Cookie consent — a transparency requirement that stopped informing anyone

What cookie consent was meant to do. The EU ePrivacy Directive, implemented through national laws from 2012, required websites to obtain consent before placing non-essential cookies. The obligation was a transparency measure: the person whose data was collected would know, and could refuse.

What it became. The first implementations treated a passing notice as implied consent, informing no decision, and enforcement pushed toward explicit opt-in models. The interfaces that answered that pressure introduced new failures: asymmetric design (a bright 'Accept All' button beside a grayed-out 'Manage Preferences'), pre-ticked boxes, and heavy friction on the opt-out path. A scrape of the top UK sites found only around 12% of banners met the GDPR's minimum legal requirements for free, informed consent (Nouwens et al., CHI 2020). Users learned to clear the screen reflexively; the disclosure did no work. The people it failed hardest were those least equipped to question it: low reading confidence, little time, clicking through and gaining nothing the disclosure promised.

The enforcement turn. Regulators eventually moved against the design itself rather than the absence of a banner. In its first settlement (March 2025), the California Privacy Protection Agency fined Honda USD 632,500 under the CCPA for a cookie banner that made opting out harder than opting in. The Swedish DPA (IMY) targeted dark patterns in cookie banners in April 2025. Geo-adaptive consent platforms now detect user location and render jurisdiction-appropriate interfaces: opt-in for GDPR regions, opt-out for CCPA/CPRA regions.

The lessons the disclosure patterns take forward.

1. Timing matters. Banners fail partly because they fire on page load, before the user has any context for the choice. Disclosure belongs at the point of the decision it informs: for a data-movement disclosure, the submission step.
2. Symmetry of choices. Regulators now fine asymmetric designs; where a disclosure offers alternatives, the options must be presented symmetrically.
3. The user must be able to act. A disclosure the user cannot act on is a screen they cannot realistically read or refuse. Where there is no alternative, the honest form is an informational label that states the position, not a consent prompt implying a choice that does not exist.
4. Fatigue is the enemy. A disclosure that fires on every interaction trains everyone to ignore it; the trigger has to be reserved for the moments that change the user's legal protections.
5. Machine-readable signals. For agent-mediated interactions, the same facts must be available as structured metadata the user's agent can process, not only as banner text.

The organizing failure is the one the library's response-surface principle names: the cookie banner put the right information at the wrong moment, before the user had a decision to make. Any new disclosure duty designed without that lesson repeats it.

Nouwens et al., Dark Patterns after the GDPR, CHI. The scrape of top UK sites found around 12 percent of banners met the minimal requirements of European law, and the study measured how presentation changed what people chose. The failure is in the design of the choice, and not in whether a choice was offered.

The California Privacy Protection Agency's Honda settlement. The California Privacy Protection Agency's first settlement fined Honda USD 632,500 under the CCPA for a banner that made opting out harder than opting in, and the Swedish data protection authority has acted on dark patterns in the same place. Regulators are now reading the interface, and not only the policy behind it.

Compliance-platform catalogs of banner failure modes (DataGrail). The compliance-platform literature catalogs the recurring banner faults: unequal prominence between accept and reject, pre-ticked boxes, and reject paths buried a layer down. The taxonomy exists because the same handful of designs recur across the web.