Measuring a consent banner
A client asked through their account manager whether the accept rate on the consent banner we’d built them could be higher.
It’s a fair question from where the client sits. It was also the only number anybody wanted from that project. Nobody asked how many people opened the second layer, how long the banner took to appear, or how many vendors were sitting in the list behind it. Just the accept rate.
So I did a small unscientific thing that week. I picked 10 sites I’d really visit, and on each one I counted the clicks between landing and having said no to everything optional.
Yes was 1 click on all 10 of them. No ran from 3 clicks to 19.
The 19 was a national newspaper, where Manage Preferences opened a list of a few hundred companies with a toggle each and most of the toggles already on. Under that was a second list of companies that apparently didn’t need my consent, with no toggles at all and a link to go and opt out of them on somebody else’s website.
That’s the deliverable. The whole industry spent two years and a lot of money preparing, and it produced a machine for getting a yes.
Working as intended
As I understand it, consent is supposed to work like a brake. Collecting data about people is intrusive, so you have to ask. Asking is awkward and the awkwardness is the part doing the work because it makes you think about whether you need the data at all.
If most people say no, that isn’t a bug. That’s the mechanism reporting back.
But the awkwardness got filed as a conversion problem instead, and this industry is extremely good at conversion problems.
So a whole product category took off within about a year, with pricing tiers and A/B testing and case studies advertising consent rates above 90%. The number those vendors optimize is explicitly the number of people who agree.
It’s on their marketing pages. Nobody’s hiding it because from where they sit there’s nothing to hide. The client wants the data, the law says ask, and the vendor sells the asking.
Meanwhile nothing about the collection changed. The trackers are the same trackers in the same tag manager, firing on the same events. We built a doorway in front of them and then spent a year making the doorway easier to walk through.
Which one looks like the button?
One line of Article 7 says that withdrawing consent has to be as easy as giving it.
Go and look at what that turned into. This is the shape of it, lifted out of a vendor stylesheet I had open last week and renamed:
.consent__accept {
background-color: #1a7f37;
border: 0;
border-radius: 4px;
color: #fff;
font-size: 16px;
font-weight: 700;
padding: 14px 36px;
}
.consent__manage {
background-color: transparent;
border: 0;
color: #6b6b6b;
font-size: 13px;
padding: 0;
text-decoration: underline;
}Both of those are <button> elements. One of them looks like a button. The eye has sorted them before anybody has read either label.
I don’t think anybody designs two controls that far apart by accident. Somebody tested it, somebody won that test, and the win got written down as a default in a product that a few thousand sites then installed without opening.
The layered version is worse. Behind Manage Preferences is a vendor list that takes several minutes of steady clicking to get through, which means the person determined enough to do it is being charged for the determination. Everyone involved knows that because it’s what the layer is for.
A few sites do put a reject-all button on the first screen (none of my 10 did). That’s a real improvement where it exists. It’s also telling that it arrives as the exception instead of as the obvious counterpart to the button that’s been there since day one.
I don’t think you can call the yes at the end of all that freely given in any ordinary sense of the words. Whether it’s freely given in the legal sense is somebody else’s question. My guess is that we find out slowly, over several years and a few countries at a time.
Now with more third parties
This is the part I can actually be technical about since it’s my job.
These things are heavy. The consent platform is often the single largest script on the page and it loads from a domain that isn’t yours. It blocks rendering because it has to be on screen before anything else is, and it makes a round trip to a vendor’s server before the page is usable.
I measured one at a little over 200 KB on a site whose entire remaining page weight was under 400 KB. The notice about the trackers outweighed the site.
I’ve been writing about page weight since 2015, mostly about images. It never once occurred to me that the heaviest thing on the page would eventually be the part explaining what the other parts are doing to you.
So the intervention meant to protect people from third-party scripts arrives as a third-party script that’s slower than most of the trackers it’s gating and knows every site you visit. I don’t have anything to add to that. It’s just true.
Nothing to declare
I keep saying this in meetings, so I’ll say it here too.
If a site doesn’t set non-essential cookies, it doesn’t need a consent banner.
That’s the design, not a loophole. The banner exists because of what’s behind it, and the more you’re doing to somebody the more interface you owe them. No tracking means no banner, no build, no legal review, and a page that loads.
I’ve now done this all the way on two client sites and it worked both times. It starts with the list of everything the site talks to because nothing comes off a site until somebody has written down what’s on it.
Self-host the fonts, which is faster anyway. Drop the heatmap tool nobody had opened in years. Replace the embedded video with a click-to-load thumbnail so nothing gets requested until somebody wants to watch. Drop the chat widget or load it on click.
That leaves the analytics question, which is the real one. Both times the answer was a setup that doesn’t identify individuals and doesn’t need consent, with the client losing some reporting granularity they’d never used to decide anything.
Both sites got faster, both got simpler, and neither one has a banner.
And I’d love to report that this is now an easy sell. It absolutely is not. “We could collect less” arrives in a meeting as a proposal to give something up. The loss gets described vividly by a vendor with a deck, while the gain is a page that loads quicker and a conversation nobody has to have.
Somebody pays for the reporting
Some businesses really do live on this data, and ad-funded publishing is the obvious one. If the money that pays for the reporting comes from targeted advertising then “just don’t track people” is a proposal to change the business model. It’s fair to point out that the visible alternatives so far are paywalls and a smaller press.
I think there’s a version of advertising that doesn’t involve following people around. I don’t think we’re anywhere near it, but I’d rather say that than pretend the trade isn’t there.
The small firm that was told by somebody they trusted that they had to install a consent platform isn’t the villain here either. They were sold a solution to a problem nobody had explained to them, which is the story of most of the last decade of this industry. Now their banner is sitting on a brochure site that sets one cookie for the contact form.
I built two of them
I’ve built two of these this year. I argued against one of them and lost. I didn’t argue about the other at all because it came through as a ticket with a date on it and I had the capacity that week.
I don’t feel great about that. I don’t think it makes me complicit in anything enormous either, since both of those sites were getting a banner regardless of who wrote the CSS. But “the client asked for it” is a sentence that carries a lot of weight in this industry. I’ve started noticing how easily I reach for it and how rarely anybody asks me to justify a yes.
I’ve been on the other side of the accept-rate question myself. Before I did this for a living, I worked a register at a big-box store for a while. My manager cared about one number, which was how many customers I’d signed up for the store’s credit card. Mine was bad every week.
I asked because the training said to, people said no, and I said okay and rang up their shampoo. My manager brought it up most shifts. I wish I could say I was holding the line on principle, but mostly I just didn’t care about the card.
Nobody at that store ever wondered whether the people saying no had a point. I recognized the question the second it came back to me with a banner attached, and the honest answer hasn’t changed since the register. More people will say yes if you make no harder to say and I’m not sure the number measures much besides that.