Test the consent dialogue against the law, not the vendor default
Whether a consent dialogue is lawful is mechanically checkable — a visible reject option at the same level as accept, no pre-ticked non-essential boxes, no forced choice — and the overwhelming majority of deployed dialogues fail that check.
Do this firstNothing. This is a place to start.
Render the banner, inspect the DOM, assert the three properties. It is a test, and almost nobody runs it.
What makes this a quality control rather than a legal footnote is that the design moves the number. In a controlled comparison, removing the opt-out button from the first layer raised recorded consent by 22 to 23 percentage points, and putting per-purpose controls on the first layer lowered it by 8 to 20. A figure that swings that far on layout is not measuring what people want; it is measuring what the interface allowed them to express.
Scope: this checks the dialogue, not the behaviour behind it. Whether declining actually stops collection is the next control, and it fails far more often.
The decoy
A consent management platform. Buying one is the step everyone takes and it is not the control: measured across 680 live sites using the five most popular platforms, only 11.8% of the resulting dialogues met the minimum legal requirements. The default template is the problem, not the fix.
Evidence
- Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence — IIOnly 11.8% of 680 consent dialogues met minimal legal requirements — a clearly visible reject option, no pre-ticked boxes, no forced-choice framing. In the embedded experiment, removing the opt-out from the first layer raised recorded consent by 22-23 percentage points, and forcing per-purpose controls onto the first layer lowered it by 8-20 points.
Last reviewed 2026-08-19.