A Bruegel study argues that online consent banners do not provide users with a truly informed choice.

Banners through which websites request consent for the collection and use of personal data fail to provide users with truly informed consent, even when designed transparently and without manipulative elements, argues a new working paper published by Bruegel. The author, Bertin Martens, argues that the problem stems not only from fatigue caused by repeated requests or the use of "dark patterns," but also from the fact that users cannot know how their data will be combined, analyzed, and reused, and what concrete effects this process will have on them.

In short The study argues that consent banners cannot provide users with sufficient information to assess the real effects of accepting or refusing data collection. A cited research in the paper shows that only 15% of the analyzed tools fully complied with GDPR standards, although many used standardized consent management infrastructures. Hiding or making access to the "reject all" option more difficult can increase the acceptance rate of data collection by nearly 18%, according to an experiment cited by the author. Reducing data collection can also have broader economic effects, including market concentration, the exit of certain applications from the market, and increased prices, although the study emphasizes that the overall effects on well-being are not unambiguous. The author believes that AI agencies could, in the future, manage personal data preferences more effectively, but only if they act in the user's interest and are not commercially influenced.

The General Data Protection Regulation requires that consent for the processing of personal data be freely given, specific, informed, and unambiguous. However, GDPR does not establish a single technical standard for how the tools through which this consent is requested should be displayed or function, leaving a large part of the design in the responsibility of websites, platforms, and service providers for managing consent.

In practice, these tools have become a constant presence in online navigation. Users must repeatedly decide whether to accept or refuse cookies, trackers, and other forms of data collection, and this succession of decisions produces what the literature calls "consent fatigue": fatigue, irritation, and ultimately, a tendency to choose the option that allows the quickest continuation of navigation.

The study emphasizes that this behavior can be exploited through design. Some interfaces offer acceptance with a single click, while refusal involves multiple steps or uses less visible buttons. The author cites research on the most accessed 10,000 websites from 31 countries, according to which only 15% of the analyzed consent tools were fully compliant with GDPR standards.

The problem is not just the existence of manipulative banners. Cited experiments in the paper show that approximately 67% of participants gave their consent for data sharing even when the interface was built neutrally, without favoring one option. When the button for rejecting all cookies is hidden, the data sharing rate increases by nearly 18%, and a user spends an average of 7.34 seconds on each encountered banner.

For the author, however, the fundamental difficulty remains even in the case of an ideal tool. A banner can explain what types of data are collected, who will use them, and for what stated purpose, but it cannot tell the user whether acceptance will later lead to different prices, changes in displayed search engine results, changes in content from social media feeds, or other forms of personalization that may advantage or disadvantage them.

The reason is that individual information is not used in isolation. Platforms and intermediaries combine data from numerous sources to build profiles and models that can influence advertising, ranking results, recommendations, or displayed prices. Neither the user nor the site that initially collects the data can fully anticipate the outcome of these analyses, making it impossible to evaluate all consequences at the moment when the person presses "accept" or "reject."

The working paper also analyzes the broader economic effects of data protection rules and the reduction of access to information about users. Cited research indicates that after the implementation of GDPR, the number of third-party data intermediaries used by websites decreased by 15%, while the concentration among those who remained in the market increased by 17%.

Another cited study estimates that approximately one-third of existing applications in the Google Play Store exited the market following the introduction of GDPR and that the entry of new applications decreased by about half in the following quarters. The author presents these results as evidence of compliance costs that may affect smaller providers more than large companies, without claiming, however, that all effects stem exclusively from the consent mechanism.

Reducing access to data can also influence advertising and prices. Research on Apple's App Tracking Transparency system, cited in the paper, has associated the decrease in data availability with lower advertising investments, greater market concentration, and higher prices for certain products. At the same time, the author emphasizes that excessive data sharing can produce negative effects through discrimination, exploitation of consumer vulnerabilities, or manipulative targeting, and empirical literature has not established which of these effects predominates overall.

The European Commission proposed in November 2025 the introduction of a general refusal signal at the browser level. The idea is for the user to express their preference once, instead of being required to respond separately to each site. The solution may reduce the time wasted with banners, but the study argues that it does not solve the lack of information about the economic and personal consequences of data usage.

There are already browser extensions that automate the decision. Consent-O-Matic can automatically reject non-essential data sharing options, while other tools block or hide banners. These solutions reduce the user's effort but do not change the fundamental problem identified by the author: the person still cannot evaluate all future consequences of sharing information.

The paper indicates artificial intelligence as a potential deeper change. AI agents could act on behalf of users, seeking products and services based on their preferences and reducing direct interaction with advertising systems built around capturing attention and individual profiling.

In such a model, providers could be forced to compete more on the quality of offers, reviews, and feedback, and less on personalized advertising. The author warns, however, that this outcome depends on the neutrality of AI agents: if they are provided by companies that earn revenue from recommendations, advertising, or user transactions, commercial interests may in turn influence automated decisions.

The working paper is signed by Bertin Martens, Senior Fellow at Bruegel, and was prepared for a debate on GDPR at the Bruegel Annual Meetings 2026. Bruegel states that the opinions expressed belong to the author and do not represent an institutional position of the organization.

The analysis does not contest the fundamental right to personal data protection nor GDPR as a whole. Its argument refers to how individual consent is practically implemented online and the difficulty of transforming the simple choice between "accept" and "reject" into an effectively informed assessment of the consequences of data usage.