A history of GDPR cookie banner compliance: the roles of publishers, regulators and CMPs

• URL: http://arxiv.org/abs/2606.31485v2
• Date: Thu, 02 Jul 2026 11:15:22 GMT
• Title: A history of GDPR cookie banner compliance: the roles of publishers, regulators and CMPs
• Abstract summary: The cookie banner landscape has evolved under the influence of key players, including publishers (website owners), regulators, and Consent Management Platforms (CMPs)<n>Our results indicate a positive evolution in the privacy landscape, with the compliance rate for websites featuring a "reject all" button increasing from 2.94% in 2018 to 30.66% in 2024.<n>Our findings highlight the importance of more uniform collaboration and guidance among EU-level regulators to reduce divergence and simplify cookie banner compliance.
• Score: 10.073865488509703
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Since the introduction of the GDPR in 2018, cookie banners have become the primary mechanism for users to express preferences on online tracking and advertising. Consequently, their visual design and the options they present significantly influence user choice. Over time, the cookie banner landscape has evolved under the influence of key players, including publishers (website owners), regulators, and Consent Management Platforms (CMPs). This paper presents an in-depth analysis of the roles of these three key actors and an examination of their impact on cookie banners' design and implementation within the context of EU law. Our results, based on a historical evaluation of 11364 websites across 30 countries, indicate a positive evolution in the privacy landscape, with the compliance rate for websites featuring a "reject all" button increasing from 2.94% in 2018 to 30.66% in 2024. We analyze Data Protection Authority (DPA) activity and find a clear correlation between higher compliance rates and stronger regulatory action and guidance. Our experiments further show that compliance improvements are primarily driven by website owners, with CMPs showing little response to regulatory action or (indirect) influence on compliance rates. Our findings highlight the importance of more uniform collaboration and guidance among EU-level regulators to reduce interpretive divergence and simplify cookie banner compliance, as well as the need for regulatory oversight of CMPs, which in turn could significantly enhance privacy for many websites and users. Our work provides a foundation for academics, regulators, and industry to develop more effective strategies to motivate key players and promote greater user privacy.

Related papers

• PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA [1.8964171459664039]
  Five years after the enforcement of the California Consumer Privacy Act (CCPA), understanding how website privacy practices evolve at scale in response to regulation remains a key challenge for researchers and regulators.<n>We present PrivAudit, an automated auditing framework that adopts a duallens approach to capture: (1) privacy disclosures through large language model-based analysis of privacy policies grounded in CCPA provisions, and (2) user-observable data collection behavior through automated browser measurements of cookie writes under diverse privacy configurations.
  arXiv  Detail & Related papers  (2026-09-09T04:31:30Z)
• Transparent and Controllable Recommendation Filtering via Multimodal Multi-Agent Collaboration [48.028080782524064]
  We introduce a novel framework that integrates end-to-cloud collaboration, multimodal perception, and multi-agent orchestration.<n>Our system employs a fact-grounded adjudication pipeline to eliminate inferential hallucinations.<n>It constructs a dynamic, two-tier preference graph that allows for explicit, human-in-the-loop modifications.
  arXiv  Detail & Related papers  (2026-04-19T14:19:28Z)
• Fairness Dynamics in Digital Economy Platforms with Biased Ratings [50.29721091981893]
  We study how digital platforms can perpetuate or counteract rating-based discrimination.<n>Our results demonstrate a fundamental trade-off between user experience and fairness.<n>Our results also provide evidence that intervening by tuning the demographics of the search results is a highly effective way of reducing unfairness.
  arXiv  Detail & Related papers  (2026-02-18T18:41:16Z)
• Using Salient Object Detection to Identify Manipulative Cookie Banners that Circumvent GDPR [5.595574586977254]
  We study how often cookie banners comply with General Data Protection Regulation.<n>We also evaluate how frequently the banners comply with recommendations of national protection authorities.<n>Although 45% of relevant websites have fully compliant banners, we found aesthetic manipulation on 38% of compliant banners.<n>We find that 13.9% of EU websites change their banner design when the user is from the US, and EU websites are roughly 48.3% more likely to use aesthetic manipulation than non-EU websites.
  arXiv  Detail & Related papers  (2025-10-30T19:50:13Z)
• "Nobody should control the end user": Exploring Privacy Perspectives of Indian Internet Users in Light of DPDPA [2.6885436577568904]
  We explore Indian Internet users' awareness and perceptions of cookie banners, online privacy, and privacy regulations, especially in light of the newly passed DPDPA.<n>Our findings reveal that privacy-conscious users often lack consistent awareness of privacy mechanisms.<n>Our study highlights the need for clearer communication regarding the DPDPA, user-centric consent mechanisms, and policy refinements to enhance data privacy practices in India.
  arXiv  Detail & Related papers  (2025-08-25T12:22:25Z)
• WebGuard: Building a Generalizable Guardrail for Web Agents [59.31116061613742]
  WebGuard is the first dataset designed to support the assessment of web agent action risks.<n>It contains 4,939 human-annotated actions from 193 websites across 22 diverse domains.
  arXiv  Detail & Related papers  (2025-07-18T18:06:27Z)
• Context Reasoner: Incentivizing Reasoning Capability for Contextualized Privacy and Safety Compliance via Reinforcement Learning [53.92712851223158]
  We formulate safety and privacy issues into contextualized compliance problems following the Contextual Integrity (CI) theory.<n>Under the CI framework, we align our model with three critical regulatory standards: EU AI Act, and HIPAA.<n>We employ reinforcement learning (RL) with a rule-based reward to incentivize contextual reasoning capabilities while enhancing compliance with safety and privacy norms.
  arXiv  Detail & Related papers  (2025-05-20T16:40:09Z)
• A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them [6.533686617147407]
  We examine the top 10,000 websites across 31 countries under the ePrivacy Directive and consent-observatory.eu.<n>We show that 67% of websites use consent interfaces, but only 15% are minimally compliant, mostly because they lack a reject option.<n>There is little evidence that regulators' guidance and fines have impacted compliance rates, but 18% of compliance variance is explained by CMPs.
  arXiv  Detail & Related papers  (2025-03-25T13:44:26Z)
• Media and responsible AI governance: a game-theoretic and LLM analysis [61.132523071109354]
  This paper investigates the interplay between AI developers, regulators, users, and the media in fostering trustworthy AI systems.<n>Using evolutionary game theory and large language models (LLMs), we model the strategic interactions among these actors under different regulatory regimes.
  arXiv  Detail & Related papers  (2025-03-12T21:39:38Z)
• Evaluating Cultural and Social Awareness of LLM Web Agents [113.49968423990616]
  We introduce CASA, a benchmark designed to assess large language models' sensitivity to cultural and social norms.<n>Our approach evaluates LLM agents' ability to detect and appropriately respond to norm-violating user queries and observations.<n>Experiments show that current LLMs perform significantly better in non-agent environments.
  arXiv  Detail & Related papers  (2024-10-30T17:35:44Z)
• Privacy Policies and Consent Management Platforms: Growth and Users' Interactions over Time [4.356242302111725]
  Consent platforms (CMPs) have emerged as practical solutions to make it easier for website administrators to manage user consent. This paper presents a detailed analysis of the evolution of CMPs spanning nine years. We observe how even small changes in the design of Privacy Banners have a critical impact on the user's giving or denying their consent to data collection.
  arXiv  Detail & Related papers  (2024-02-28T13:36:27Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.