Does a Consent Rate Measure User Preference or Banner Design?

A site’s consent rate is usually interpreted as visitors’ attitude, independent of that site. The interpretation holds for some visitors. For the rest, the decision depends on how easy or hard the banner makes rejecting. Within the same population, removing the reject button from the banner’s first screen drops the reject rate from 17% to 4%.¹ In another study, more than 60% of users do not consent when a one-click reject is available.² Part of the gap between benchmarks also comes from whether visitors who see the banner and never touch it are counted.

This is the first of a three-part series on cookie banners. It looks at how visitors make that choice and how banner design steers it, based on research. The next two posts will examine the banners of ecommerce sites in Türkiye and whether the choice made on the banner is reflected in the data flow.

Same Rate, Three Calculations

Consent rate comparisons often use different denominators from the start. CMPs (Consent Management Platforms) and studies use three separate metrics, and which one is used is not always stated.

Metric	Calculation	Visitors who saw the banner but did not decide
Consent rate	accepts / (accepts + rejects)	Not counted
Opt-in rate	accepts / banners displayed	Counted
No-choice rate	impressions without interaction / banners displayed	Counted in the numerator

Didomi’s metric glossary draws the distinction explicitly: consent rate is the “percentage of opt-ins among all recorded choices (opt-ins + opt-outs)”, opt-in rate the “percentage of users who consented to data collection across all banners displayed”.³ In Didomi’s 2025 data, Western Europe has a consent rate of 75.1% and an opt-in rate of 55.7%. The gap of about 20 percentage points comes from visitors who see the banner and do nothing.⁴

The effect shows even within a single study. In the field experiment by Utz et al. with more than 80,000 real visitors, banners with pre-checked boxes lead about 30% of mobile users and 10% of desktop users to “accept all”. Under the same condition, 83.55% of the 1,380 people who interacted with the banner accepted.⁵ Both numbers are correct. One describes all visitors, the other only those who decided.

Before making a decision based on a consent rate, four questions need an answer:

• What is the denominator: recorded choices, banners displayed or unique visitors?
• If the banner is shown again on every page within a session, how many times is the impression counted?
• Does “accept” mean only “accept all”, or does it include partial acceptance? A reject is not a full reject either: strictly necessary cookies keep running after the visitor rejects. Some banners show buttons such as “Only necessary” or “Essential only” instead of “Reject”.
• Is the rate calculated only from decisions made that day? Visitors whose choice is stored from an earlier visit do not see the banner again, so they appear in neither impressions nor decisions. A daily rate shows who decided that day, not the overall consent state of the site’s visitors.

What Consent Rate Is Normal

The question of a “normal” rate cannot be answered until it is clear what each source measures. The sources I have fall into three groups, and each measures something different in its own context.

Source type	Example	What it measures	Watch out for
Survey	CNIL / IFOP 2022, BfDI / forsa 2025	Stated behaviour	Self-report, not clicks
CMP benchmark	Didomi 2026, Commanders Act 2025	Real clicks on customer sites	Results reflect customers’ banner designs and the vendor’s customer mix
Academic field experiment	Utz 2019, Nouwens 2020, Jha 2024	Controlled design differences	Often a single site or a small sample

Regional and Industry Differences

In Didomi’s 2025 data, consent rate is 75.1% in Western Europe, 82.5% in Southern Europe, 84.8% in Northern Europe, 87.3% in the British Isles and 89.3% in Eastern Europe. France, at 71%, pulls the Western European figure down. No-choice rate ranges from 21.7% to 27.4% by region.⁴ By industry, the highest consent rate is in media and publishing at 82.7%, the lowest in energy and utilities at 69.6%. The industry with the most visitors moving on without deciding is tech and telecom, at 35.1%.⁶

Commanders Act’s 2025 barometer covers 1,301 banners and splits the results by device:⁷

Device	Consent rate	Reject	No-choice	Opt-in rate
Desktop	78.06%	21.94%	39.37%	46.55%
Mobile	80.54%	19.46%	32.41%	55.03%

In the same report, the desktop no-choice rate in food and beverage rises to 72.13% and the opt-in rate falls to 18.91%. In that industry, only about a fifth of desktop visitors shown the banner opt in.

