Measuring a consent banner
A client came back on the consent banner we’d built for them to ask whether the accept rate could be higher.
It’s a fair question inside the frame it was asked in. It was also the only number anybody wanted from that project: not how many people opened the second layer, not how long the banner took to appear, not how many vendors were sitting in the list behind it. The accept rate.
So I did a small unscientific thing that week. 10 sites, all ones I’d genuinely visit, and on each one I counted the clicks between landing and having said no to everything optional.
Yes was 1 click on all 10 of them. No ran from 3 clicks to 19. The 19 was a national newspaper, where Manage Preferences opened a list of a few hundred companies with a toggle each, most of them already on, and behind that a second tab called legitimate interests where the toggles were also on and the copy explained that these didn’t require my consent at all.
That’s the deliverable. A year of preparation across the whole industry, a lot of money, and what it produced is a machine for getting a yes.
Working as intended
The idea behind consent, as I understand it, is that it works like a brake. Collecting data about people is intrusive. So you have to ask, and asking is awkward, and the awkwardness is the part doing the work, because it makes you think about whether you need the data at all. If most people say no, that isn’t a bug. That’s the mechanism reporting back.
Instead the awkwardness got filed as a conversion problem, and this industry is extremely good at conversion problems.
So a whole product category appeared inside about a year, with pricing tiers and A/B testing and case studies advertising consent rates above 90%, and the number those vendors optimize is explicitly the number of people who agree. It’s on their marketing pages. Nobody’s hiding it, because from inside the frame there’s nothing to hide. The client wants the data, the law says ask, and the vendor sells the asking.
Meanwhile nothing about the collection changed. The trackers are the same trackers, in the same tag manager, firing on the same events. We built a doorway in front of them, and then we spent a year making the doorway easier to walk through.
Which one looks like the button?
One line of Article 7 says that withdrawing consent has to be as easy as giving it.
Go and look at what that turned into. This is the shape of it, lifted out of a vendor stylesheet I had open last week and renamed:
.consent__accept {
background-color: #1a7f37;
border: 0;
border-radius: 4px;
color: #fff;
font-size: 16px;
font-weight: 700;
padding: 14px 36px;
}
.consent__manage {
background-color: transparent;
border: 0;
color: #6b6b6b;
font-size: 13px;
padding: 0;
text-decoration: underline;
}Both of those are <button> elements. One of them looks like a button. The eye has sorted them before anybody has read either label, and nobody designs two controls that far apart by accident. Somebody tested it, somebody won that test, and the win got written down as a default in a product that a few thousand sites then installed without opening.
The layered version is worse. Behind Manage Preferences is a vendor list that takes several minutes of steady clicking to get through, which means the person determined enough to do it is being charged for the determination, and everyone involved knows that, because it’s what the layer is for. Reject-all buttons are starting to appear on some of these now. That’s a real improvement, and it’s telling that it arrives as a concession instead of as the obvious counterpart to the button that’s been there since day one.
I don’t think you can call the yes at the end of all that freely given in any ordinary sense of the words. Whether it’s freely given in the legal sense is somebody else’s question, and my guess is we find out slowly, over several years, a few countries at a time.
Now with more third parties
The part I can be properly technical about, since it’s my job.
These things are heavy. The consent platform is frequently the single largest script on the page, it loads from a domain that isn’t yours, it blocks rendering because it has to be on screen before anything else is, and it makes a round trip to a vendor’s server before the page is usable. I measured one at a little over 200 KB on a site whose entire remaining page weight was under 400 KB. The notice about the trackers outweighed the site.
I’ve been writing about page weight since 2014, mostly about images. It never once occurred to me that the heaviest thing on the page would eventually be the part explaining what the other parts are doing to you.
So the intervention meant to protect people from third-party scripts arrives as a third-party script, slower than most of the trackers it’s gating, that knows every site you visit. I don’t have anything to add to that. It’s just true.
Nothing to declare
This is the thing I keep saying in meetings, so I’ll say it here too.
If a site doesn’t set non-essential cookies, it doesn’t need a consent banner.
That isn’t a loophole, it’s the design. The banner exists because of what’s behind it, and how much interface you owe somebody is proportional to how much you’re doing to them. No tracking, no banner, no build, no legal review, and a page that loads.
I’ve now done this properly on two client sites and it worked both times. It starts with the list of everything the site talks to, because nothing comes off a site until somebody has written down what’s on it. Self-host the fonts, which is faster anyway. Drop the heatmap tool nobody had opened in years. Replace the embedded video with a click-to-load thumbnail, so nothing gets requested until somebody actually wants to watch. Drop the chat widget, or load it on click. Then the analytics question, which is the real one, and the answer that worked both times was a setup that doesn’t identify individuals and doesn’t need consent, with the client losing some reporting granularity they’d never once used to decide anything.
Both sites got faster, both got simpler, and neither one has a banner.
And I’d love to report that this is now an easy sell. It absolutely is not. “We could collect less” arrives in a meeting as a proposal to give something up, and the thing being given up gets described vividly by a vendor with a deck, while the thing being gained is a page that loads quicker and a conversation nobody has to have.
Somebody pays for the reporting
Some businesses do genuinely live on this data, and ad-funded publishing is the obvious one. If the money that pays for the reporting comes from targeted advertising, then “just don’t track people” is a proposal to change the business model, and it’s fair to point out that the visible alternatives so far are paywalls and a smaller press. I think there’s a version of advertising that doesn’t involve following people around. I don’t think we’re anywhere near it, but I’d rather say that than pretend the trade isn’t there.
The small firm who was told by somebody they trusted that they had to install a consent platform isn’t the villain here either. They were sold a solution to a problem nobody had explained to them, which is the story of most of the last decade of this industry, and the banner they’ve now got is sitting on a brochure site that sets one cookie for the contact form.
I built two of them
I’ve built two of these this year. One of them I argued against and lost, and the other I didn’t argue about at all, because it came through as a ticket with a date on it and I had the capacity that week.
I don’t feel great about that, and I don’t think it makes me complicit in anything enormous either. Both of those sites were getting a banner regardless of who wrote the CSS. But “the client asked for it” is a sentence that carries a lot of weight in this industry. I’ve started noticing how easily I reach for it, and how rarely anybody asks me to justify a yes.