# Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence

arXiv: https://arxiv.org/abs/2001.02479 · HTML: https://mlsanity.com/paper/2001.02479/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Jan 2020.

## Built on by (most cited first, 27 of 27)

- [LLM Whisperer: An Inconspicuous Attack to Bias LLM Responses](https://mlsanity.com/paper/2406.04755/) (2024)
- [DECEPTICON: How Dark Patterns Manipulate Web Agents](https://mlsanity.com/paper/2512.22894/) (2025)
- [Designing Fiduciary Artificial Intelligence](https://mlsanity.com/paper/2308.02435/) (2023)
- [SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agents](https://mlsanity.com/paper/2510.11035/) (2025)
- [Regulating Gatekeeper AI and Data: Transparency, Access, and Fairness under the DMA, the GDPR, and beyond](https://mlsanity.com/paper/2212.04997/) (2022)
- [A Decentralized Approach towards Responsible AI in Social Ecosystems](https://mlsanity.com/paper/2102.06362/) (2021)
- [Automated detection of dark patterns in cookie banners: how to do it poorly and why it is hard to do it any other way](https://mlsanity.com/paper/2204.11836/) (2022)
- [Locally Private Estimation with Public Features](https://mlsanity.com/paper/2405.13481/) (2024)
- [On the Regulatory Potential of User Interfaces for AI Agent Governance](https://mlsanity.com/paper/2512.00742/) (2025)
- [More Human or More AI? Visualizing Human-AI Collaboration Disclosures in Journalistic News Production](https://mlsanity.com/paper/2601.11072/) (2026)
- [Convenience vs. Control: A Qualitative Study of Youth Privacy with Smart Voice Assistants](https://mlsanity.com/paper/2601.04399/) (2026)
- [Automating privacy decisions -- where to draw the line?](https://mlsanity.com/paper/2305.08747/) (2023)
- [Targeted and Troublesome: Tracking and Advertising on Children's Websites](https://mlsanity.com/paper/2308.04887/) (2023)
- [Jurisdiction as Structural Barrier: How Privacy Policy Organization May Reduce Visibility of Substantive Disclosures](https://mlsanity.com/paper/2601.20792/) (2026)
- [Mapping the Empirical Evidence of the GDPR (In-)Effectiveness: A Systematic Review](https://mlsanity.com/paper/2310.16735/) (2023)
- [Why is the User Interface a Dark Pattern? : Explainable Auto-Detection and its Analysis](https://mlsanity.com/paper/2401.04119/) (2023)
- [Mapping the Scholarship of Dark Pattern Regulation: A Systematic Review of Concepts, Regulatory Paradigms, and Solutions from an Interdisciplinary Perspective](https://mlsanity.com/paper/2407.10340/) (2024)
- [From Exploration to Revelation: Detecting Dark Patterns in Mobile Apps](https://mlsanity.com/paper/2411.18084/) (2024)
- [How To Think About End-To-End Encryption and AI: Training, Processing, Disclosure, and Consent](https://mlsanity.com/paper/2412.20231/) (2024)
- [Using Salient Object Detection to Identify Manipulative Cookie Banners that Circumvent GDPR](https://mlsanity.com/paper/2510.26967/) (2025)
- [From Fragmentation to Integration: Exploring the Design Space of AI Agents for Human-as-the-Unit Privacy Management](https://mlsanity.com/paper/2602.05016/) (2026)
- [On the Suitability of LLM-Driven Agents for Dark Pattern Audits](https://mlsanity.com/paper/2603.03881/) (2026)
- [Tiny, Hardware-Independent, Compression-based Classification](https://mlsanity.com/paper/2603.06359/) (2026)
- [Designing for Disagreement: Front-End Guardrails for Assistance Allocation in LLM-Enabled Robots](https://mlsanity.com/paper/2603.16537/) (2026)
- [The Privacy Guardian Agent: Towards Trustworthy AI Privacy Agents](https://mlsanity.com/paper/2604.21455/) (2026)
- [Privacy Washing: Detecting Internal Contradictions in Privacy Policies](https://mlsanity.com/paper/2609.02055/) (2026)
- [Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces](https://mlsanity.com/paper/2609.34974/) (2026)

## Abstract (arXiv)

New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.