The consumer view of online cookies: consent and control

Summary

Government has recently consulted on a range of options for changes to the way that cookies are used online, as part of their steps to redraw data protection legislation post-Brexit. Which? undertook new consumer research to understand how consumers felt about the proposed changes.
Contrary to the government’s proposals, we found that consumers would prefer to continue to be able to actively choose what cookies are used and what data is collected about them.
Our findings challenge the consensus view that consumers dislike cookie banners. When consumers understand what the banner is asking, they find them a useful way of offering control and choice. The problem is not the concept or inconvenience of the banner, but rather the lack of standardisation in how cookies are explained and consent is sought.

Introduction

In September 2021, the Department for Digital, Culture, Media and Sport (DCMS) launched a consultation, entitled ‘Data: A New Direction’. It discussed the future of the data protection regime in the UK, and contained many suggestions for change that could have a direct impact on consumers. Which? carried out deliberative qualitative research with twenty-two consumers to gather their views on some of the options put forward.

One set of changes proposed by the government were significant reforms to the use of ‘cookies’ - a technology used to track consumers online - including the option to extend the ways in which cookies can be used without the consumer’s consent, and changes to the ways that consumers are asked to consent to the use of cookies. This article describes how our research participants reacted to these proposals.

Methodology

22 consumers took part in a 6 day online community between 18-23 October, hosted on our research platform Recollective. Participants selected to take part in the research reflected a balanced cross section of the online population, with a demographic spread as well as a range of internet behaviour/usage.

During the online community, participants were able to examine stimulus materials, learn about the topic areas and proposed reforms, share their views and engage with other participants’ opinions. Participants completed a series of tasks, with each day of the community focused on a specific research question.

Consumers understand that cookies improve their online experience

Cookies support a wide range of online functionality, from remembering what a customer has added to their basket while shopping online, to helping online services understand how people are using their website, to building profiles to support targeted advertising.

Currently, web services must seek consent for all cookies beyond those which are ‘strictly necessary’ to make the website work properly. The government proposed changing this to widen the range of cookies which can be used without the users’ explicit consent, with the aim of giving websites access to more information that could help them improve their services.

While most of our participants were comfortable with the use of functional first party cookies (placed by the website currently being used), we found that many participants were uncomfortable with cookies being used for other purposes, including tracking by third parties (other than the website currently being used) for personalised marketing.

"I appreciate that some cookies make my life easier when I am returning to a site I have visited before, but not so happy that my browsing history and advertisements are used for targeted advertising"

But control is essential

Our research participants were clear that they should be in control of their data, and asked for explicit consent for anything beyond functional cookies, mirroring the findings of our quantitative and qualitative research exploring consumers’ views on how online platforms collect data to target adverts. In particular, participants in this project bristled at the government’s suggestion that the requirement for consent should be removed for all cookie types, including third party tracking.

"I don't believe it is ethical to collect data without consent and that the government should provide protection from this"

The vast majority of participants were 'not comfortable ' with the idea of third party cookies collecting data without explicit consent. Indeed, 15 of the 22 participants said they were ‘not at all comfortable’, indicating the strength of feeling on this subject.

"I feel a little uncomfortable knowing that many companies are following me. I only think it is acceptable for the store or website I am visiting to track my activity there and once I leave it should stop"

The government made its proposal on the assertion that the pop-up cookie ‘banners’ used to collect consent for cookies on websites are a source of frequent complaints and consumer ‘fatigue’, citing evidence that many people don’t engage with these notices. Our research, however, challenges this.

As the table shows, all but three participants reported that using cookies automatically, without consent, was their least preferred option. Consumers were also reluctant for the more limited analytic or performance cookies to be redefined as ‘essential’ and collected without consent, with most participants selecting this as their fourth preference of the five offered.

Instead, our participants continue to demonstrate a clear preference for providing their explicit consent to cookies. Over half (13 of the 22) participants’ first preference was to set cookie preferences in their browser/device, a convenient, one-off way of ensuring the consumer is in control.

"I believe the most efficient way to deal with cookies preferences is to set these up in your browser once and apply the same settings to every new site you open in that browser"

A third (8 out of 22) chose cookie banners on individual sites as their most preferred consent mechanism. The view that consumers dislike or are fatigued by cookie banners is challenged by our community findings. Consumers - when they understand what the banner is asking - find them useful processes for enhanced control and for more nuanced choice:

"I think banners are preferable [even if] they're irritating and unsightly!"

Our participants did express frustration with cookie banners, but not in the way we might have expected: rather than bemoaning the interruption to their online experience, our participants criticised the lack of standardisation in how cookies are explained and consent is presented. Banners are inconsistent in design and in their information provision, with the worst examples using dark patterns to encourage consumers to give more wide-ranging consents. Our participants noticed this, and resented the manipulation.

"My options were “I’m happy with all cookies, let’s go” or “I want to manage cookies”. On selecting the manage button I was given a similar, but smaller, list than before. This time the choice of YES or NO was not as clear as before. There was a box around NO and the YES was shaded – I could assume this meant that No had been selected but I’ve been caught out before with such ambiguity."

Conclusion

What this deliberative research shows clearly is that giving the consumer the ability to consent and choose cookies is preferable to removing it. Consumers do not want their choice decided for them by redefining what is necessary data collection or through a change in consent mechanisms.

Which? would like to see consent options developed with, and tested and evaluated by consumers to ensure that the solutions meet their diverse needs.