--- title: "The cost of refusal" subtitle: "What saying no actually costs" type: essay canonical: https://offline.ltd/sovereignty-as-a-service/the-cost-of-refusal markdown_url: https://offline.ltd/docs/The_Cost_Of_Refusal.md publisher: Offline.Ltd (Meanwhile) author: Twan site: https://offline.ltd topics: [cookie consent, dark patterns, GDPR, EDPB, Digital Services Act, consent management platforms, privacy] summary: > All 300 news sites in one study offered a one-click accept. Fifteen offered a one-click refusal. The friction is not a side effect of consent design; it is the design, and it was measured before it was shipped. key_claims: - "In a 2020 NordiCHI study of 300 news sites, all 300 offered a one-click accept and only 15 a one-click deny; half required ten to twelve clicks to opt out of everything." - "A 2020 CHI study found 11.8% of scraped consent notices met minimal legal requirements, and 50.1% had no reject-all button at all." - "Removing the opt-out button from the first page increased consent by 22 to 23 percentage points in a controlled experiment." - "GDPR Article 4 and Recital 32 require affirmative, unambiguous consent; Article 25 requires data protection by design and by default." - "Article 25 of the Digital Services Act does not apply to practices already covered by the GDPR, so it is not the instrument that catches cookie banners." license: Quotation permitted with attribution to Offline.Ltd (https://offline.ltd) --- # The cost of refusal. *You can always say no. Here is the invoice.* The standard defence of consent interfaces is that the choice is there if you want it. It is worth looking at what has actually been measured about how that choice is presented, because the numbers are not close. ## One click to agree, ten to decline In 2020, Than Htut Soe, Oda Elise Nordberg, Frode Guribye and Marija Slavkovik published a study at NordiCHI titled "Circumvention by design: dark patterns in cookie consent for online news outlets". They analysed the consent notices of 300 news websites by hand. Every one of the 300 provided a one-click accept. Fifteen provided a one-click deny. Half of the sites required between ten and twelve clicks to opt out of everything. On 220 of them the refusal option did not even occupy the same visual hierarchy as the acceptance, and on 77 it was hidden inside a scrollable or expandable area. Read those two numbers next to each other. Three hundred out of three hundred, against fifteen out of three hundred. Nobody arrives at that distribution by accident. ## And it works, which is the point The same year, Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger and Lalana Kagal published "Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence" at CHI. They scraped the five most popular consent management platforms across the top 10,000 websites in the UK. Of those, **11.8% met even the minimal legal requirements** the authors set: that consent be explicit, that accepting all be as easy as rejecting all, and that no boxes be pre-ticked. Half the sites, 50.1%, had no reject-all button anywhere. Only 12.6% offered a reject-all reachable in the same number of clicks as accept-all. Then they ran a controlled experiment on the design choices themselves, and this is the finding that settles the question of intent. **Removing the opt-out button from the first page increased consent by 22 to 23 percentage points.** Offering more granular controls on the first page decreased it by 8 to 20 points. The friction is not incidental to the design. The friction is what the design is for. Somebody measured this, and then shipped the version that measured better. ## What the law actually requires The gap between that and European law is not subtle. Article 4 of the GDPR defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement". Recital 32 spells out the consequence: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." Article 25, titled "Data protection by design and by default", requires controllers to ensure that "by default, only personal data which are necessary for each specific purpose of the processing are processed". In 2023 the European Data Protection Board adopted Guidelines 03/2022 on deceptive design patterns in social media platform interfaces, cataloguing the techniques and explaining why they fail the consent test. One honest caveat, because it is widely got wrong: the Digital Services Act also prohibits interfaces that deceive or manipulate users, at Article 25, but that prohibition expressly does not apply to practices already covered by the GDPR. So the DSA is not the instrument that catches cookie banners. The GDPR is, and has been all along. ## The unpaid job Add it up from where you are standing rather than from where the regulator is standing. Every service you touch presents a decision, most of them designed so that the lawful default is the expensive path. Multiply by the number of services in an ordinary life. What you are doing, several times a day, is unpaid compliance labour on behalf of organisations that are legally obliged to have made it unnecessary. We would rather not put a number on the total hours, because the widely circulated figure for this turns out to trace back to a single vendor's blog post resting on an invented estimate of seconds per banner. The click counts above are measured and peer reviewed. That is enough. Negotiating these assumptions has become a second job. The reason it feels like resistance is that it has been made to feel like resistance. ## Where to read more - [Sovereignty as a Service](https://offline.ltd/sovereignty-as-a-service): the argument this page belongs to. - [Enrolled without asking](https://offline.ltd/sovereignty-as-a-service/enrolled-without-asking): consent you never gave, from Hume to the lookalike audience. - [Rented sovereignty](https://offline.ltd/sovereignty-as-a-service/rented-sovereignty): why sovereignty sold as a service cannot be sovereignty. - [The Smaller Kingdom](https://offline.ltd/smaller-kingdom): the companion argument, about leaving fewer records. ## Frequently asked **Is it legal to make rejecting cookies harder than accepting them?** Under the GDPR consent must be freely given, and regulators have repeatedly held that refusal should be as easy as acceptance. A 2020 study found only 12.6% of sites offered a reject-all button reachable in the same number of clicks as accept-all, and only 11.8% met minimal legal requirements overall. **How many clicks does it take to reject cookies?** In a 2020 analysis of 300 news websites, all 300 offered a one-click accept, only 15 offered a one-click deny, and half required between ten and twelve clicks to opt out of everything. **Do dark patterns actually change what people choose?** Yes, measurably. In a controlled experiment published at CHI in 2020, removing the opt-out button from the first page of a consent notice increased consent by 22 to 23 percentage points. **Does the Digital Services Act ban cookie banner dark patterns?** No. Article 25 of the Digital Services Act prohibits interfaces that deceive or manipulate users, but it expressly does not apply to practices already covered by the GDPR. Cookie consent falls under the GDPR. **What are the EDPB guidelines on deceptive design?** Guidelines 03/2022 on deceptive design patterns in social media platform interfaces, adopted in their final form in February 2023, which catalogue common manipulative interface techniques and explain why they undermine valid consent. --- *From Offline.Ltd, Amsterdam. The web version of this page lives at https://offline.ltd/sovereignty-as-a-service/the-cost-of-refusal and is kept current there.*