Context & Motivation
Why Cookie Consent Matters
Cookie consent banners are everywhere — and almost universally ignored, rushed through, or submitted to without comprehension. When I joined this research project at IIT Delhi, the central puzzle was deceptively simple: do users ever actually consent to cookies, or are they coerced by design? The more we dug in, the more we realised the answer was almost always the latter.
I came to this project as someone who had been thinking about dark patterns in product design for years — watching companies optimise interfaces not for user benefit, but for data extraction. Cookie banners represent a uniquely concentrated case: a legally mandated consent mechanism that has, in practice, become a tool for manufacturing compliance. The GDPR requires informed, freely-given consent. What we actually see is the opposite.
Working alongside Shreya Ahuja and Prof. Jyoti Kumar, I helped design and conduct a two-phase qualitative study with 20 university students. We wanted to understand not just what users did when confronted with cookie banners, but what they thought, felt, and experienced. The result was a rich taxonomy of coercion — five cognitive response types, six categories of perceived constraint, and a model of felt autonomy infringement that we believe has real implications for privacy regulation and design ethics.
“When users click 'Accept All Cookies,' are they making an informed decision — or being coerced by design?”
Background
What Are Dark Patterns — and Why Do They Matter?
Deceptive by Design
Dark patterns are UI elements intentionally crafted to manipulate users into choices they wouldn't make if the interface were neutral. Not bugs — deliberate design decisions optimised for extraction, not user benefit.
Cookie Banners as a Case Study
Cookie consent banners are legally required to collect informed consent. In practice, most use at least one dark pattern: visually prominent 'Accept All', buried 'Decline', no reject option, deliberately unclear language.
Why Ethical Technology Matters
When design undermines autonomy, it doesn't just harm individual users — it erodes trust in digital systems broadly, enables surveillance capitalism, and violates the regulatory intent of frameworks like GDPR.
The Dark Pattern Spectrum
Neutral Design
Persuasive Design
Nudge
Dark Pattern
Coercion
Research Questions
Four Questions That Guided the Study
How do users cognitively respond to cookie consent banners during naturalistic web browsing?
What constraints do users perceive when interacting with cookie consent interfaces?
What moderating factors influence the degree of felt autonomy infringement in cookie consent interactions?
What emotional responses do users experience as a result of encountering cookie consent dark patterns?
Literature Review
What Was Known — and What Was Missing
What Was Known
Dark patterns in cookie banners are deliberately designed to nudge users toward data-sharing choices that benefit the platform.
GDPR compliance requirements have not eliminated manipulative design; many sites use 'consent theatre' to satisfy legal requirements while still harvesting data.
Users exhibit a 'privacy paradox' — stating they care about privacy while consistently sharing data — often attributed to cognitive load and interface friction.
Visual design choices (colour contrast, button placement, default states) significantly influence opt-in rates on consent interfaces.
The Gap
Most prior work focused on quantitative click-through rates — not the lived cognitive and emotional experience of users during consent interactions.
No existing taxonomy described the full spectrum of cognitive responses users exhibit when confronted with cookie banners in naturalistic settings.
The role of perceived constraints — feeling unable to refuse — had not been systematically studied or categorised.
Emotional dimensions of consent coercion (anger, fear, disgust) had not been documented through qualitative interview data.
Methodology
Two-Phase Mixed-Methods Design
Stimulus Site Selection — Why IKEA?
Amazon
Familiar, high engagement
BBC
News context, complex banner
IKEASelected
Selected — clear task, moderate complexity
Booking.com
Aggressive consent UI
Task Scenario Given to Participants
“You are browsing IKEA's website to find a desk lamp for your study room. Navigate to the website, search for a suitable product, and add it to your cart. Think aloud as you interact with the site — narrate everything you notice, decide, and feel.”
Stimulus Site
The IKEA Cookie Banner — What Participants Actually Saw
Screen recordings from participants during the think-aloud protocol. Each participant browsed ikea.com/in on their own device in incognito mode — cookie banners appeared naturally within seconds of landing.
Participant Demographics
Who We Studied
Participants
Mean age
Gender split
Disciplines
Gender Distribution
Educational Backgrounds
Think Aloud Findings
5 Cognitive Response Types
interactions across all participants involved no informed consent — users clicked through without genuine understanding of what they were agreeing to.
Participants did not notice the cookie banner at all, scrolling past or clicking through without any conscious acknowledgement.
Participants noticed the banner but reacted with body language (sighs, eye-rolls) or pauses rather than verbalised thought.
Most common response. Participants verbalised awareness of the banner but accepted without reading — 'I always just click accept.'
Participants attempted to find an opt-out path, expressed frustration when it was deliberately obscured or absent.
Participants explicitly voiced feeling they had no real choice — 'I have to accept or I can't use the site.'
Response frequency (out of 37 interactions)
Perceived Constraints
Six Categories of Felt Constraint
Users felt genuinely free to choose. Rare, observed only when participants had prior knowledge of opt-out mechanisms.
