Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR
Authors: Dominique Machuletz (Independet), Rainer Böhme (University of Innsbruck, Austria)
Volume: 2020
Issue: 2
Pages: 481–498
DOI: https://doi.org/10.2478/popets-2020-0037
Abstract: The European Union’s General Data Protection Regulation (GDPR) requires websites to ask for consent to the use of cookies for specific purposes. This enlarges the relevant design space for consent dialogs. Websites could try to maximize click-through rates and positive consent decision, even at the risk of users agreeing to more purposes than intended. We evaluate a practice observed on popular websites by conducting an experiment with one control and two treatment groups (N = 150 university students in two countries). We hypothesize that users’ consent decision is influenced by (1) the number of options, connecting to the theory of choice proliferation, and (2) the presence of a highlighted default button (“select all”), connecting to theories of social norms and deception in consumer research. The results show that participants who see a default button accept cookies for more purposes than the control group, while being less able to correctly recall their choice. After being reminded of their choice, they regret it more often and perceive the consent dialog as more deceptive than the control group. Whether users are presented one or three purposes has no significant effect on their decisions and perceptions. We discuss the results and outline policy implications.
Keywords: web privacy, user study, consent, cookies, controlled experiment, choice proliferation, deception, privacy paradox, privacy by design, dark patterns
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 license.
