Somewhere near the top of every European crawl there is a box asking permission. What your crawler does with it — click Accept, click Reject, dismiss it, or drive straight past — is not a configuration detail. It is the treatment in your experiment, and it decides which web you measured. A crawl that never touched the banner measures the pre-consent web; a crawl that accepted everything measures the maximally-tracked web; the gap between them is where most of the interesting results are.

This page is about that decision and everything downstream of it: how to make the browser express a consent choice, how to check the site actually recorded it, how to read what it recorded, and what the alternative channel — an automated signal such as GPC instead of a click — can and cannot do. Finding the notice and labelling its buttons is a DOM-classification problem and lives on Classifying Web Requests; the crawler-side mechanics of clicking anything at all are on Interaction. What the resulting cookies mean is on Classifying Cookies.

• Do Cookie Banners Respect my Choice? [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], IEEE S&P 2020 — the paper that turned “is this banner legal?” into something a crawler can decide, by reading what the CMP stored rather than what the banner said. Read it for the four-violation taxonomy, which almost every later compliance paper reuses.
• Automated Large-Scale Analysis of Cookie Notice Compliance [2Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1723-1739. USENIX Association, Philadelphia, PA. (Link)], USENIX Security 2024 — the current reference pipeline: find the notice, classify its buttons with a small language model, drive it, and check the cookies against the site's own declarations. Read it for the numbers you will be asked to beat.
• (Un)informed Consent [3Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], CCS 2019 and Dark Patterns after the GDPR [4Nouwens, Midas; Liccardi, Ilaria; Veale, Michael; Karger, David; Kagal, Lalana (2020): "Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence", in: Proceedings of the CHI Conference on Human Factors in Computing Systems. (DOI)], CHI 2020 — the two studies that established that banner design moves consent rates, so a banner is a manipulation and not a question. Nouwens et al. is outside this corpus's seven venues; it is still the one everybody cites.
• A Large-Scale Study of Cookie Banner Interaction Tools [5Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)], PETS 2024 — read before you decide to use an off-the-shelf extension, because it measures how often they actually work.
• Intractable Cookie Crumbs [6Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)], PETS 2025 — read for the single most under-appreciated mechanic: rejection often does nothing until the page is reloaded.
• If your study is US-facing rather than EU-facing, start instead at Usability and Enforceability of Global Privacy Control [7Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)], PETS 2023 and Websites' Global Privacy Control Compliance at Scale and over Time [8Hausladen, Katherine; Wang, Oliver; Eng, Sophie; Wang, Jocelyn; Wijaya, Francisca; May, Matthew; Zimmeck, Sebastian (2025): "Websites' Global Privacy Control Compliance at Scale and over Time", in: Proceedings of the USENIX Security Symposium. (Link)], USENIX Security 2025.

There are six things a crawl can do, and the corpus records which one each paper chose. They are not interchangeable and they are not on a scale — each answers a different question.

The Verified column is the count that survived reading all 36 candidate papers' own full text: all three dismiss-or-remove values and four of fifteen accept-all values are extraction false positives, while every accept-and-reject, reject-all and cmp-specific-choices value held. Details and the paper-by-paper verdicts are on the provenance page. The practical reading: the enum is trustworthy exactly where the paper had to describe two arms, and unreliable where a single word in a methods paragraph could be misread.

This is the step that most often goes wrong, and it goes wrong silently: the click misses, the crawl carries on, and pre-consent behaviour is reported as post-consent behaviour. A click is not a measurement. The stored consent is. Check all four of these:

1. Did the element exist and did the click land? Log the element you clicked — its text, its selector, its bounding box — not just “clicked”. An element that scrolls out of the viewport, sits under an overlay, or lives in a shadow DOM or a cross-origin <iframe> will accept a synthetic click and do nothing.
2. Did the banner go away? Re-run your detector after the click. The banner disappearing is weak evidence but a banner that is still there is strong evidence of failure.
3. Did the site store a decision? This is the real check. Read the CMP's own record — the TC string for a TCF banner (below), or the vendor's consent cookie (OptanonConsent for OneTrust, CookieConsent for Cookiebot, euconsent-v2 for TCF, cookieyes-consent, and so on) — and assert that its contents match the choice you made. Matte et al. [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] built their whole method on this: they compare what the banner offered against what the CMP stored, which is why they can detect a positive consent stored before the user chose at all (141 of 1,426 TCF sites, 9.9%) and one stored after an explicit refusal (27 of 508, 5.3%).
4. Did you reload? Rasaii et al. [6Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)] found that rejecting a banner produces no immediate change in the cookies being sent, and that on average 25% of “intractable” cookies stop being sent only after the page is reloaded with the rejection in place. A crawl that rejects and then immediately measures will conclude that rejection does nothing. Reload, in a stateful session, and measure again.

