Consent and Choice: Experimental Evidence on User Behavior at Consent Banners

A study (1) co-authored by Francesco Decarolis of Bocconi University follows 789 internet users for up to three months and finds that they engage with only one in three cookie banners. Its results bear on the European Commission's proposal to move consent into the browser.

In November 2025, the European Commission proposed, as part of its Digital Omnibus package, that websites respect a machine-readable signal through which users give or refuse consent automatically, and that browsers offer a way to set it. The proposal is motivated in large part by the time Europeans spend on banners, and it leaves open whether the signal would be a single setting applied to every website or could differ from one website to the next.

A new study by Cristiana Firullo (Cornell University and BAFFI), Francesco Decarolis (Bocconi University and CEPR), Cristobal Cheyre (Cornell University) and Alessandro Acquisti (MIT), “Consent and Choice: Experimental Evidence on User Behavior at Consent Banners”, looks at what users actually do when a banner appears. The authors use data from the Internet Behavior Experiment (IBE), a large field experiment on how online tracking and advertising affect consumers. IBE participants install research software that includes a browser extension which, for up to three months, records the pages they visit, the consent banners they meet and the clicks they make on them, and they answer surveys on their privacy attitudes when they join, every month and when they leave. Each participant is randomly assigned to one of three conditions: opted in to tracking and targeted advertising, opted out of tracking across major advertising networks, or browsing with ads blocked. The experiment is ongoing and targets 1,200 participants; the study analyzes the first 789 U.S. Chrome users. Unlike experiments in which researchers design the banner, the study observes the banners that websites themselves display while participants browse as they normally would: 16,410 encounters in total.

Two banners in three are ignored

Users make an explicit choice in only 31 percent of encounters. In 62 percent they ignore the banner and keep browsing, and in 7 percent they leave the website. When they do choose, 84 percent of choices accept tracking and 16 percent reject it.

Whether a user answers a banner at all depends mostly on the website and on the banner, not on the user. The privacy preferences that participants stated at the start of the study predict whether they engage with a banner no better than a coin toss. Engagement is lowest on productivity and on news and lifestyle websites (24 and 25 percent of encounters) and highest on streaming websites (51 percent). Banners that offer a one-click reject button are answered in 47 percent of encounters, against 20 percent for banners that do not, and websites that cannot be browsed until a choice is made obtain an answer in 80 percent of encounters, against 26 percent elsewhere. These websites, however, see visitors leave more than twice as often (17 against 7 percent).

What users choose, once they answer, is instead related to who they are. Participants in the top third of stated privacy concern reject tracking more than twice as often as those in the bottom third, although they still accept 77 percent of the banners they answer.

How well would one setting reflect users' choices?

To approximate a single browser setting, the authors take the choice each participant made most often during the first third of the days they were observed and compare it with what the participant did afterwards. This signal matches 90 percent of later explicit choices. But explicit choices are only a third of later encounters: when ignoring the banner is counted as a possible outcome, the signal matches 65 percent of them. A single setting would thus also apply to the many encounters in which users currently make no choice, and the study cannot say what ignoring a banner means for the user, who may be content to be tracked, may think that not clicking is enough to refuse, or may not care.

How much time is actually lost with banners?

The Commission's Staff Working Document estimates that Europeans spend 334 million hours a year on cookie banners. Per internet user, this assumes 100 websites visited a month, 85 percent of them showing a banner and 3.5 seconds spent on every banner: about 60 minutes a year, all of which the Commission expects users of a browser setting to save.

The study's data change two of these assumptions. Most websites do not show the banner again once a user has answered it, so what matters is the number of new websites a user visits, 76 a month for the median participant. And most banners are ignored, so the authors count time only for explicit choices, which take a median of 6.6 seconds. Using European data on how many websites show a banner (two in three) and how many of these force a choice (about half), the authors estimate that a user spends about 42 minutes a year on cookie banners, most of them on websites where ignoring the banner is not an option. If websites could not force a response, this time would fall to about 18 minutes a year, 58 percent less, without any change in how consent is collected.

What is at stake for websites

In the study's data, 95 percent of encounters end without a rejection, which counts as consent under U.S. practice, so most of the impressions that a new way of collecting consent would affect are currently tracked. Previous research estimates that an ad shown without tracking is worth from 4 percent to about half less. How much publishers would lose depends on how many users refuse and on how the advertising market responds: spending could fall, or move to contextual advertising and to advertising based on first-party data. Because a browser setting applies to the tracking that passes through the browser, such as third-party cookies, large platforms that collect data from their logged-in users could gain relative to publishers.

The authors note that their data come from U.S. users and from banners designed by websites under current rules, and cannot predict how users would answer a question asked once by the browser. Their findings suggest that the time users spend on consent depends more on whether websites force a response than on how often consent is asked, and that a single signal would reproduce most, but not all, of the choices users make website by website.

(1) Professor Francesco Decarolis and co-author Cristiana Firullo gratefully acknowledge financial support from Amazon Europe Core S.à r.l and Clifford Chance for the analytical contributions regarding the legal and regulatory aspects of the study. None of the funders had any role in the study design, data collection, analysis, or decision to publish.

Time spent on cookie banners, per user per year