Surveys show lower acceptance. In the IFOP survey for CNIL, the share of French respondents who say they accept cookies falls from 76% in December 2019 to 59% in June 2022.⁸ In Germany, in a forsa survey for BfDI, 60% of respondents say they reject all cookies when it takes a single click.⁹ Because these numbers are self-reported, they cannot be compared directly with CMP data. Still, they point to why, while 10-25% of visitors who make a choice reject in CMP data, the reject share can come out higher in a design where rejecting is easy.

Comparing Your Own Rate

Before comparing the rate in your CMP dashboard with these benchmarks, check the following:

1. What is the rate calculated over? If only visitors who decided are counted, the number is comparable with the consent rate of Didomi and Commanders Act.
2. Are visitors who made no choice identified, and how? Most dashboards do not show this; it requires recording banner decisions as separate events. I covered why this number does not come out of the GA4 export in the consent rate measurement post.
3. Do you have device, country and industry data? The desktop-mobile difference alone accounts for an opt-in gap of 8-9 points in Commanders Act’s 2024 and 2025 data. In Didomi’s data the spread between regions is about 14 points (75.1-89.3%), between industries about 13 points (69.6-82.7%). The same industry can also rank differently across CMP benchmarks: energy has the lowest consent rate in Didomi (69.6%),⁶ but stays above average in Commanders Act (80.96% on desktop, 85.76% on mobile).⁷ An industry average is a rough match anyway: a store selling adult products and an artist’s site selling their own designs fall into the same ecommerce category, but their visitors’ attitudes may differ.
4. What is your success criterion? Before reading a consent rate above 90% as a success, check whether the reject button is on the first screen and looks equal to accept.

How much measurement is lost when the rate is low is a separate question. Google’s behavioral modeling for GA4 requires at least 1,000 events per day with denied consent for at least 7 days, and at least 1,000 daily users with granted consent on at least 7 of the previous 28 days.¹⁰ On a small site, modeling may not activate whatever the rate is. I covered how the loss is distributed across channels in the post on consent’s measurement impact.

The Rate Changes When Rejecting Takes an Extra Step

Studies measuring the effect of design differences point in the same direction. What changes the rate most is how many steps and how much attention rejecting requires.

Design difference	Measured effect	Source and method
Reject not on the first screen	Consent +22.0 points (blocking), +23.1 points (non-blocking)	Nouwens 2020, field experiment, 40 participants11
Reject not on the first screen	Reject from 17% to 4%	Bielova 2024, 3,947 participants, France1
Rejecting takes more than one click	About 90% accept	Jha 2024, 14 months of logs from one CMP2
Reject as a link instead of a button	Only 10% rejected all	Berens 2022, 521 participants, Germany12
Pre-checked boxes	Mobile ~30%, desktop ~10% accept all; unchecked <0.1%	Utz 2019, 80,000+ visitors5
”Select all” highlighted by default	Consent up ~20 points	Machuletz and Böhme 2020, 150 students13
Granular choices on the first screen (purposes, vendors)	Consent down 8-20 points	Nouwens 202011

One finding is not in the table: two experiments found no statistically significant effect from highlighting a button with colour alone. In the experiment Bielova et al. ran with CNIL, highlighting the accept button did not significantly change the reject rate (18%, p=0.566).¹ Berens et al. also found no significant difference between equal buttons and highlighting one of them.¹² One way to read this: colour and size alone barely affect rejecting. The effect comes from the extra step rejecting requires (friction). Removing the reject button from the first screen and offering it on the settings screen, or presenting it as a link instead of a button, are examples of that extra step.

The effect works in the other direction too. On a banner that highlights reject, rejection rises to 34%, and with a text explaining the consequences of tracking, to 47%.¹ The same experiment also shows a notable carry-over effect: participants who saw a banner without a reject button twice rejected the next neutral banner only 10% of the time. Among those who had seen banners highlighting reject, the figure was 30%.¹ A site’s banner may therefore also affect the user’s decision on the next site.

The longest observation with real traffic comes from Jha et al. In 14 months of logs from thousands of sites using one CMP, adding a reject button raised the reject rate from 10% or less to about 20%. When the banner became a centred modal with a blurred background and the close mark counted as a reject, rejection reached 70%. When the banner moved to the bottom of the page without the blurred background, it dropped to 55%; the authors attribute this to users ignoring the banner.² The study is not randomized but a before-after comparison, so the results suggest a trend but do not isolate the effect of the design change.