Most consent banners on European sites are operated by a Consent Management Platform (CMP), and a large share of those implement IAB Europe's Transparency and Consent Framework (TCF), which standardises both the API and the storage format. That standardisation is what makes consent machine-readable at scale, and it is why so many measurement papers are TCF papers.

TCF sites are a minority, and you must report the denominator as such. Matte et al. [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found a TCF banner on 1,426 of 22,949 reachable European sites (6.2%) in 2019; Hils et al. [9Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)] tracked adoption longitudinally and detected TCF implementations on the order of thousands of sites in the top 100k. In Android apps the share is comparable: Morel et al. [10Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)] found TCF in 576 of 4,482 apps (12.85%). “Consent on the web” and “TCF consent” are not the same population.

The detection primitive is the API function itself. TCF v1.x exposes __cmp(); TCF v2.x exposes __tcfapi(). Probing for the function is precise but narrow — it finds TCF banners and nothing else.

tcf_probe.js

// Run in the page context. Resolves to null when the site has no TCF CMP,
// otherwise to the decoded-by-the-CMP consent state plus the raw TC string.
// Deliberately has no try/catch: a page that defines __tcfapi and then throws
// is a finding, not something to swallow.
function readTcf(timeoutMs = 3000) {
  return new Promise((resolve) => {
    if (typeof window.__tcfapi !== 'function') return resolve(null);
    const timer = setTimeout(() => resolve({ error: 'no callback within timeout' }), timeoutMs);
    window.__tcfapi('getTCData', 2, (tcData, success) => {
      clearTimeout(timer);
      resolve({
        success,
        cmpId: tcData.cmpId,             // join to the IAB CMP list
        cmpVersion: tcData.cmpVersion,
        tcfPolicyVersion: tcData.tcfPolicyVersion,
        eventStatus: tcData.eventStatus, // 'cmpuishown' | 'useractioncomplete' | 'tcloaded'
        gdprApplies: tcData.gdprApplies, // false here means the CMP decided you are not in scope
        purposeConsents: tcData.purpose.consents,
        purposeLegitimateInterests: tcData.purpose.legitimateInterests,
        vendorConsents: tcData.vendor.consents,
        tcString: tcData.tcString,       // the base64 blob also stored in euconsent-v2
      });
    });
  });
}

Run against four European news sites on 2026-08-19 from a non-EU vantage, before touching the banner, it returns this — the shape you should expect from a site whose banner is up and unanswered:

www.spiegel.de   => {"success":true,"cmpId":6,"cmpVersion":1,"tcfPolicyVersion":5,
                     "eventStatus":"cmpuishown","gdprApplies":true,
                     "purposeConsents":{},
                     "purposeLegitimateInterests":{"1":false,"2":false,"3":false,"4":false,
                       "5":false,"6":false,"7":true,"8":false,"9":true,"10":true},
                     "vendorConsentCount":0,
                     "tcStringPrefix":"CQpMXQAQpMXQAAGABCENCsFgAAAAAALAAAQ4AAAM"}
www.heise.de     => {"success":true,"cmpId":6,...,"eventStatus":"cmpuishown","gdprApplies":true,
                     "purposeConsents":{},"purposeLegitimateInterests":{},"vendorConsentCount":0}
www.repubblica.it=> {"success":true,"cmpId":123,"cmpVersion":387,...,"tcStringPrefix":""}
www.lemonde.fr   => {"error":"no callback within timeout"}

Four things that output already teaches you. gdprApplies was true from a non-EU IP on all three that answered — the CMP's own scope decision does not always track your vantage point, so measure it rather than assuming it. purposeConsents is empty and vendorConsentCount is 0 while the banner is still up: that is the correct pre-consent state and it is what your no-interaction arm should look like. Spiegel already asserts legitimate interest for purposes 7, 9 and 10 before any click — legitimate interest is not consent and is not recorded in purposeConsents, so a study that only reads purposeConsents will under-count what the site is already doing. And lemonde.fr defines __tcfapi but never invokes the callback within four seconds, which is why the timeout branch exists: without it your crawler hangs, and without recording the timeout you would score the site as having no TCF.

Three things to record every time, because reviewers ask and papers routinely omit them:

• cmpId and cmpVersion. cmpId joins to IAB Europe's registered-CMP list, which is how you attribute a behaviour to a vendor rather than to a publisher. Toth et al. [11Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)] showed why that attribution matters: six of the ten CMP consent pop-ups they studied made Accept and Reject visually unequal by default, so the dark pattern was shipped by the CMP, not chosen by the site.
• gdprApplies. The CMP decides this, usually from your IP. gdprApplies: false means you are measuring the non-EU variant of the site — see below.
• eventStatus. useractioncomplete is the only value that means a choice was recorded. cmpuishown with a consent already present is exactly Matte et al.'s consent stored before choice violation.

