What Consent Means in the Digital World

Every day billions of people press a button. «Accept all». «Agree». «I accept the terms». «Continue». And every time they think they made a choice. That they consented consciously. That now everything is lawful — both for them and for the company. It is not so. Most of what is called consent in the digital world is not consent by law. Is not consent by meaning. And is not consent in fact. Below we examine why. Not abstractly — concretely. What real consent is. What fake consent looks like. And why the difference between them is worth billions of euros in fines.

What consent is under GDPR. Four words that change everything. GDPR defines consent through four characteristics. Article 4(11) and Article 7. Each of them is mandatory. The absence of any one — and the consent is invalid. Free. Specific. Informed. Unambiguous. These are not just beautiful words. They are legally significant criteria with concrete content. Let us examine each. Free — means that you had a real choice. Refusal entails no negative consequences. You do not lose access to the service if you do not agree. You are not subjected to pressure. Consent is given voluntarily — not because the alternative is worse. Specific — means that for each processing purpose separate consent is required. You cannot obtain one consent for everything at once. An «accept all» covering analytics, advertising, transfer to third parties and profiling simultaneously — is not specific consent. Informed — means that you understand what you are agreeing to. Who processes the data. For what purposes. To whom it is transferred. How long it is stored. This is not fine print of forty pages that no one reads. This is real understanding. Unambiguous — means an active action. Explicitly expressed. Not silence. Not continued use of the site. Not a pre-ticked box. A person must do something — press, tick, write — to express consent. Four criteria. All four mandatory simultaneously. Now look at any cookie banner you saw today. And ask yourself — how many of these criteria does it meet.

Tied consent. When there is no choice. This is the first and most widespread violation of the free-consent criterion. You visit a site. A banner appears. Two options. «Accept all» — and you get onto the site. «Customise» or «Reject» — and the site is closed, or the functionality is limited, or a wall appears with text that without consent the service is unavailable. This is called a consent wall. And it is a direct violation of the free-consent criterion. The European Data Protection Board in its guidance documents explicitly indicated — consent is not free if refusing it entails denial of access to the service. If a service is conditioned on consent to data processing that is not necessary for providing that service — the consent is invalid. The logic is simple. You cannot freely consent if you have no real alternative. But look around. How many sites offer full access without consent to advertising cookies? A handful. Most either fully block access, or substantially limit functionality, or show such an inconvenient interface without consent that the user gives up and presses «accept». This is not chance. It is designed pressure.

Consent to everything at once. When there is no specificity. The second mass violation — a violation of the specific-consent criterion. One «accept all» button technically covers dozens of different processing operations. Behavioural analytics. Personalised advertising. Transfer of data to hundreds of advertising partners. Building a psychographic profile. Transfer of data to third countries. GDPR requires separate consent for each substantially different purpose. This means that a correct banner should offer separate toggles for each category of purposes — and by default all should be switched off. The reality looks different. Most banners offer two options. «Accept all» — one press. «Customise» — three screens of settings with dozens of toggles where by default everything is on and you have to actively switch off each item. The asymmetry is deliberate. Consent — one click. Refusal — ten clicks and several minutes of attention. This is a violation of the principle of equivalence — refusal must be as simple as consent. European regulators have repeatedly recorded this. The French CNIL. The German DSK. The Irish DPC.

Informed — the most violated criterion. The informed-consent criterion is violated so systemically that it has become the industry norm. What does a person really understand when they press «accept all»? That their data will be used for advertising — this most people know in general terms. That their data will go to 287 advertising partners whose list is updated weekly and available via a link in the fifth point of the policy — this no one knows. That among these partners are companies on servers in the US without a proper transfer mechanism — this is not mentioned. That their behavioural profile will be sold again and again at real-time advertising auctions — this is hidden behind the phrase «personalised advertising». For informed consent a person must really understand the consequences. Not in theory — in practice. This means the information must be presented in clear language before the moment of consent. Not in a forty-page privacy policy. Right in the banner. Briefly. Clearly. A study conducted in Norway in 2021 showed that when users were shown real information about what happens to their data when they press «accept» — in a clear presentation right in the banner — the percentage of consents fell from 90% to 20%. People are not against the use of data in principle. People are against what is done with it — when they understand what exactly. This is precisely why the real information is not shown. This is precisely why banners are written in legal language. This is precisely why the list of 287 partners is not in the banner but via a link. Ignorance is a product. Specially manufactured.