Browsing Without a Choice

On a non-blocking banner, a large share of users never decide, and this group does not show up in most analyses.

• CMP data. No decision is made in 21.7-27.4% of impressions at Didomi,⁴ and in 39.37% on desktop and 32.41% on mobile at Commanders Act.⁷
• Controlled experiment. In the experiment by Habib et al. with 1,109 participants, 19.8% of participants with the non-blocking banner, and 24.0% in the worst-practice variant, went on to the product catalogue without deciding.¹⁴
• Position. In Utz’s experiment, interaction was highest for the bottom-left box at 37.1%, against 2.9% for the thin bar at the top and 9.6% for the bar at the bottom.⁵
• Screen share. In my October scan, cookie banners that offered a choice covered about a third of the first screen on mobile and a sixth on desktop. The banner filling more of the screen on mobile is one possible explanation for fewer silent visitors on mobile. I did not measure this directly; Commanders Act’s data and the sites I examined are also not the same.

The position finding is worth stating separately, because some secondary sources cite Utz as saying the top banner gets more interaction. The paper itself says the opposite: “users are more likely to interact with a notice shown in the lower (left) part of the screen”.⁵

Does a Blocking Banner Change the Decision or the Split?

The literature calls a blocking banner a barrier and a non-blocking one a banner.¹¹ Habib et al. call the same structure a fully-blocking interface.¹⁴ In the experiment by Nouwens et al., acceptance does not differ between the blocking and the non-blocking banner (F(1,279)=0.000, p=1). The difference was in how often visitors ignored the banner: the non-blocking banner was ignored 3.6 times more often.¹¹ Habib et al. also recommend a fully-blocking interface with inline choices and a persistent button for changing the decision later.¹⁴

Taken together, it seems fair to read the two findings this way: a blocking modal pushes visitors who make no choice to decide and raises the opt-in rate, but does not clearly change the accept-reject split among those who already decide. A modal is, of course, not the same as a cookie wall. A modal asks for a choice; a cookie wall makes access to content conditional on acceptance. The EDPB does not regard consent obtained by forcing acceptance as freely given.¹⁵

For examples of different banner designs, see the galleries compiled by Usercentrics, CookieYes and Didomi. The examples in these galleries and their compliance assessment are chosen by the CMP vendors themselves.¹⁶¹⁷¹⁸

Where User Preferences Remain Stable

The influence of design is limited, because some users have made up their minds before they see the banner. In the experiment by Papenmeier, Halama and Reichert across 12 websites, about two-thirds of participants always accepted or always rejected, regardless of button highlighting.¹⁹ In that experiment, accepting and rejecting took the same effort. The authors note that it is unclear whether this stability holds when rejecting is harder, and that the share may be slightly overestimated because the buttons were always on the same side. In Bielova’s experiment, half of those who accepted said they did so “out of habit”.¹

The trend over time differs from source to source:

Source	Period	Change
CNIL / IFOP (self-reported)	2019-2022	Respondents saying they accept: 76% to 59%8
Commanders Act (CMP)	2024-2025	Desktop consent rate 81.37% to 78.06%, mobile 84.53% to 80.54%7
Didomi (CMP)	Past four years	”remained broadly consistent over the past four years”4

It is hard to draw a general downward trend from this table. Two sources show rising rejection, but Didomi sees stability in its own data and does not publish yearly figures.

Which Design Approaches Have a Measured Effect, and Which Are Problematic

Evidence and regulation point to the same designs in most cases, but not always.

