Invisible, Unreadable, and Inaudible Cookie Notices: An Evaluation of Cookie Notices for Users with Visual Impairments
James M. Clarke, Maryam Mehrnezhad, Ehsan Toreini
TL;DR
This work investigates how accessible cookie notices are for users with visual impairments by combining system studies on 46 top UK websites with a dedicated user study of 100 VI participants. It integrates automated WCAG testing (WAVE, Lighthouse), a text-only browser (WebbIE), and screen readers (NVDA, JAWS) to reveal widespread issues such as low contrast, missing headings, and notices not read immediately. The findings show that many cookie notices enable or precede tracking and that VI users often experience negative perceptions and mismatches between desired and actual interaction with notices. The study concludes with concrete recommendations for web developers, accessibility-tool designers, policymakers, and end users to align privacy practices with accessibility needs and improve real-world protections for VI users.
Abstract
This paper investigates the accessibility of cookie notices on websites for users with visual impairments (VI) via a set of system studies on top UK websites (n=46) and a user study (n=100). We use a set of methods and tools--including accessibility testing tools, text-only browsers, and screen readers, to perform our system studies. Our results demonstrate that the majority of cookie notices on these websites have some form of accessibility issues including contrast issues, not having headings, and not being read aloud immediately when the page is loaded. We discuss how such practises impact the user experience and privacy and provide a set of recommendations for multiple stakeholders for more accessible websites and better privacy practises for users with VIs. To complement our technical contribution we conduct a user study and finding that people with VIs generally have a negative view of cookie notices and believe our recommendations could help their online experience. We also find a disparity in how users wish to respond to cookie notices as apposed to how they do in reality.