Do not decode the TC string yourself. It is a versioned bit-packed base64 format; use a maintained decoder and pin its version. Two papers in this corpus report writing their own decoding script, and both had to pin a Global Vendor List version to interpret the vendor bitfield — the GVL changes weekly, so a decoded vendor set is only meaningful together with the GVL version you decoded it against. The list is served from vendor-list.consensu.org/v3/vendor-list.json with numbered archives under /v3/archives/, which is what makes a retrospective decode reproducible at all: fetch and archive the GVL alongside your crawl, do not resolve vendor IDs months later.

The other reason to read the stored string: it lets you check compliance without trusting the interface. Smith et al. [12Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)] decoded TC strings across repeated crawls and found recorded-consent violations in 2.2% of domains and 1.3% of crawls — a much lower rate than the “72% of sites violate something” headlines elsewhere on this page, precisely because it is a narrow, mechanically checkable question (“does the stored string match the choice made?”) rather than a broad legal one. When you report a violation rate, say which of those two kinds of question you asked.

The alternative to clicking every banner is for the browser to say no once, in a way every site is obliged to read. Three attempts exist; only one is live.

DNT sent a DNT: 1 request header and exposed navigator.doNotTrack. It failed because nothing obliged anyone to honour it: Libert [13Libert, Timothy (2018): "An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies", in: Proceedings of the ACM Web Conference. (DOI)] found that only 7% of privacy policies even contained the string “do not track”, and of the ones that did, 64.80% explicitly said they did not honour it against 19.46% that committed to honouring it. Among 25 third-party data collectors, nine mentioned DNT and none offered unqualified support.

It is formally dead. The W3C Tracking Protection Working Group concluded its work and republished both specifications as W3C Working Group Notes on 17 January 2019, saying in the status section that “there has not been sufficient deployment of these extensions (as defined) to justify further advancement”.⁶⁾ Browsers have since diverged rather than converged: Safari dropped DNT alongside ITP 2.1 in 2019, and Firefox removed the checkbox in version 135 (4 February 2025), whose release notes point users at “Tell websites not to sell or share my data” — which is GPC.⁷⁾ Chrome still exposes a DNT toggle. If your crawl runs a default Chrome profile you may be sending DNT without meaning to; if it runs a current Firefox, the setting you find in the UI is GPC, not DNT. Check what your browser actually sends rather than what you assume.

Do not build a measurement on DNT today, and do not report “sites ignore DNT” as a finding — it has been the known state for a decade. It is worth knowing for one reason: it is the control condition that explains why GPC was designed the way it was, with a legal hook first and a technical mechanism second.

GPC is the live signal, and it has moved up: it is a W3C Working Draft on the Recommendation track, dated 11 June 2026, published by the W3C Privacy Working Group.⁸⁾ If a paper or a page describes GPC as a Community Group report, that is stale.

It is deliberately narrow — it expresses a do-not-sell-or-share request, not a general “do not track” — and the specification defines three carriers, which you should check separately, because sites implement them inconsistently:

• the Sec-GPC: 1 request header (the spec fixes the value at exactly 1; a server must ignore any other value),
• the navigator.globalPrivacyControl DOM property, available on both Navigator and WorkerNavigator,
• an optional /.well-known/gpc.json resource, by which an origin declares awareness of and support for GPC. Read the spec's own caveat before you use it as a compliance measure: it “is not intended to convey whether the origin abides by GPC requests from the user agent accessing the resource”.

There is a standard way to turn it on in an automated browser, and you should use it. §8 of the specification defines two WebDriver extension commands — POST /session/{session id}/privacy to set the preference and GET /session/{session id}/privacy to read it back. Driving the preference through WebDriver rather than through a profile pref or an extension means your setup is reproducible and the “did the browser actually send it?” question has an answer.

Sec-GPC on the navigation request = "1"
navigator.globalPrivacyControl     = undefined

On the legal side the specification is explicit that its force is jurisdictional: “At least four states have specifically identified GPC as a valid means to exercise legal opt-out rights.” That is the spec's own conservative wording; the practical number of US states whose comprehensive privacy laws require honouring a universal opt-out mechanism is now roughly a dozen, and it grows every legislative session — check the current list for your crawl's date rather than reusing one from a paper. Colorado is the sharpest case — the state Attorney General's office states that GPC has been mandatory there since 1 July 2024 and is currently the only universal opt-out mechanism the Department recognises.¹⁰⁾ If your paper claims a site is legally obliged to honour GPC, name the state and cite the regulator, not a vendor blog.