Silence is not consent. Ever. This seems obvious. But it is violated constantly. «By continuing to use our site you agree to our privacy policy.» This wording is found on thousands of sites. And it directly contradicts the definition of consent in GDPR. Continued use of a site is not an unambiguous expression of consent. An active action. An explicitly expressed will. You visited the site to read an article. You did not express consent to anything. You were simply reading. The European Court of Justice in the 2019 Planet49 decision explicitly indicated — pre-ticked boxes and silent continued use are not valid consent under GDPR. This decision has existed for five years. The wording «by continuing to use» is still on thousands of sites. Because no one checks every site. Because the violation formally exists — but the risk of being caught is minimal.

What happens when consent is invalid. This is an important point that many miss. If consent is invalid — all data processing based on this consent is unlawful. Not merely problematic. Unlawful. This means that all data collected on the basis of invalid consent — must be deleted on request. That all profiles built on this data — are built without a legal basis. That all advertising auctions conducted using this data — violated GDPR. The scale of this is hard to imagine. If most cookie banners do not meet GDPR requirements — and this is exactly what regulators across Europe record — then most of the data collected through them is collected unlawfully. This is precisely why the industry so fiercely resists real enforcement of the consent requirements. Because real enforcement means that a significant part of their business model is based on unlawfully collected data. In the next part we will examine dark design patterns. How exactly the interface is designed to obtain consent you did not plan to give. Concrete mechanics. Concrete examples. And why this is not merely bad design — but a documented legal violation.

Part two — dark design patterns

Last time we examined what real consent under GDPR is. And why most cookie banners do not meet it. Today — more concretely. How exactly interface design is used to obtain consent you did not plan to give. What mechanics. What they are called. And why this is not merely inconvenient design — but a documented legal violation.

Dark patterns. What they are. The term dark patterns was introduced by British designer Harry Brignull in 2010. The definition is simple — interface elements that deliberately mislead the user or steer them towards actions not in their interests. The key word is deliberately. These are not design errors. Not shortcomings. These are decisions made consciously — after testing, measurement, optimisation. The company knew what it was doing. And did it because it works. The European Commission in 2022 conducted a large-scale study. It analysed 399 of the largest online platforms in the EU. The result — 97% used at least one dark pattern. These are not exceptions. This is the industry standard. Now — concrete mechanics. For each — what it looks like, what it is called, which right it violates.

Pattern one. Visual interference. The most widespread and most obvious. What it looks like. The «accept all» button — bright, colourful, large, positioned at eye level. The «reject» or «customise» button — grey, small, fine print, hidden in a corner or beneath the main content of the banner. Technically both options are present. Architecturally — only one of them is visible. The brain, in automatic mode, goes to the bright and noticeable. This is not a weakness — it is the normal working of attention. The design uses this. A 2019 MIT study showed that simply changing the colour of the buttons — making «reject» as bright as «accept» — reduced the percentage of consents to advertising processing from 87% to 43%. The same choice. Different visual design. A fundamentally different result. Which right it violates. The free-consent criterion — Article 7 GDPR. Consent is not free if one option visually dominates another, creating an asymmetry of pressure.

Pattern two. Confirmshaming. What it looks like. The consent button — neutral or positive text. «Accept», «Yes, I want the discount», «Improve my experience». The refusal button — text written so as to provoke shame or discomfort. Real examples found on sites. «No thanks, my safety doesn’t matter to me». «No, I prefer irrelevant advertising». «No, I don’t want to save money». «Refuse and remain unprotected». Technically you can press this button. Psychologically — the design creates a barrier. The automatic mode avoids the feeling of shame and incompetence. Most people press «accept» not because they want to — but because the wording of refusal is unpleasant. This is manipulation of an emotional state to obtain consent. A direct violation of the free-consent criterion. Consent obtained through emotional pressure is invalid.

