A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them

TL;DR

This study probes the prevalence and design of GDPR/ePrivacy cookie banners across 31 European jurisdictions by deploying robust automated methods via the consent-observatory.eu platform to study the top 10,000 sites per country. It introduces open-source, scalable detection techniques for consent interfaces, CMP providers, user options, visual prominence, and purpose controls, enabling large-scale cross-country analysis. The authors find that 67% of websites display consent interfaces, two-thirds of which are CMP-driven, with three CMPs (Usercentrics, CookieYes, OneTrust) handling 37% of all CMP usage; only 15% of interfaces meet a conservative minimal compliance standard. They show CMP choice explains up to ~18% of compliance variance, while regulatory guidance and fines have limited measurable impact, emphasizing the need for an infrastructural regulatory focus on CMPs rather than solely improving interfaces. The work highlights power dynamics in the consent ecosystem and offers a practical platform for regulators, journalists, and researchers to map and intervene in this space.

Abstract

Online tracking remains problematic, with compliance and ethical issues persisting despite regulatory efforts. Consent interfaces, the visible manifestation of this industry, have seen significant attention over the years. We present robust automated methods to study the presence, design, and third-party suppliers of consent interfaces at scale and the web service consent-observatory.eu to do it with. We examine the top 10,000 websites across 31 countries under the ePrivacy Directive and GDPR (n=254.148). Our findings show that 67% of websites use consent interfaces, but only 15% are minimally compliant, mostly because they lack a reject option. Consent management platforms (CMPs) are powerful intermediaries in this space: 67% of interfaces are provided by CMPs, and three organisations hold 37% of the market. There is little evidence that regulators' guidance and fines have impacted compliance rates, but 18% of compliance variance is explained by CMPs. Researchers should take an infrastructural perspective on online tracking and study the factual control of intermediaries to identify effective leverage points.

Figures (7)

• Figure 1: Nearly invisible. The top image says "Neka alla" ("Reject all") and the bottom says "Ok". Both images have very low contrast between the text and the background, and no other features that make it stand out.
• Figure 2: Subtle. The top element has no contrast between the button background and parent background and low contrast between the background and the text and border. The bottom element is merely an underlined link.
• Figure 3: Visible. The top element has high contrast between the text and the background, but no other colour or border. The bottom element is a button with a background, but with medium contrast.
• Figure 4: Prominent. The top element has a high contrast between the parent background, button background, and the text, and it is underlined. The bottom element has lower contrast, but a vibrant colour.
• Figure 6: Distribution of top 10 CMP providers by website popularity rank. The main plot groups websites into popularity rank bins of 200 (e.g., 1–200, 201–400). The inset shows the top 1,000 sites, using bins of 50. Dashed lines indicate CMPs that appear in the top 10 only within this smaller subset. The dotted line represents the combined count of all other CMPs outside the top 10. Grid lines mark bin boundaries.