The published compliance numbers are low and are the ones to cite. Zimmeck et al. [7Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)] found that of the sites implementing a US Privacy String, only 54 of 464 (12%) actually opted the user out when GPC was sent. Hausladen et al. [8Hausladen, Katherine; Wang, Oliver; Eng, Sophie; Wang, Jocelyn; Wijaya, Francisca; May, Matthew; Zimmeck, Sebastian (2025): "Websites' Global Privacy Control Compliance at Scale and over Time", in: Proceedings of the USENIX Security Symposium. (Link)] re-ran it at scale over time and found 44% (1,411/3,226) in December 2023, 43% (1,473/3,402) in February 2024 and 45% (1,620/3,566) in April 2024 — a different, narrower denominator (sites with all implemented privacy strings set to opt-out), which is exactly the kind of denominator difference that makes two GPC papers look contradictory when they are not. Charatan and Birrell [14Charatan, Jan; Birrell, Eleanor (2024): "Two Steps Forward and One Step Back: The Right to Opt-out of Sale under CPRA", in: Proceedings on Privacy Enhancing Technologies. (DOI)] found 2,429 of the top 25,000 sites (9.9%) offering a manual opt-out-of-sale link in November 2022, 814 honouring GPC by November 2023, and 340 for which GPC was the only opt-out mechanism offered.

GPC also interacts with banners rather than replacing them. Rasaii et al. [6Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)] measured both together: enabling GPC reduced “intractable” cookies by about 30%, and rejecting the banner on top of that removed a further 32%.

Alongside GPC, US opt-outs are carried in a string. The original US Privacy String was built for the CCPA specifically, has not been updated since 2020, and IAB Tech Lab deprecated it on 31 January 2024 in favour of the Global Privacy Platform (GPP), which can represent the Virginia, Colorado, Connecticut and Utah signals that USP cannot.¹¹⁾ A 2026 crawl that only reads usprivacy is reading a deprecated field; read the GPP string too, and report which you read. Every published USP measurement below therefore describes a mechanism that has since been retired — which does not make the findings wrong, but does date them.

Aziz and Wilson [15Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)] tested whether the plumbing works: with GPC enabled, 380 of 825 publishers (46.1%) implementing the USP API set the string to opt-out — and the number of tracking pixels showed no statistically significant reduction either way. The signal propagating is not the same thing as the tracking stopping, and a paper that measures only the string has measured the plumbing.

The US route to refusal is often not a banner at all but a link — Do Not Sell or Share My Personal Information — or a paragraph buried in a privacy policy. That makes finding it a text problem rather than a DOM problem, and it has its own small literature. Kumar et al. [16Kumar, Vinayshekhar Bannihatti; Iyengar, Roger; Nisal, Namita; Feng, Yuanyuan; Habib, Hana; Story, Peter; Cherivirala, Sushain; Hagan, Margaret; Cranor, Lorrie Faith; Wilson, Shomir; Schaub, Florian; Sadeh, Norman M. (2020): "Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text", in: Proceedings of the ACM Web Conference. (DOI)] built the reference extractor for opt-out statements in policy text, reaching precision 0.93, recall 0.90, F1 0.91, and found that opt-outs are heavily concentrated at the top of the ranking: an average of 3.43 per site for US Alexa ranks 1–200 against 1.22 above rank 1,000. If your sample is a long tail, expect to find almost nothing, and do not read that as compliance.

Then there is the question of whether the link does anything. Bui et al. [17Bui, Duc; Tang, Brian; Shin, Kang G. (2022): "Do Opt-Outs Really Opt Me Out?", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] followed opt-out cookies and the policies that describe them and found 11 trackers whose behaviour after opt-out contradicted their own stated policy. Liu et al. [18Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)] went further downstream and watched the ad auction: personas that had opted out under both GDPR and CCPA still attracted higher bids than the control. An opt-out that is offered, findable and technically registered can still be an opt-out that does nothing, and each of those is a separate measurement.

All the checks in this table were run on 2026-08-19 against the project's own repository or store listing. Re-run them: a tool table is the fastest-rotting part of any page.¹²⁾

Which ones the field actually uses. Counting papers in this corpus that name a tool as used or produced — 18 distinct names over 40 papers, folded with consent_fold.mjs: Consent-O-Matic 9, BannerClick 4, CookieBlock 4, a custom GPC extension or crawler 4, autoconsent 3, EasyList Cookie List 2, Priv-Accept 2, a TC-string decoder 2, and one paper each for ConsentChk, CookieCheck, CookieEnforcer, CookieGuard, GDPR-Consent, “I don't care about cookies”, Ninja Cookie, Opt-Out Easy, OptOutCheck and Super Agent. The long tail is the finding: almost every consent paper builds its own instrument, which is the main reason consent results are hard to compare across papers.

The banner you see is chosen by the site from your IP address. Crawl a European site from a US datacentre and you will often get no banner at all, or a different one — and the TCF's own gdprApplies flag will be false. This makes the vantage point a co-determinant of every consent result, not an independent choice.

