How the world’s busiest websites tackle GDPR consent

Confusion around GDPR has led many website owners to make the decision to wait and see how other websites tackle it before committing to their own solution. User consent is an area of particular concern for many websites, with a myriad of approaches and solutions being used around the web.  Hoping to find some form of consensus on how to approach consent, we looked at how some of the world’s busiest websites are approaching it. Visiting the top 5 websites in fifteen difference categories, we looked at how each presented cookie/privacy information to a user inside the European Economic Area.

How many sites notify about cookies / privacy?

The first test was simply whether any form of privacy or cookie information was presented to the user. It was noted whether each site requested active consent (such as clicking of an “agree” button, or setting preferences), provided some sort of notice beyond a discrete privacy link (such as a pop-up message or interstitial), or did neither of these things. Over 37% of the tested sites did neither.

Of the 75 sites tested:

• 28 presented no notice regarding cookies, privacy or personalised ads
• 26 showed a notice (such as a pop-up alert)
• 21 requested some form of user interaction to provide consent

What active consent mechanism was used?

Test two was to look at what method was used to collect consent when some form of active consent was sought. Over half of the sites tested opted for granular controls that allowed the user to either select what Cookies were used, or what purposes cookies could be used for.

Of the 21 sites that presented some form of opt-in:

• 7 were Opt-in only :  A notice was presented with a means to provide consent (such as an “I agree” button). No on-site means offered to refuse consent or otherwise adjust cookie usage.
• 1 was Opt-in / Opt-out : A notice was presented with a means to provide consent (such as an “Agree” button) and a means to decline it (such as a “Disagree” button).
• 11 offered granular controls over cookie usage : A means was provided to consent to decline the use of either particular cookies or particular uses of cookies.
• 2 took a different approach (see below)

Foxnews.com showed no privacy or cookie notice, but prevented personalised ads serving to EEA users by simply blocking all ads to users in that region. Content still served normally, but without ads showing.

Indiatimes.com Simply blocked all users in the EEA from accessing the site, instead showing a notice explaining that they are currently not allowing users in Europe to access the site.

What the sites served whilst awaiting consent

Sites load before consent is given, and there are differences in what content is served whilst waiting for consent. 37.5% of the sites that serve ads didn’t do so until consent was sought. Almost half of sites blocked all content/interaction until preferences had been set.

Of the 21 sites that required active consent:

• 10 blocked content until the user had expressed their preferences
• 5 were sites that didn’t show ads
• 6 blocked ads until preferences were set
• 10 served some sort of ad before preferences were expressed

Conclusions

Even amongst some of the busiest sites on the web there is still little consensus on either when consent should be sought or what form that consent should take. Solutions range from the costly  and conservative to making no outwardly obvious efforts towards compliance. Even amongst top sites, over a third have no apparent means to gain consent. Whether that is due to taking the position that none is required or not yet having a solution in place is not yet clear.

Methodology

We looked at the top 5 websites in each of Alexa’s top level categories, skipping any domain that appeared in an earlier category. Each was viewed on desktop and mobile in an incognito browser window from two different UK IP addresses. We only looked at consent gathering, not the less clear topic of whether consent was necessary. No testing was done as to whether withdrawing consent had any actual impact on Cookie use.  No testing was done on site in the adult category.  Analysis was performed on June 6th 2018. Please note that our experience at time of testing may not reflect the experience of others. No opinion is offered regarding the compliance status of any of the websites tested.

Consent methods were classified as follows:

• None : No notice regarding cookie or advertising consent was seen.
• Notice only : Some form of notice was presented regarding Cookies/Privacy. This was information only with not means presented to affect cookie use.
• Opt-in only : A notice was presented with a means to provide consent (such as an “I agree” button). No on-site means offered to refuse consent or otherwise adjust cookie usage.
• Opt-in / Opt out : A notice was presented with a means to provide consent (such as an “Agree” button) and a means to decline it (such as a “Disagree” button).
• Granular controls : A means was provided to consent to decline the use of either particular cookies or particular uses of cookies.

Raw data