# Using Salient Object Detection to Identify Manipulative Cookie Banners that Circumvent GDPR

arXiv: https://arxiv.org/abs/2510.26967 · HTML: https://mlsanity.com/paper/2510.26967/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 56 references that are in the map.
- First posted on arXiv 30 Oct 2025.

## Builds on (most cited first, 12 of 12)

- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence](https://mlsanity.com/paper/2001.02479/) (2020)
- [(Un)informed Consent: Studying GDPR Consent Notices in the Field](https://mlsanity.com/paper/1909.02638/) (2019)
- [We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy](https://mlsanity.com/paper/1808.05096/) (2018)
- [Relative Saliency and Ranking: Models, Metrics, Data, and Benchmarks](https://mlsanity.com/paper/1810.02426/) (2018)
- [Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework](https://mlsanity.com/paper/1911.09964/) (2019)
- [Instance-Level Relative Saliency Ranking with Graph Reasoning](https://mlsanity.com/paper/2107.03824/) (2021)
- [Visual Attention: Deep Rare Features](https://mlsanity.com/paper/2005.12073/) (2020)
- [Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners](https://mlsanity.com/paper/1912.07144/) (2019)
- [Accept All: The Landscape of Cookie Banners in Greece and the UK](https://mlsanity.com/paper/2104.05750/) (2021)
- [Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies](https://mlsanity.com/paper/2302.05353/) (2023)
- [To Be or Not to Be (in the EU): Measurement of Discrepancies Presented in Cookie Paywalls (LONG)](https://mlsanity.com/paper/2410.06920/) (2024)

## Abstract (arXiv)

The main goal of this paper is to study how often cookie banners that comply with the General Data Protection Regulation (GDPR) contain aesthetic manipulation, a design tactic to draw users' attention to the button that permits personal data sharing. As a byproduct of this goal, we also evaluate how frequently the banners comply with GDPR and the recommendations of national data protection authorities regarding banner designs. We visited 2,579 websites and identified the type of cookie banner implemented. Although 45% of the relevant websites have fully compliant banners, we found aesthetic manipulation on 38% of the compliant banners. Unlike prior studies of aesthetic manipulation, we use a computer vision model for salient object detection to measure how salient (i.e., attention-drawing) each banner element is. This enables the discovery of new types of aesthetic manipulation (e.g., button placement), and leads us to conclude that aesthetic manipulation is more common than previously reported (38% vs 27% of banners). To study the effects of user and/or website location on cookie banner design, we include websites within the European Union (EU), where privacy regulation enforcement is more stringent, and websites outside the EU. We visited websites from IP addresses in the EU and from IP addresses in the United States (US). We find that 13.9% of EU websites change their banner design when the user is from the US, and EU websites are roughly 48.3% more likely to use aesthetic manipulation than non-EU websites, highlighting their innovative responses to privacy regulation.