Cookie consent banners, the modal that asks you to manage your preferences before you can read a news article, are now standard across most EU sites and a growing number of US sites. The original intent was good. Give the user a real choice about tracking. What we got instead was a dark pattern industry. Roughly 90 percent of consent banners in 2026 use deceptive design to push the user toward accepting all cookies. The Information Commissioner Office fined several major UK sites in 2024 and 2025 for exactly this. The pattern persists because the banner vendors make money from the accept rate, not from the rejection rate, and the sites pay the banner vendors to optimise for accept rate. The privacy banner has become a checkbox exercise that the user resents, the regulator penalises, and the marketer defends on the grounds that it is technically compliant.
Why the dark patterns persist
Three reasons, and they are all economic. First, the data broker industry depends on the consent flow being optimised for accept. A site that shows a genuine reject button sees a roughly 12 to 20 percent accept rate, depending on the audience. A site that uses dark patterns (the accept button is large and high contrast, the reject button is small and low contrast, the settings page requires 14 clicks) sees a 75 to 90 percent accept rate. The difference is millions in advertising revenue for a mid tier publisher. Second, the banner vendors are paid per acceptance event in some contracts. The incentive runs straight through. Third, the regulator enforcement has been too slow to change the calculation. The ICO and the CNIL have issued fines, but the fines have been smaller than the revenue gain, and the appeals take years. The economics win until the regulator makes the economics lose.
The user’s behaviour, for what it is worth, is rational. Faced with a banner they have seen ten thousand times, the user clicks whatever dismisses the banner fastest. The consent given is uninformed. The privacy choice is an illusion. The regulator is supposed to be the backstop, but the backstop has not materialised at scale. Until it does, the banner will keep working against the user it was designed to protect.
What privacy UX that actually works looks like
The patterns that make a difference in 2026 are not about the banner. They are about the choice architecture. The first pattern is do not track by default. The site loads without third party tracking. The user can opt in to specific features (personalisation, recommendations) if they want them. The choice is binary, clear, and reversible. The second pattern is the privacy budget. The site declares what it collects, what it shares, and what it keeps, in plain language, in two sentences or fewer. The user does not need to navigate a settings tree. The third pattern is the data export and the data delete, made trivially easy. The user can download everything the site has on them, and the user can delete everything the site has on them, in one click. These three patterns are how serious privacy teams in 2026 are building. The banner is on its way out.
The interesting case study is Apple. App Tracking Transparency, the prompt that asks the user whether to allow tracking across other apps, has been live since iOS 14.5. The accept rate is roughly 25 percent. The data broker industry claims it has cost them billions. The user sees a single binary prompt. The choice is informed. The privacy budget is implicit. Apple does not have a settings tree. The pattern works, and the rest of the industry is slowly copying it under regulator pressure.
The bottom line
Banners have failed because the vendors make money from accept rate. Three patterns work: do not track by default, declare the data budget in two sentences, make export and delete one click. The banner is on its way out. The default that does not track is on its way in. Build for the second, not the first.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