Design	Measured effect	Regulator position
Reject not on the first screen	Consent +22-23 points	EDPB: most authorities consider the absence of reject on a screen with an accept button an infringement20
Pre-checked boxes	~30% accept all on mobile, <0.1% when unchecked	Court of Justice of the EU, Planet49: a pre-checked box is not valid consent21
Faded or unreadable reject	Colour highlighting alone had no significant effect	EDPB: case by case; contrast too low to read could be manifestly misleading20
Small “continue without accepting” link	With reject as a link, only 10% rejected all	EDPB: a link without sufficient visual support is problematic20
Treating continued browsing as consent	Not measured; no decision is ever made	KVKK, Türkiye’s data protection authority: “not a lawful form of use” (translation)22
Cookie wall and “consent or pay”	Close to 99% choose tracking with pay-or-OK	EDPB: on large platforms, a binary choice alone will in most cases not give valid consent; KVKK: fair alternatives to a cookie wall may be acceptable case by case2322

Pay-or-OK data shows the extreme end of design effects. In the study by Müller-Tribbensee, Miller and Skiera of 517 days of data from one publisher, 99.06% of unique users who made a choice on the last observed day (month 17) chose the tracking option.²⁴ This suggests not that users want tracking, but that paying is not a real option in practice.

In France, CNIL actively sanctions these designs. Of its 83 sanctions in 2025, 21 concerned cookie violations. Failing to take into account a user’s refusal or withdrawal of consent appears in the decisions as a separate breach.²⁵

The KVKK Guide and the EU Proposal

The cookie guide from KVKK, updated in July 2025, describes equal buttons as an example of good practice, not as an explicit obligation: offering “accept”, “reject” and “preferences” buttons that are equal “in terms of colour, size and font” “may be an example of good practice” (translation).²² The same guide is clearer on cookie walls: where consent is imposed as a precondition for the service, a cookie wall “may impair the data subject’s free will, and the explicit consent obtained in that case will not be valid explicit consent” (translation).²²

In the EU, the Digital Omnibus package proposed in November 2025 would make one-click reject a rule and bar asking again for at least 6 months after a refusal.²⁶ The proposal has not become law, and secondary sources report differently how the Council’s October 2026 position changed these provisions. For now it should be read as a sign of direction.

In Türkiye, the 2027-2029 Medium-Term Programme targets completing the alignment of Law No. 6698 on the Protection of Personal Data (KVKK) with the GDPR in the third quarter of 2027.²⁷ This is a programme target; how alignment will change the rules on cookie consent is not yet clear.

My Own Measurements

My own banner’s design is in line with the evidence above. A non-blocking box sits at the bottom left of the page, “Accept” and “Reject” look identical on the first screen, and “Settings” is a text link. I do not use advertising cookies; the banner asks for consent only for analytics and behaviour measurement.

I have been writing banner events to BigQuery via server-side tagging since 2026-10-15. An impression is counted once per session, and only decisions made on the landing page are counted.

Metric	Calculation	Rate
Consent rate	accepts / (accepts + rejects)	68.1%
Opt-in rate	accepts / impressions	10.1%
Left without deciding	impressions without a decision / impressions	33.7%
Outcome not measured	impressions with no outcome received / impressions	51.4%

The same data yields three different “consent rates”: 68.1%, 10.1%, and 20.8% with a calculation that includes visitors who made no choice but leaves out the unmeasured ones. A CMP dashboard would show only the first.

The last row shows the limit of the measurement itself: in half of the impressions, the banner’s outcome never reached the server, so the opt-in rate is most likely lower than the true value. For a statistical benchmark, these observations are limited and biased. I think it is still enough to see the difference the calculation method makes.

The Data Gap for Türkiye

I could not find a published consent rate for Türkiye. As far as I can tell, CMPs operating in Türkiye do not publish country-specific rates, and KVKK has not published a sector survey on the subject. The only empirical study I found scanned the 50 most visited news sites in May 2022: all of them placed non-essential cookies without explicit consent, a third showed no cookie notice at all, and half of those showing a notice treated visiting the site as consent.²⁸ That is exactly the practice the KVKK guide does not consider lawful.

The next two posts in the series aim to close part of this gap. The second post will examine cookie banners on ecommerce sites in Türkiye through screenshots and page code: the banner’s position, how the reject option is presented, colours and text.

The third post will look at whether the visitor’s choice on the banner is reflected in the site’s data flow, that is, whether tracking continues after the visitor declines consent.