Interface design captured attention toward the 'Accept All' button through colour, size, and visual salience.
Most common. Jargon-heavy language, complex nested options, and information overload made informed decision-making practically impossible.
Opt-out options were visually buried, disabled by default, or required multiple additional steps to activate.
Users felt their privacy was already compromised — 'they already have my data anyway' — leading to resigned acceptance.
The perceived absence of a real alternative — use the site and accept, or leave. Binary framing eliminated perceived agency.
Cognitive Constraints were most prevalent (14/45 instances), but Choice Constraints drove the strongest felt autonomy infringement — the perception that refusal is not a real option.
Moderating Factors
What Makes Infringement Better or Worse
Increases Infringement
Repeated Exposure
Users who encounter banners frequently develop habituation — a learned helplessness that reduces critical evaluation.
Time Pressure
Goal-oriented browsing (shopping, researching) creates urgency that suppresses careful consent deliberation.
Interface Complexity
More options, more panels, more settings — paradoxically increases acceptance of defaults rather than engagement.
Low Privacy Literacy
Users who cannot interpret technical privacy language feel unable to make meaningful choices.
Decreases Infringement
Prior Negative Experience
Users who experienced concrete data misuse (spam, targeted ads) were more motivated to seek opt-out options.
Technical Knowledge
CS and design students more likely to understand banner mechanics and attempt to navigate opt-out paths.
Low Task Urgency
Casual browsing without a specific goal gave users time to engage with consent options more carefully.
Transparent Interface Design
When 'Reject All' was equally prominent to 'Accept All,' users were significantly more likely to opt out.
“Autonomy infringement is not binary — it exists on a spectrum moderated by individual, contextual, and interface factors. This means design interventions can meaningfully shift outcomes.”
Emotional Experiences
How Cookie Banners Make Users Feel
Directed at companies for using deceptive design, and at regulatory systems for failing to prevent it.
"It's manipulative. They know exactly what they're doing."
"Why is the reject button hidden? This is not okay."
Concern about data being misused, surveillance, or consequences of clicking the 'wrong' option.
"I don't actually know what I'm agreeing to."
"What if they sell this to someone?"
Moral repugnance at the deceptive design — a visceral reaction to the perception of being tricked.
"This feels gross. Like they're trying to fool you."
"It's disgusting that this is even legal."
Resignation and helplessness — a low-arousal response to perceived inability to protect one's privacy.
"I just feel like there's nothing I can do."
"It is what it is. I've given up."
Emotional detachment, often following habituation. Users neither distressed nor engaged — simply compliant.
"I don't really think about it anymore."
"It's just part of using the internet."
Discussion & Implications
What This Means for Design and Policy
Design Ethics
Cookie consent interfaces must be redesigned to default to privacy-protective states. 'Accept All' should not be the primary CTA. Reject options must be visually equivalent.
Privacy Regulation
GDPR's 'freely given consent' standard is systematically violated by current design norms. Regulators must mandate visual parity between accept and reject options.
Privacy Paradox
The privacy paradox — caring about privacy but sharing data — is not a user failure. It is an interface-induced constraint. Users cannot act on values they cannot operationalise.
Autonomy Research
Felt autonomy infringement is a measurable, gradable construct. Future HCI research should develop validated scales to quantify it across interface contexts.
Research Timeline
From Idea to Publication
Reviewed 40+ papers on dark patterns, cookie consent, privacy paradox, and HCI methodology.
Finalised two-phase methodology: think aloud + semi-structured interviews. RQs defined.
3 pilot participants. IKEA selected as stimulus site. Protocol refined based on pilot findings.
20 participants recruited at IIT Delhi. All sessions conducted, transcribed, and anonymised.
Thematic analysis of transcripts. Taxonomy of cognitive responses and constraints developed.
Full paper drafted, peer-reviewed internally, revised and submitted to ICoRD 2025.
Accepted and published in Springer proceedings of ICoRD 2025 (International Conference on Research into Design).
Research Model
Complete Framework at a Glance
Publication
Springer — ICoRD 2025
Cookie Consent Interfaces as Dark Patterns: A Qualitative Study of Felt Autonomy Infringement
Reflection
This research changed how I think about consent — not just in digital interfaces, but as a design primitive. Consent is only meaningful when refusal is genuinely possible. What we found is that most cookie banners are not consent mechanisms at all; they are compliance theatre, optimised to manufacture a legal fig leaf while systematically removing the conditions necessary for real choice.
The emotional data was what stayed with me most. Twenty students, most of them eighteen or nineteen years old, expressing resignation and helplessness about their own digital privacy. 'I've given up' is not a user preference — it is a design outcome. We built that helplessness into them, interaction by interaction, banner by banner.
Working on this paper made me a sharper product designer. I now think about constraint architecture in every interface I touch: where am I giving users real agency, and where am I manufacturing the appearance of it? The gap between those two things is where dark patterns live.