The cookie banner is the product now

I did a small unscientific thing last week. Ten sites, all ones I’d genuinely visit, and on each one I counted the clicks between landing and having said no to everything optional.

Saying yes was one click on all ten. Saying no ranged from three to 19. The 19 was a national newspaper, where “manage preferences” opened a list of a few hundred companies, each with its own toggle, most of them on by default, and a second tab labeled legitimate interests where the toggles were also on and the copy explained that these didn’t require my consent at all.

That’s the deliverable. That’s what a year of preparation and an enormous amount of money produced across the industry: a machine for obtaining a yes.

What it was supposed to be

The idea behind consent, as I understand it, is that it functions as a brake. Collecting data about people is intrusive, so you have to ask, and asking is awkward, and the awkwardness is doing useful work: it makes you consider whether you need the data at all. If most people say no, that’s not a bug. That’s the mechanism telling you something.

What happened instead is that the awkwardness was identified as a conversion problem, and this industry is extremely good at conversion problems. So an entire product category appeared, with pricing tiers and A/B testing and case studies advertising consent rates above 90%, and the number they optimize is explicitly the number of people who agree.

Consent was supposed to be a brake. We identified the friction as a conversion problem, and this industry is extremely good at conversion problems.

Nothing about the collection changed. The trackers are the same trackers. What we built was a doorway in front of them, and then we spent a year making the doorway easier to walk through.

The asymmetry is the whole tell

Last month I wrote that the consent clauses read as a design brief, and one of the lines in that brief is that consent must be freely given and as easy to withdraw as to give.

Put that next to a big colored button saying Accept All and a piece of gray underlined text saying Manage Preferences, and the interface has already answered the question. Nobody designs those two elements with that much difference between them by accident. Someone tested it.

The layered version is worse. Behind Manage Preferences is a list of vendors that would take a determined person 20 minutes to work through, and the determined person is being punished for their determination, and everyone involved knows this because that’s what the layer is for. There’s a reject-all button appearing on some of these now. That’s an improvement, and it’s telling that it’s being treated as a concession rather than as the obvious counterpart to the button that was there from day one.

I don’t think you can call the resulting yes freely given in any ordinary sense of those words. Whether it’s freely given in the legal sense is somebody else’s question and I’d guess we’ll find out over the next few years.

Heavy, and third-party

The part I can be properly technical about, because it’s my job.

These things are heavy. The consent platform is frequently the largest single script on the page, it’s loaded from a third-party domain, it blocks rendering because it has to appear before anything else, and it does a round trip to a vendor’s server before your page is usable. I’ve measured one at over 200 KB, on a site whose entire remaining page weight was under 400 KB.

So the intervention designed to protect people from third-party scripts is delivered by a third-party script, slower than most of the trackers it’s gating and which knows every site you visit. I don’t have anything clever to add to that, it’s just true.

The option nobody took

Here’s the thing I keep saying in meetings and I’ll say it here.

If a site doesn’t set non-essential cookies, it doesn’t need a consent banner.

That’s not a loophole, it’s the design. The banner exists because of what’s behind it, and the amount of interface you need is proportional to how much you’re doing. Zero tracking, zero banner, zero engineering, zero legal review, and a page that loads.

I’ve now done this properly on two client sites and it was achievable in both cases. Self-host the fonts, which is faster anyway. Drop the heatmap tool nobody has opened since 2016. Replace the embedded video with a click-to-load thumbnail, so nothing is requested until someone actually wants to watch. Drop the chat widget, or load it on click. And then the analytics question, the real one, where the answer that worked was a setup that doesn’t identify individuals and doesn’t need consent, and the client lost some reporting granularity they had never once used for a decision.

Both sites got faster. Both got simpler. Neither has a banner. And I’d love to report that this is now an easy sell and it absolutely is not, because “we could collect less” arrives in a meeting as a proposal to give something up, and the thing being given up is vividly described by the vendor and the thing being gained is diffuse.

There’s a real trade here

I don’t want to be glib about this, so.

Some businesses do make their living from this data, and ad-funded publishing is the obvious one. If the money that pays for reporting comes from targeted advertising, then “just don’t track people” is a proposal to change the business model, and it’s fair to point out that the visible alternatives so far are paywalls and a smaller press. I think there’s a version of advertising that doesn’t require following people around and I don’t think the industry is close to it, but I’d rather say that than pretend the trade-off doesn’t exist.

And the small firm who was told by someone they trusted that they had to install a consent platform isn’t a villain. They were sold a solution to a problem nobody had explained to them, which is the same story as most of the last decade of this industry.

The admission

Since it’d be dishonest to leave it out: I have built two of these this year and invoiced for both. One of them I argued against and lost, and one I didn’t argue about at all, because the client asked for it and I had two weeks free.

I don’t feel great about that. I don’t think it makes me complicit in anything enormous either, and the site would have had one whether or not I built it. But I’ve noticed that “the client asked for it” is a sentence that carries a lot of weight in this industry, and I’d like to be at least a bit more careful about how often I lean on it 😔