Cookie consent — a transparency requirement that stopped informing anyone

What cookie consent was meant to do. The EU ePrivacy Directive, implemented through national laws from 2012, required websites to obtain consent before placing non-essential cookies. The obligation was a transparency measure: the person whose data was collected would know, and could refuse.

What it became. The first implementations treated a passing notice as implied consent, informing no decision, and enforcement pushed toward explicit opt-in models. The interfaces that answered that pressure introduced new failures: asymmetric design (a bright 'Accept All' button beside a grayed-out 'Manage Preferences'), pre-ticked boxes, and heavy friction on the opt-out path. A scrape of the top UK sites found only around 12% of banners met the GDPR's minimum legal requirements for free, informed consent (Nouwens et al., CHI 2020). Users learned to clear the screen reflexively; the disclosure did no work. The people it failed hardest were those least equipped to question it: low reading confidence, little time, clicking through and gaining nothing the disclosure promised.

The enforcement turn. Regulators eventually moved against the design itself rather than the absence of a banner. In its first settlement (March 2025), the California Privacy Protection Agency fined Honda USD 632,500 under the CCPA for a cookie banner that made opting out harder than opting in. The Swedish DPA (IMY) targeted dark patterns in cookie banners in April 2025. Geo-adaptive consent platforms now detect user location and render jurisdiction-appropriate interfaces: opt-in for GDPR regions, opt-out for CCPA/CPRA regions.

The lessons the disclosure patterns carry forward.

1. Timing matters. Banners fail partly because they fire on page load, before the user has any context for the choice. Disclosure belongs at the point of the decision it informs: for a data-movement disclosure, the submission step.
2. Symmetry of choices. Regulators now fine asymmetric designs; where a disclosure offers alternatives, the options must be presented symmetrically.
3. The user must be able to act. A disclosure the user cannot act on is a screen they cannot realistically read or refuse. Where there is no alternative, the honest form is an informational label that states the position, not a consent prompt implying a choice that does not exist.
4. Fatigue is the enemy. A disclosure that fires on every interaction trains everyone to ignore it; the trigger has to be reserved for the moments that change the user's legal protections.
5. Machine-readable signals. For agent-mediated interactions, the same facts must be available as structured metadata the user's agent can process, not only as banner text.

The organizing failure is the one the library's response-surface principle names: the cookie banner put the right information at the wrong moment, before the user had a decision to make. Any new disclosure duty designed without that lesson repeats it.

Consent-banner design failure modes are documented across the compliance-platform literature: see DataGrail on deceptive design mistakes, Transcend's Cookie Banner 101, and Webtoffee on banner design. Enforcement has turned on those failure modes: the Swedish DPA's April 2025 action on dark patterns and the California Privacy Protection Agency's first settlement (March 2025), fining Honda USD 632,500 under the CCPA for a banner that made opting out harder than opting in. The scale of the design failure is quantified in Nouwens et al. (CHI 2020), the scrape of top UK sites behind the compliance figure of around 12%.