Pattern three. Roach motel. Easy to get in — almost impossible to get out. What it looks like. A subscription is set up in two clicks. The button is visible immediately. The form is simple. Payment is instant. Cancelling requires a call to support, which works weekdays from 9 to 17. Or finding a cancel button hidden in the fifth submenu of settings. Or filling in a form with an explanation of the reason. Or listening to a counter-offer before they let you go. Applied to data — consent to processing is given in one press. Withdrawal of consent requires several steps through a non-obvious interface. Sometimes — a separate letter to the DPO’s address. This is a direct violation of Article 7(3) GDPR. Withdrawal of consent must be as simple as its provision. Not harder. Not less convenient. The same.

Pattern four. Hidden processing purposes. What it looks like. The banner says — «we use cookies to improve your experience». It sounds harmless. In reality, hidden behind this wording — behavioural profiling, transfer of data to advertising brokers, synchronisation of identifiers across platforms, targeting based on a psychographic profile. «Improving your experience» is not a processing purpose in the sense of GDPR. It is a marketing phrase that says nothing about the real operations with the data. GDPR requires the specific indication of purposes. Article 5(1)(b) — the purpose-limitation principle. Purposes must be specific, explicit and lawful. «Improving your experience» is not a specific purpose. But this wording is used everywhere precisely because it explains nothing. A person thinks they consented to something harmless. In fact — to the full spectrum of advertising processing.

Pattern five. Trick questions. Confusing wording. What it looks like. Double negatives in the consent text. Inconsistent tick logic — somewhere a tick means consent, somewhere refusal. Mixing different categories of consent in one text. A real example. «Untick the box if you do not want us not to transfer your data to third parties for advertising purposes.» Let us break down the logic. The box is ticked by default. To untick means «not to want». «Not to transfer» — a double negative. In total: if the box is ticked — you want the data to be transferred. If you untick it — you do not want it. Most people read the first few words and make a decision. The full semantic structure of the sentence is not processed. This is precisely what is counted on. This is a violation of the informed-consent criterion — Article 4(11). Consent is informed only if a person really understands what they are agreeing to. Confusing wording deprives them of this understanding.

Pattern six. Urgency and scarcity. What it looks like. A countdown timer on the consent banner. «This offer is valid for another 02:47». «To continue, you must accept the terms before time runs out». «Last chance to adjust the settings». This is a mechanic from e-commerce transferred into the context of consent to data processing. Urgency switches off the analytical mode of thinking. A person makes a decision quickly so as not to lose the opportunity. Without analysing what exactly they are accepting. This is a violation of the free-consent criterion. Consent given under the pressure of a time limit is not free. A decision on the processing of personal data should not be made under conditions of artificially created urgency.

Pattern seven. Endless layers of settings. What it looks like. The «accept all» button — first screen, one press, occupies the central place. The «customise» button leads to a second screen with categories. Each category unfolds into a third screen with a list of specific companies. Each company has a separate page with a description. By default — everything is on at all levels. Technically the possibility of refusal exists. In practice — it is hidden behind so many layers that most people give up after the first or second level. A Carnegie Mellon University study showed that each additional step needed to refuse reduces the probability that the user will refuse by about 20%. Three extra steps — and the probability of refusal falls threefold. This is again a violation of the principle of equivalence of refusal and consent. Article 7(3) in conjunction with the free-consent criterion.

Pattern eight. CMP A/B testing to maximise consents. This is a pattern not visible to the user — but which is system-forming. How it works. Companies that provide consent-management systems — CMP platforms — allow clients to conduct A/B testing of banner design. Colours, button sizes, wordings, element placement are tested. The optimisation metric — the percentage of users who pressed «accept all». This means that the design of every large cookie banner has gone through dozens of iterations of optimisation. Each element — the result of data about how real people react. The best variant — the one that maximises consents. The best from the company’s standpoint. The worst from the standpoint of a real informed choice by the user. This is a systemic problem. The CMP market competes for clients — that is, for sites. Sites choose the CMP that gives more consents. The CMP optimises for this. The user in this chain is not a client. He is an object of optimisation.