The corpus says the field mostly does not handle this. Of the 349 crawling papers that state a consent action, 68 (19.5%) state an EU/EEA vantage point, 72 (20.6%) state a non-EEA vantage only, and 206 (59.0%) carry a vantage tuple with the location not stated. The picture is much better among the papers that actually clicked: of the 29 whose interaction is verified, 21 (72.4%) did so from an EU/EEA vantage, 3 from a stated non-EEA vantage only, and 5 never said where they were.

Ogut et al. [23Ogut, Aysun; Turanlioglu, Berke; Metiner, Doruk Can; Levi, Albert; Yilmaz, Cemal; Cetin, Orcun; Uluagac, Selcuk (2024): "Dissecting Privacy Perspectives of Websites Around the World: "Aceptar Todo, Alle Akzeptieren, Accept All..."", in: Proceedings of the USENIX Security Symposium. (Link)] is the paper to read on the language side of the same problem: button text is the classifier's input, and Accept all is Aceptar todo and Alle akzeptieren elsewhere. They found a consent notice on 37% (1511) of successfully loaded sites worldwide. Tang et al. [22Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)] did the regional comparison for violations, finding at least one consent violation on 96.18% (EU) to 97.72% (US) of sites, with only 3.82% enforcing preferences correctly.

Everything in this section comes from a structured extraction over 5,859 full-text papers from CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, one record per paper with a verbatim evidence quote per claim. The 2025 and 2026 venue-years are provisional — CCS and IMC 2026 have not been held, and IEEE S&P and WWW 2026 are incompletely selected — so any per-year row reaching them is under-represented by construction. Methodology and limits are at the end of this section.

Population: the 1,120 papers that ran an automated web crawl.

And the six stated rows do not all survive contact with the papers. Every one of the 36 papers in the five interacting rows was read against its own full text; 7 (19.4%) are extraction false positives — the value fired on push-notification permission prompts, on “banner ads”, and three times on IRB participant consent. The audited count of papers that verifiably interacted with a consent notice is 29, or 2.6% of crawling papers. The script is consent_action_audit.mjs and every verdict is on the provenance page. no-interaction was not audited — 313 papers is beyond a hand pass — so treat it as an upper bound in the same way.

The three italic rows are sentinels, not answers. not-applicable is a legitimate value — a crawl of an API, a mobile app store or a set of non-European sites may have no banner to handle — but not-stated at 44.2% is the finding: nearly half of all crawling papers leave the reader unable to tell which web they measured.

* provisional venue-years. Two separate trends. Whether a paper says anything moved from 24.5% in 2010–2013 to a peak of 33.6% in 2022–2024 and back to 29.8% in the provisional 2025–2026 bucket — about five points net over sixteen years, and no better in the latest bucket than it was before the GDPR. This is not a solved reporting problem, and it is not obviously improving. Whether a paper interacts starts at exactly zero before the GDPR and rises steadily afterwards: the treatment arrived with the law, as you would expect, and is now in roughly one crawling paper in sixteen. Note that the false positives cluster in the early buckets — the extraction is most likely to mistake something else for a consent action in a paper that has nothing to do with consent, which is exactly the pre-2022 population.

No field in the extraction means “is about consent”, so the population below (S2) is a hand-audited proxy: a vocabulary sweep over tool names, classification resources, detection phenomena and assessed-law strings, plus the classification.target = consent-notice enum, minus 28 hand-checked false positives. The sweep, the exclusions and their reasons are listed in full on the provenance page. S2 = 72 papers.

PETS is where this work lives, by more than a factor of five over the next venue as a share of its own programme. If you are surveying consent measurement and you skip PETS, you have skipped the field. (Note also that this corpus does not contain CHI, SOUPS, EuroS&P, ACSAC or WPES, all of which publish consent work — see the limitations below.)

Per year: 1 (2018), 4 (2019), 3 (2020), 5 (2021), 9 (2022), 9 (2023), 20 (2024), 15 (2025*), 6 (2026*). The pre-2018 count is essentially zero, which is what you would expect of a literature created by a statute.

In 60 of the 72 (83.3%) the consent mechanism is the object of study; in the other 12 (16.7%) it appears only as an instrument — a paper measuring something else that had to get past the banner. 57 (79.2%) measure the web and 15 (20.8%) measure mobile apps; consent-dialog measurement in apps is a real and growing subfield [24Nguyen, Trung Tin; Backes, Michael; Stock, Ben (2022): "Freely Given Consent?: Studying Consent Notice of Third-Party Tracking and Its Violations of GDPR in Android Apps", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI), 25Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link), 10Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI), 26Zimmeck, Sebastian; Aggarwal, Nishant; Liu, Zachary; Altman, Sage; Kollnig, Konrad (2026): "Exercising the CCPA Opt-out Right on Android: Legally Mandated but Practically Challenging", in: Proceedings on Privacy Enhancing Technologies. (DOI)], and its methods do not transfer from the web unchanged.

