The new European General Data Protection Regulation (GDPR) came into force on 25 May 2018. The fear of heavy fines and warnings has resulted in a renewed focus on cookie banners. Before the new data protection regulation came into force, there was speculation about the effects of cookie banners on the behavior of website visitors.
Because data-based decisions are better than vague predictions, we analyzed the use of cookie banners 30 days after GDPR came into force.
We have used aggregated, anonymized user data from various websites for a period of 30 days after GDPR came into force. The data comes from international B2B websites in the service, industry and trade sectors and shows the usage behavior of over 100,000 website visitors.
The following cookie banner was used:
The cookie banner provides the following user interactions:
1. Accept all cookies
2. Cookie settings to accept individual cookie categories
3. Close banner
A click on the cookie settings button opens the Privacy Preference Center, where individual cookie categories can be turned off or on. The text is displayed in the respective browser language.
The consent model follows the requirements of GDPR and functions as follows:
- Standard implicit consent for necessary cookies, performance cookies and functional cookies when using the website.
- Standard deactivation and explicit consent required for targeting cookies.
- The cookie banner is displayed on all pages.
- The cookie banner will not be displayed after closing or accepting all cookies, even on your next visit.
- The cookie settings can be accessed on the website at any time and the cookie settings can be adjusted.
11% of all Visitors Accept Cookies
Looking at the user interactions of all website visitors, the following picture emerges:
- 76% of all visitors ignore the cookie banner
- 12% close the cookie banner
- 11% click on "Accept all cookies".
- 0.5% open the cookie settings
Surprisingly, a high percentage of visitors (76%) ignore the cookie banner or do not interact with it at all (not even to close it). This is despite the fact that it can be seen on every page and can be disruptive. With 11% of visitors accepting all cookies, the forecasts of 3 to 20% look to be valid. This means that these 11% of visitors may continue to be used for remarketing, as the targeting cookies have been accepted.
The good news is that more than 99% of all visitors are still accepting to have data collected for audience measurement, as only 0.5% open the cookie settings in order to deactivate any of the performance cookies.
It turns out that only 0.33% of visitors disable one or more cookie categories.
When visitors disable cookies, these are primarily functional cookies (53.8%). Only 12.4% switch off the targeting cookies. This is a surprising result, as it was expected that the targeting cookies in particular would not be accepted.
Different User Behaviour in Different Countries
What is striking is the different user behaviour in the individual countries, this allows conclusions to be drawn about national data protection awareness.
Switzerland and most European countries show a significantly higher interaction with the cookie banner (engagement rate). This could mean that visitors from Europe have a higher data protection awareness, or simply that a general tendency to "click away" and "close" has resulted from the cookie banners used since 2002. Here it can be assumed that Swiss website visitors have also become accustomed to the cookie banners from the European region.
If you compare the ratio between accepting cookies and closing the banner, you get the following result per country:
It turns out that most European countries also have a stronger likelihood of accepting cookies (blue area).
To compare the engagement rate with accepting and closing the banner, we have superimposed the two graphics.
It is striking that visitors from France have a significantly lower engagement rate with the cookie banner and also accept cookies considerably less often.
This may be due to the fact that stricter cookie guidelines have been in force in France since December 2013 and active approval must be obtained.
Most other European countries (including Switzerland), on the other hand, show not only a high engagement rate but also a higher willingness to accept cookies. These values suggest that visitors in Europe either have greater confidence in website operators or have already developed a "click-away routine" due to the cookie banners being in use since 2002.
The major differences between the individual countries are striking. Sweden (23.3%), the Netherlands (23.4%) and Switzerland (22.0%) have the highest acceptance rates for cookies. In contrast, China (1.4%), Japan (3.0%) and South Korea (4.3%) have the lowest willingness to accept cookies.
North America and Asian countries have a comparatively low engagement rate and a low willingness to accept cookies.
This result is surprising in that GDPR was primarily developed for Europe and has been omnipresent in the media in recent months. One would have expected that as a result, visitors from European countries would have been more reluctant to accept cookies.
In summary, the willingness to accept cookies is in the predicted range of 3-20% at 11%. Only a small percentage of visitors (0.5%) need to adjust the cookie settings, with the majority of visitors (88%) ignoring or closing the banner. If cookies are switched off, these are mainly functional cookies (53.8%).
The country comparison shows large differences in cookie acceptance rates from 1.4% (China) to 23.4% (Netherlands), with a higher interaction rate and a higher willingness to accept cookies in most European countries.
The reasons for this higher acceptance in Europe are unclear, but could be related to the "cookie banner culture", which has come as a result of mandatory cookie banners in Europe since 2002.
What does your website look like? Have you activated a cookie banner and do your website visitors behave similarly? Send me an email, I am looking forward to your experiences.
1 “Research result: what percentage will consent to tracking for advertising?”, PageFair Insider, 12 September 2017
2“Europe Online: an experience driven by advertising”, GFK, 2017, p. 7,