What regulators do about this. Dark patterns in cookie banners are a documented category of violations. Regulators record and fine them. The French CNIL in 2022 fined Google 150 million euros and Facebook 60 million euros precisely for dark patterns in cookie banners. Specifically — for the refusal button requiring more clicks than the consent button. And for the «reject all» button not being presented on the first screen on a par with «accept all». The Norwegian regulator Datatilsynet issued an order against Grindr for using dark patterns when obtaining consent to transfer data to advertising partners. The Irish DPC opened investigations against several large platforms precisely regarding the design of consent mechanisms. This is not theory. It is practice that is already changing the industry. Slowly. But changing.

Why this is important to understand. Knowledge of the specific patterns changes behaviour. When you see a bright «accept» button and a grey «reject» — you already know that this is visual interference. A tool of manipulation. When the refusal button is written humiliatingly — you know that this is confirmshaming. Emotional pressure. When the settings are hidden behind three screens — you know that this is a deliberate barrier. Not a technical necessity. Knowledge destroys the mechanism. Because dark patterns work only when you do not see them. When you see them — they turn into what they are. Into manipulation that can be ignored. In the next part we will examine what real informed consent should look like. What the law requires. What ethics requires. And why companies that do this right — exist and prove that it is possible.

Part three — what real consent should look like

Two posts ago we examined what consent is by law. Last time — how design deliberately fakes this consent. Today — a different angle. Not what is wrong. But how it is right. Because there is a risk of getting stuck in criticism and missing the main thing. Real informed consent is not a utopia. It is an achievable standard. It exists. It can be described concretely. And companies that apply it — exist and work.

What the law actually requires. Without interpretations. Let us start with the letter of the law. Not with how companies interpret it — but with what is written there. Article 7 GDPR. Conditions for consent. The controller must be able to demonstrate that the data subject has consented to the processing of their personal data. This means — the burden of proof is on the company. Not on you. The company must prove that consent was obtained. That it was free, specific, informed and unambiguous. If it cannot — the consent is considered absent. If consent is given in the context of a written declaration that also concerns other matters — the request for consent must be presented in such a way that it can be distinguished from the other matters, in an intelligible and easily accessible form, using clear and plain language. This means — consent to data processing cannot be hidden in the general terms of use. It must be separate. Noticeable. In understandable language. The data subject must have the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Before giving consent, the data subject must be informed of this. Withdrawal of consent must be as simple as its provision. Three requirements in one point. The right of withdrawal — absolute. Informing about this right — mandatory. Simplicity of withdrawal — equal to the simplicity of consent. Article 13. When collecting data, the company is obliged to communicate — the purposes of processing, the legal bases, the recipients of the data, the storage periods, the right to withdraw consent. Before the start of processing. Not after. Before. These are the minimum requirements of the law. Not an ideal standard. A minimum.

What a real consent banner looks like. Concretely. A real consent banner — one that meets all the requirements of GDPR — looks different from most of what we see. The first screen contains three equivalent options. Not two where one is hidden. Three — and all equally visible, equally accessible, equally simple to use. The first option — «Accept only necessary». Technical cookies needed for the site to work. Without advertising. Without analytics. Without profiling. The site works fully. The second option — «Customise». The person chooses what exactly they permit. Each category separately. By default — everything switched off. The person switches on what they consider acceptable. The third option — «Accept all». For those who consciously want to consent to everything. All three buttons of the same size. The same colour. Equally noticeable. Equally accessible. In the banner — on the first screen, not via a link — it is written concretely. Not «improving your experience». But «data about your behaviour on the site will be transferred to advertising partners for showing personalised advertising. The list of partners — here». And the list — real, with names, updated. The time to make a decision — unlimited. No timers. No urgency. This is not fiction. It is what the law requires. And what some companies really do.