Of the S2 papers carrying a classification tuple whose target is a consent notice (24 papers):

Shares do not sum to 100% because a paper usually stacks several. The shape is the point: this is still a hand-built-heuristic field. Supervised ML enters only with CookieEnforcer [21Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)] and Bouhoula et al. [2Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1723-1739. USENIX Association, Philadelphia, PA. (Link)], both using BERT-class models on button text, and exactly one paper in the corpus classifies a consent artefact with an LLM — WhisperTest (CCS 2025), which uses Qwen2.5-7B for iOS UI automation rather than for consent semantics.

Validation is better here than on most pages: 19 of 24 (79.2%) report manual validation and 19 of 24 name a ground-truth source; 4 report no validation at all. Since manual validation of a notice detector is cheap — a few hundred screenshots — there is no excuse for being in the last group.

Of the 53 S2 papers that assess a law (folded with law_fold.mjs; a paper can assess several):

Three further families carry one paper each and are omitted above: non-EU/US data protection law, a national-rules catch-all, and one string the fold could not place. The unfolded residue is on the provenance page.

The GDPR is not the cookie law. Consent for storing or reading information on a device comes from Article 5(3) of the ePrivacy Directive; the GDPR supplies the definition of valid consent that Article 5(3) points at. Only 20 of 53 papers name ePrivacy at all, and a compliance claim that cites the GDPR alone for a cookie finding is citing the wrong instrument. That also changes who enforces it — see Legal enforcement.

If you are turning observations into violation claims, three EDPB documents are the cheapest way to align your rules with what regulators actually said, and all three are worth reading before you write your own taxonomy:¹⁴⁾

• Report of the work undertaken by the Cookie Banner Taskforce (18 January 2023) — the closest thing to an agreed list of what a non-compliant banner looks like across the EU.
• Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive, final version 16 October 2024 — the one that decides what your measurement is even allowed to be about. It reads Article 5(3) as covering far more than cookies: tracking pixels, URL and link decoration, local processing followed by transmission, and IP-only tracking. If your study measures “cookie consent” and your denominator is cookies, this document says you have scoped the legal question too narrowly.
• Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms (17 April 2024) — the reference for cookiewall studies of the kind Rasaii et al. [19Rasaii, Ali; Gosain, Devashish; Gasser, Oliver (2023): "Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] pioneered.

These are each paper's own numbers, checked against the paper's own full text (see limitations). Note how different the denominators are — this is the main reason “how many sites have banners” has no single answer.

• How they were produced. One structured record per paper, extracted from full text, each tuple carrying a verbatim evidence quote and its section. The script that produces every number in this section, with its denominators, is report_consent.mjs; the folding rules are consent_fold.mjs (tools and CMPs), law_fold.mjs (laws) and geo.mjs (vantage locations). Every query, the scripts' unedited output and the full residue of each fold are on the provenance page for this one; corpus-level caveats are on corpus.
• The S2 population is a judgement, not an enum. It is a vocabulary sweep plus one enum, minus a hand-audited exclusion list of 28 papers. The classification.target = consent-notice enum alone fires on 39 papers, of which the audit keeps 24 — it misfires on cryptomining opt-ins, misinformation labels and login forms. Both lists are on the provenance page so you can disagree with them.
• A paper counts once, never once per tuple, and shares do not sum to 100% because the fields are multi-valued.
• Sentinels are counted as what they are. not-stated and not-applicable are never folded into a stated value; where they are the largest row, that is the finding.
• Free-text names were folded before counting, and the residue is printed. The consent-tool fold leaves 5 distinct unmapped names over 5 papers, all of them IAB artefacts that are not banner-interaction tools (IAB ads.txt crawler, IAB anti-ad-block script, the IAB content taxonomy). The law fold leaves 2 (Digital Economy Act 2017, Act against Unfair Competition (UWG)). The vantage fold leaves 5 strings that name no place (different continents, various geographic regions).
• Every per-paper figure on this page was checked against the paper's own text, not against the extraction's summary of it. The check covers 61 literals — a superset of what is published, since ten were checked and then cut — and found 60 in both the column-repaired and the plain rendering, 1 in the column-repaired rendering only, and 0 not found. That pass caught two errors in an earlier draft of this page — a figure attributed to Bouhoula et al. that the paper writes without a thousands separator, and a Matte et al. percentage this page had rounded to the wrong decimal.
• consentAction was audited paper by paper, and it needed to be. The schema's stability comparison puts it in the reliable band — an independent extraction run over the same text agrees with it on 93% of papers — but that measures whether two runs agree, not whether either is right, and it was measured on the earlier 4,322-paper corpus. Reading all 36 interacting papers found 7 false positives (19.4%), concentrated in accept-all and dismiss-or-remove. Note also that the field's own evidence quote cannot catch this: crawlConfig carries one quote for the whole configuration object, so the quote behind a consentAction value usually evidences statefulness or crawl depth instead. Spot-checking quotes, which is the standard check on this site, is structurally blind here.
• Venue coverage. Seven venues only. CHI, SOUPS, EuroS&P, ACSAC, RAID, AsiaCCS and WPES are absent, and that bites harder on this page than on most: the usable-privacy half of the consent literature (Nouwens et al., Habib et al., Utz et al.'s follow-ups) is largely CHI and SOUPS work. Every count here is a lower bound.