Footnotes

1. Bielova, Litvine, Nguyen, Chammat, Toubiana, Hary: The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions, USENIX Security 2024. Reject rate “from 17% on a neutral banner to 4%”. The rates in the study count refusal and personalization together (“refusal/personalization rate”). ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶
2. Jha, Trevisan, Mellia, Fernandez, Irarrazaval: Privacy Policies and Consent Management Platforms: Growth and Users’ Interactions over Time, arXiv 2024 (preprint). “over 60% of users do not consent when offered a simple ‘one-click reject-all’”. ↩ ↩² ↩³
3. Didomi: CMP Consent Banner Performance Metric Glossary (2026-02-24). Consent rate: “percentage of opt-ins among all recorded choices (opt-ins + opt-outs)”; no-choice rate: “how often the banner was shown without any interaction recorded”. ↩
4. Didomi: Average consent rate in Europe, 2026 data privacy benchmark (2026-03-19, 2025 data). “Western Europe records the lowest consent rate at 75.1%, heavily influenced by France, which sits at 71%.” ↩ ↩² ↩³ ↩⁴
5. Utz, Degeling, Fahl, Schaub, Holz: (Un)informed Consent: Studying GDPR Consent Notices in the Field, ACM CCS 2019. §4.2.1: “the notices shown at the bottom-left position received the most interactions, 37.1 % of visitors interacted with them”; Table 2. ↩ ↩² ↩³ ↩⁴
6. Didomi: Consent rate by industry in Europe 2026 (2026-05-25). ↩ ↩²
7. Commanders Act: Privacy Barometer 2025. “1301 banners deployed on sites around the world between 1 and 31 May 2025”. 2024 comparison: Privacy Barometer 2024 (2,115 banners, March 2024). ↩ ↩² ↩³ ↩⁴
8. CNIL / IFOP: Les Français et la réglementation en matière de cookies, vague 5 (June 2022, n=1,008). ↩ ↩²
9. BfDI: Pressemitteilung 16/2025, Cookie-Einwilligung (2025-11-04). “60 Prozent lehnen Cookies pauschal ab, wenn dies mit nur einem Klick möglich ist.” ↩
10. Google Analytics Help: Behavioral modeling for consent mode. ↩
11. Nouwens, Liccardi, Veale, Karger, Kagal: Dark Patterns after the GDPR, CHI 2020. “the banner notification was ignored 3.6 times more often than the barrier”. ↩ ↩² ↩³ ↩⁴
12. Berens, Dietmann, Krisam, Kulyk, Volkamer: Cookie Disclaimers: Impact of Design and Users’ Attitude, ARES 2022. ↩ ↩²
13. Machuletz, Böhme: Multiple Purposes, Multiple Problems, PoPETs 2020(2). ↩
14. Habib, Li, Young, Cranor: “Okay, whatever”: An Evaluation of Cookie Consent Interfaces, CHI 2022. §4.4.2. ↩ ↩² ↩³
15. EDPB: Guidelines 05/2020 on consent under Regulation 2016/679 (2020-05-04), §39: “access to services and functionalities must not be made conditional on the consent of a user to the storing of information … (so called cookie walls)”. ↩
16. Usercentrics: 8 Top Cookie Banner Examples: Create a Compliant Banner (2025-04-11) ↩
17. CookieYes: 10 GDPR Cookie Consent Examples That Boost Compliance (2026-03-03) ↩
18. Didomi: 10 examples of GDPR-compliant cookie banners (2020-05-25) ↩
19. Papenmeier, Halama, Reichert: Accepting cookies: Nudging, deceptive patterns and personal preference, Computers in Human Behavior 168 (2025). “about two-thirds of our participants showed a stable cookie acceptance behavior of either always accepting cookies or always rejecting cookies”. ↩
20. EDPB: Report of the work undertaken by the Cookie Banner Taskforce (2023-01-17). ↩ ↩² ↩³
21. Court of Justice of the European Union: Planet49, C-673/17 (Grand Chamber, 2019-10-01). “the consent referred to in those provisions is not validly constituted if … access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent.” ↩
22. KVKK: Çerez Uygulamaları Hakkında Rehber (Guide on Cookie Practices) (Publication No 69, July 2025). Original wording of the translated quotes: “eşit derecede (renk, büyüklük, punto açısından) “kabul et”, “reddet” ve “tercihler” butonlarının sunulması iyi uygulama örneği olabilecektir.”; “çerez duvarının ilgili kişinin özgür iradesini sakatlaması söz konusu olabilecek ve bu durumda alınan açık rıza, geçerli bir açık rıza olmayacaktır.”; “hukuka uygun bir kullanım şekli değildir”. ↩ ↩² ↩³ ↩⁴
23. EDPB: Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms (2024-04-17). ↩
24. Müller-Tribbensee, Miller, Skiera: Paying for Privacy: Pay-or-Tracking Walls, arXiv 2024 (working paper). ↩
25. CNIL: Sanctions and corrective measures, CNIL’s actions in 2025 (2026-02-09). ↩
26. European Commission: COM(2025) 837 final, Digital Omnibus (2025-11-19, proposal). Proposed Art. 88a(4): refusal “with a single-click button or equivalent means”, no new request “for a period of at least six months”. ↩
27. Medium-Term Programme (2027-2029), Presidential Decision 11752, Resmî Gazete (Official Gazette), 06.09.2026, issue 33362 (mükerrer). Measure: “6698 sayılı Kişisel Verilerin Korunması Kanunu (KVKK)‘nun Avrupa Birliği Genel Veri Koruma Tüzüğü (GDPR) ile uyumlaştırma süreci tamamlanacaktır.” Timeline: 2027, Q3. ↩
28. Uluk: Connectist: Istanbul University Journal of Communication Sciences, issue 64 (2023). ↩

