 crawled and found that at least 54% had at least one violation: 141 registered a consent signal before the user had chosen anything, 236 used pre-selected options, and 27 stored a consent signal after the user had explicitly refused.

So a substantial fraction of the boxes are not functioning as consent mechanisms at all. That is the context for everything that follows.

What design actually does to your click

Three studies, at increasing scale, have tested this properly.

Nouwens et al. (2020) ran a field experiment across eight banner variations. The two effects that mattered:

• Removing the opt-out button from the first page raised consent by 22 to 23 percentage points.
• Putting granular controls on the first page lowered consent by 8 to 20 percentage points.

And one null worth noting: whether the notice was a banner or a full blocking barrier made no difference.

Utz and colleagues (CCS 2019) ran three field experiments on a live site with 82,890 unique visitors. Their largest single effect was not wording at all - it was position:

Banner position	Visitors who interacted
Bottom-left corner	33.1%
Bottom bar	9.6%
Top bar	2.9%

Cramér's V = .31. A banner in the corner got more than ten times the engagement of one across the top, purely by being where the eye already was.

Pre-selecting the options mattered too. With a genuine opt-in choice, under 0.1% of visitors allowed all third parties. With the boxes pre-ticked, that rose to around 30% on mobile and about 10% on desktop.

Bielova and colleagues (USENIX Security 2024), working with the French data protection authority, ran the largest controlled test: 3,947 participants across six banner designs. Their outcome was the refusal rate.

Banner design	Refused
"Consequences" framing (explaining what accepting means)	47% [40.2-52.9]
Tricolor design	38% [32.1-44.2]
Highlighted decline button	34% [27.7-39.2]
Control	17%
Highlighted accept button	18% [14.2-22.6]
No decline button on the first layer	4% [2.5-5.9]

Two things stand out. Removing the reject button cut refusals from 17% to 4%. And highlighting the accept button - one of the most frequently condemned dark patterns - moved the needle by one point and was not statistically significant.

The same study found the effects persisted. When participants later met a plain, neutral banner, those who had earlier seen the "consequences" version still refused at 36% against a 17% baseline. A single well-designed banner changed behaviour on the next one.

The result that complicates the story

If the account so far is "design controls your click," then Graßl and colleagues (2021) are a problem for it - and they are the best-designed study in the set.

Two preregistered experiments, 228 and 255 participants, testing default settings, visual salience and obstruction.

93.8% of participants agreed to the consent request. The nudges did not significantly change that. The authors found no support for their hypotheses about defaults, aesthetic manipulation, or obstruction.

And one finding ran backwards: when the "do not agree" option was obstructed, people reported feeling more in control of their personal data, not less.

The most recent systematic review - Schaffner, Heysen and Chetty (CHI 2026), covering 148 experimental units across 27 peer-reviewed papers - puts numbers on how common this is. 15 of 101 experiments testing a deceptive pattern against a control found no significant effect, and the review reports large variation in effect sizes indicating strong context dependence. It also notes something bleaker: of the interventions designed to protect users from these patterns, only 4 of 27 worked.

What this adds up to

The naive version - that banner design hypnotises you into consenting - is not what the evidence shows. Most people accept most things most of the time, in the lab and in the field, whatever the box looks like. Graßl's 93.8% is the honest baseline.

What design reliably does is at the margins, and asymmetrically. Taking the reject button away works: 17% to 4% in Bielova, 22 points in Nouwens. Pre-ticking boxes works: under 0.1% to around 30%. Putting the banner where people are already looking works: 2.9% to 33.1%.

Notice what those three have in common. They are not persuasion. They are removal of the option, pre-supply of the answer, and control of where the question appears. The effects come from architecture, not rhetoric - which is why highlighting the accept button, the most visible and most complained-about pattern, did almost nothing in a study of nearly four thousand people.

There is a genuinely encouraging finding in here too, and it is the one nobody quotes. The best-performing design in the Bielova study was not a trick. It was the banner that simply explained the consequences of accepting, which nearly tripled refusals against the control, and whose effect carried forward to the next banner the person saw. Telling people what they are agreeing to changed what they agreed to, more than any manipulation tested.

Where that leaves you

Click reject. It rarely costs you anything, and the reason the button is small is that the 22-point difference between having it and not is worth real money to somebody.

But the more useful takeaway is about what to notice. The patterns with the largest measured effects are the structural ones: an option that is not on the first screen, a box that is already ticked, a choice that appears where you were about to click anyway. Those are worth a second of attention. A brightly coloured "Accept" button, it turns out, is mostly just a brightly coloured button.

Consent banners are one instance of a general problem in interface design - see the persuasive design guide for the wider set, your phone isn't the problem, its defaults for what pre-supplied answers do elsewhere, and what your feed knows about you for where the data goes once you have said yes.