1. Your consent action, in the enum above, in one sentence in the methods section, for every arm of the crawl. “We did not interact with consent notices” is a complete and respectable answer; silence is not.
2. How you detected the notice, and the detector's recall on a hand-labelled sample of your own. Precision is the easy number; recall is the one that conditions every downstream rate. State the denominator as “of sites where we detected a notice”.
3. Whether the choice was verified as stored, and how — TC string, CMP cookie, or nothing. If nothing, say so.
4. Whether you reloaded after interacting, and whether the crawl was stateful across that reload [6Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)].
5. Your vantage point and the gdprApplies value you observed. Not “we crawled from Europe” — the country, and preferably the observed flag.
6. If you used an off-the-shelf tool, its success rate on your sample, not its authors' [5Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)]. Also its version and, for a rule-driven tool, the rule-set commit.
7. Which law you are assessing, by article. ePrivacy Art. 5(3) for the storage/access question, GDPR Art. 4(11) and 7 for the validity-of-consent question; both, usually.
8. The banner language and the site's locale, if your button classifier is language-dependent [23Ogut, Aysun; Turanlioglu, Berke; Metiner, Doruk Can; Levi, Albert; Yilmaz, Cemal; Cetin, Orcun; Uluagac, Selcuk (2024): "Dissecting Privacy Perspectives of Websites Around the World: "Aceptar Todo, Alle Akzeptieren, Accept All..."", in: Proceedings of the USENIX Security Symposium. (Link)].
9. Whether you cleared shared-domain consent cookies between sites, if the crawl is stateful. A consent string set on one site is readable on another [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)].
10. What you counted as the effect of the choice — requests, tags loaded, or cookies set. On a Google consent-mode site these disagree, because the tag fires either way.
11. Your violation definition, verbatim, and preferably as machine-checkable rules. This is what makes your 72% and someone else's 96% comparable.

* Nobody has replicated the banner-interaction-tool evaluation since 2024. Demir et al.'s 65% is one measurement, on one sample, of tools that have since changed. It is load-bearing for a lot of this page and for a lot of published crawls, and re-running it is a well-scoped, publishable study. * LLM-driven banner interaction is unmeasured as an instrument, and alarming as a subject. A language model that reads any banner in any language is the obvious successor to CSS-selector rule sets, and exactly one paper in this corpus puts an LLM anywhere near a consent artefact. Nobody has published cost, latency, determinism or accuracy against a hand-labelled set — and determinism is the hard one for a measurement instrument. Meanwhile the reverse question is opening up: work outside this corpus reports that browser-automation agents accept consent banners even when instructed to refuse everything.¹⁶⁾ Whether an agentic browser can be trusted to express a consent choice is now both a methods question and a research topic. * Consent measurement is about to be measuring a different law, and the primary documents exist. The Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, would insert a new Article 88a into the GDPR carrying “the consent requirement for the storing or accessing of personal data on the terminal equipment of natural persons” — that is, it moves the cookie rule out of the ePrivacy Directive and into the GDPR.¹⁷⁾ The EDPB and EDPS jointly opined on it on 11 February 2026 (Joint Opinion 2/2026), supporting simplification but warning that splitting the cookie rules across instruments risks legal uncertainty.¹⁸⁾ It is a proposal, not law, and it is not settled. But a longitudinal consent study spanning 2025–2028 will straddle a change in the legal object it measures, and should say which regime each wave sits under. * The UK has already moved, and by more than the EU has. The Data (Use and Access) Act 2025 amended PECR to exempt several categories — including aggregate-statistics analytics — from prior consent, with effect from 5 February 2026, and raised the maximum PECR fine from £500,000 to £17.5m or 4% of global turnover. The ICO's own storage-and-access guidance is being consulted on rather than settled.¹⁹⁾ * The reload effect has been measured once [6Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)]. If 25% of post-rejection change only appears after a reload, an unknown share of the published consent literature under-reports the effect of rejection. Which share is an answerable question. * Consent revocation is nearly unstudied. One paper [28Kancherla, Gayatri Priyadarsini; Bielova, Nataliia; Santos, Cristiana; Bichhawat, Abhishek (2025): "Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web", in: Proceedings on Privacy Enhancing Technologies. (DOI)], 158 sites. Withdrawal is as legally required as consent and is far harder to automate. * No shared benchmark exists. There is no public, versioned set of annotated consent notices that a new detector can report against, which is why every paper reports precision and recall on its own hand-labelled sample and none of them are comparable. Building one would be a bigger contribution than most new detectors. * The reporting gap itself. 44.2% of crawling papers say nothing about consent, and the share that says something is no higher in 2025–2026 than it was in 2014–2017. A one-line methods sentence would fix it; the question is why sixteen years of the field have not produced one. * How many of the 313 no-interaction papers really did not interact is unknown. The 36 papers claiming an interaction were read one by one and 7 turned out not to have interacted; nobody has done the same in the other direction, and 313 is too many for a hand pass. If the error is symmetric, the true count is somewhere either side of 29 — which is a reason to treat every figure in this section as an order of magnitude and to read the papers you actually compare yourself against.