Examples that exist. This is important to say explicitly — because it is easy to create the impression that everything is hopeless. There are companies that do consent right. Not because they are altruists — but because it is their business model or because the regulator forced them. Wikipedia. A non-profit organisation. Does not show advertising. Does not build profiles. The cookie banner is minimalist and honest. The site works fully without any consent to data processing beyond what is technically necessary. DuckDuckGo. A search engine that earns on contextual advertising — not behavioural. Does not track users. Does not build profiles. Consent is not requested because only technically necessary data is processed. A number of European government services — in Estonia in particular — implement consent through clear separate toggles with understandable descriptions of each category. The state cannot afford to violate GDPR as openly as commercial companies. Some media publications, after fines from regulators — especially French and German ones — have fully rebuilt their consent mechanisms. Le Monde, Der Spiegel — their banners today are significantly closer to GDPR requirements than a few years ago. This works. These companies did not go bankrupt. The traffic did not fall to zero. The business continues.

Real informed consent. Five principles. If you gather everything the law requires and add what ethics requires — you get five principles of real informed consent. Principle one. Equivalence of options. Refusal must be as simple and noticeable as consent. One click to refuse — one click to consent. The same button size. The same colour. The same placement on the screen. Principle two. Specificity before the action. A person must understand exactly what they are consenting to before they press the button. Not after. Not via a link to a document that opens in a new tab. Right in the banner. Briefly and clearly. Who will receive the data. For what. How long. Principle three. Separateness of categories. Each substantially different purpose — a separate option. Analytics of site usage — separately. Personalised advertising — separately. Transfer of data to third parties — separately. The person chooses what they permit — rather than accepting everything as a package or accepting nothing. Principle four. Simplicity of withdrawal. If consent can be given in three clicks — withdrawing it must also be possible in three clicks. From any point on the site. Without calls to support. Without explaining reasons. Without delay. Principle five. No consequences for refusal. If a person refuses optional processing — the site works. Perhaps with less functionality — but it works. Refusal of advertising cookies should not mean the site is unavailable. These things are not connected in essence. The company connects them artificially to create pressure.

Why this is implemented almost nowhere. An honest answer. We examined what the law requires. What is technically possible. What some companies already do. Why then does the overwhelming majority of sites still use dark patterns? The answer is honest and uncomfortable. Because it works. Because dark patterns give 80–95% consents. Real informed consent gives 20–40%. The difference is in data. The difference is in money. The difference is in advertising revenue. And because the risk of being caught — is still lower than the benefit of the violation. Regulators fine. But they cannot check every one of the millions of sites operating in the EU. There is no systemic compulsion to comply. This is changing. Slowly. Fines are becoming larger. Precedents are being set. Technical standards are tightening. The AI Act adds new requirements for automated systems. But for now — the violation remains more profitable than compliance for most commercial companies.

What you can do right now. Three concrete actions that require no technical knowledge. First. When you see a cookie banner — look for the «only necessary» or «reject all» button. If it is not on the first screen — that is a signal. Go into the settings and switch everything off manually. It takes two minutes. But your data — your decision. Second. Install the Consent-O-Matic extension in your browser. It automatically refuses optional cookies on most sites. Free. Developed by Danish researchers. Open source — you can verify what it does. Third. If a site does not allow you to normally use the service without accepting advertising cookies — this is a possible GDPR violation. Record it. If this is a regular practice of a large site — it is grounds for a complaint to AKI.

Finally. About the standard that changes the conversation. Knowing what real consent should look like — changes how you perceive what you see. Before, a cookie banner was just an annoying pop-up window. Now — you see concrete violations. Confirmshaming. Visual interference. Disproportionate difficulty of refusal. This is not paranoia. It is literacy. The same as the ability to read the ingredients of a product on the packaging. Or to understand the terms of a loan agreement. The digital world requires digital literacy. Consent is one of its basic elements. You now know what real consent is. What its fake is. And how to tell one from the other. This material is enough to make conscious decisions where before everything happened automatically.