# Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework

arXiv: https://arxiv.org/abs/1911.09964 · HTML: https://mlsanity.com/paper/1911.09964/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Nov 2019.

## Built on by (most cited first, 9 of 9)

- [An In-Depth Investigation of Data Collection in LLM App Ecosystems](https://mlsanity.com/paper/2408.13247/) (2024)
- [Algorithmic audits of algorithms, and the law](https://mlsanity.com/paper/2203.03711/) (2022)
- [Automated detection of dark patterns in cookie banners: how to do it poorly and why it is hard to do it any other way](https://mlsanity.com/paper/2204.11836/) (2022)
- [WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks](https://mlsanity.com/paper/2604.06367/) (2026)
- [Mapping the Empirical Evidence of the GDPR (In-)Effectiveness: A Systematic Review](https://mlsanity.com/paper/2310.16735/) (2023)
- [Using Salient Object Detection to Identify Manipulative Cookie Banners that Circumvent GDPR](https://mlsanity.com/paper/2510.26967/) (2025)
- [Whistleblowing and the machine -- towards a considered position](https://mlsanity.com/paper/2606.21201/) (2026)
- [PromptPET: Privacy-Utility Optimized Prompt Obfuscation](https://mlsanity.com/paper/2607.02932/) (2026)
- [SoK: From Generation to Consumption of Privacy Documents in Software Systems](https://mlsanity.com/paper/2608.12511/) (2026)

## Abstract (arXiv)

As a result of the GDPR and the ePrivacy Directive, European users encounter cookie banners on almost every website. Many of such banners are implemented by Consent Management Providers (CMPs), who respect the IAB Europe's Transparency and Consent Framework (TCF). Via cookie banners, CMPs collect and disseminate user consent to third parties. In this work, we systematically study IAB Europe's TCF and analyze consent stored behind the user interface of TCF cookie banners. We analyze the GDPR and the ePrivacy Directive to identify legal violations in implementations of cookie banners based on the storage of consent and detect such violations by crawling 22 949 European websites. With two automatic and semi-automatic crawl campaigns, we detect violations, and we find that: 141 websites register positive consent even if the user has not made their choice; 236 websites nudge the users towards accepting consent by pre-selecting options; and 27 websites store a positive consent even if the user has explicitly opted out. Performing extensive tests on 560 websites, we find at least one violation in 54% of them. Finally, we provide a browser extension to facilitate manual detection of violations for regular users and Data Protection Authorities.