Key Takeaways

• 01 Consent rate counts only visitors who decided; opt-in rate counts everyone who saw the banner. In the benchmarks discussed here, consent rate comes out about 20-30 percentage points higher, and the gap is made up of visitors who never touched the banner. Before comparing against a benchmark, check which metric it uses.
• 02 Moving the reject button off the banner's first screen and offering it only under settings raises consent by 22-23 points (Nouwens 2020); in a CNIL experiment the reject rate drops from 17% to 4% (Bielova 2024). Highlighting a button with colour alone had no significant effect in two experiments.
• 03 On banners that do not force a decision, visitors do not touch the banner at all in 22-40% of impressions. In Commanders Act data this share is higher on desktop than on mobile.
• 04 About two-thirds of participants always accept or always reject regardless of button highlighting; design takes effect in the remaining group, whose decision changes from site to site.
• 05 The July 2025 cookie guide from KVKK describes equal 'accept', 'reject' and 'preferences' buttons as good practice, and does not treat continuing to use the site after a cookie notice as lawful consent.

Frequently Asked Questions (FAQ)

+ What is a normal consent rate?

There is no single value that holds for everyone, because the rate depends on who is counted. In European CMP data, consent rate calculated among those who decided ranges from 75% to 89%, and opt-in rate calculated over banners displayed ranges from 56% to 68%. Part of each range comes from regional and industry differences, so a comparison needs the same region, industry and device. On a banner where reject sits on the first screen as an equal to accept, studies are consistent with anywhere from a third to more than half of visitors who make a choice rejecting. A consent rate above 90% usually indicates that rejecting has been made harder.

+ Why is the consent rate in my CMP dashboard higher than in studies?

Most CMPs calculate consent rate only over visitors who decided; visitors who see the banner and do not touch it are not counted. Some studies count all visitors or all impressions instead. CMP benchmarks also reflect their own customers' designs, and the reject button may not be presented as an equal to accept on every site.

+ Does a blocking modal change the rate?

There is evidence that it changes the decision rate, not the acceptance rate. In the experiment by Nouwens et al., acceptance did not differ between the blocking and the non-blocking banner, but the non-blocking banner was ignored 3.6 times more often. A modal pushes silent visitors to decide without clearly changing the split among those who decide.

+ Is a colourful accept button with a faded reject button a problem?

It depends on the case. The EDPB Cookie Banner Taskforce report assesses colour and contrast case by case, but notes that a reject option whose text contrast is too low to read could be manifestly misleading. On the evidence side, colour highlighting alone had no significant effect in two experiments; the clear effect appears when rejecting takes an extra click or a separate settings screen.

+ Is there consent rate data for Türkiye?

I could not find any published data. As far as I can tell, CMPs operating in Türkiye do not publish country-specific consent rates, and I have not come across a sector survey published by KVKK. The only empirical study I found is a 2022 scan of the 50 most visited news sites, and it measured implementation, not rates.