Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
https://arxiv.org/abs/2001.02479
Method
"scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680)"
Population
"the top 10,000 websites in the UK (n=680)"
What it does not show
Audits banner design and stated consent, not whether declining actually stopped downstream collection. UK sites and five vendors only, so prevalence may not carry to other jurisdictions or hand-built flows. Says nothing about enforcement outcomes.
Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, Lalana Kagal
Only 11.8% of 680 consent dialogues met minimal legal requirements — a clearly visible reject option, no pre-ticked boxes, no forced-choice framing. In the embedded experiment, removing the opt-out from the first layer raised recorded consent by 22-23 percentage points, and forcing per-purpose controls onto the first layer lowered it by 8-20 points.
Tier II: Observational audit of live consent-platform code across 680 real sites, with a smaller embedded randomised field experiment. The population-scale finding is observational and has no control group.