• Classifying Web Requests — detecting the notice and labelling its buttons, with the comparison table of detectors.
• Classifying Cookies — what the cookies you observe before and after the click actually are, and the CookieBlock/Cookiepedia label sources.
• Interaction with websites and Stateful and stateless crawling — the crawler-side mechanics this page assumes.
• Comparison of crawling libraries — which crawlers ship a consent-interaction step.
• Crawling location — why the vantage point changes which banner you get.
• Legal enforcement — what to do with a violation once you have found one, and which authority is competent.
• Ethics — clicking Accept at scale on behalf of nobody is a decision with an ethical dimension; it is discussed there.
• Provenance of this page's figures — every query, the report scripts and their unedited output, the folds and their residue.

[1]

Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[2]

Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1723-1739. USENIX Association, Philadelphia, PA. (Link)

[3]

Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[4]

Nouwens, Midas; Liccardi, Ilaria; Veale, Michael; Karger, David; Kagal, Lalana (2020): "Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence", in: Proceedings of the CHI Conference on Human Factors in Computing Systems. (DOI)

[5]

Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)

[6]

Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)

[7]

Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)

[8]

Hausladen, Katherine; Wang, Oliver; Eng, Sophie; Wang, Jocelyn; Wijaya, Francisca; May, Matthew; Zimmeck, Sebastian (2025): "Websites' Global Privacy Control Compliance at Scale and over Time", in: Proceedings of the USENIX Security Symposium. (Link)

[9]

Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[10]

Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)

[11]

Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)

[12]

Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)

[13]

Libert, Timothy (2018): "An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies", in: Proceedings of the ACM Web Conference. (DOI)

[14]

Charatan, Jan; Birrell, Eleanor (2024): "Two Steps Forward and One Step Back: The Right to Opt-out of Sale under CPRA", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[15]

Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[16]

Kumar, Vinayshekhar Bannihatti; Iyengar, Roger; Nisal, Namita; Feng, Yuanyuan; Habib, Hana; Story, Peter; Cherivirala, Sushain; Hagan, Margaret; Cranor, Lorrie Faith; Wilson, Shomir; Schaub, Florian; Sadeh, Norman M. (2020): "Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text", in: Proceedings of the ACM Web Conference. (DOI)

[17]

Bui, Duc; Tang, Brian; Shin, Kang G. (2022): "Do Opt-Outs Really Opt Me Out?", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[18]

Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[19]

Rasaii, Ali; Gosain, Devashish; Gasser, Oliver (2023): "Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[20]

Bollinger, Dino; Kubicek, Karel; Cotrini, Carlos; Basin, David (2022): "Automating Cookie Consent and GDPR Violation Detection", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2893-2910. USENIX Association, Boston, MA. (Link)

[21]

Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)

[22]

Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)

[23]

Ogut, Aysun; Turanlioglu, Berke; Metiner, Doruk Can; Levi, Albert; Yilmaz, Cemal; Cetin, Orcun; Uluagac, Selcuk (2024): "Dissecting Privacy Perspectives of Websites Around the World: "Aceptar Todo, Alle Akzeptieren, Accept All..."", in: Proceedings of the USENIX Security Symposium. (Link)

[24]

Nguyen, Trung Tin; Backes, Michael; Stock, Ben (2022): "Freely Given Consent?: Studying Consent Notice of Third-Party Tracking and Its Violations of GDPR in Android Apps", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[25]

Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)

[26]

Zimmeck, Sebastian; Aggarwal, Nishant; Liu, Zachary; Altman, Sage; Kollnig, Konrad (2026): "Exercising the CCPA Opt-out Right on Android: Legally Mandated but Practically Challenging", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[27]

Degeling, Martin; Utz, Christine; Lentzsch, Christopher; Hosseini, Henry; Schaub, Florian; Holz, Thorsten (2019): "We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[28]

Kancherla, Gayatri Priyadarsini; Bielova, Nataliia; Santos, Cristiana; Bichhawat, Abhishek (2025): "Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web", in: Proceedings on Privacy Enhancing Technologies. (DOI)