Cookie Consent Statistics (2026)

Cookie banners are the most visible artifact of modern privacy law, and they have been studied intensively: how many sites show them, how people interact with them, and what design choices do to the numbers. This page collects the most-cited findings. The pattern across all of them is consistent: when people get a real choice, a large share say no.

How many websites have a banner

Before the GDPR took effect in May 2018, only around 5 percent of websites used a consent management platform (CMP). By the end of 2023 that figure had grown to roughly 42 percent of European websites, according to study compilations by Ignite.

A cross-country analysis presented at the CHI 2025 conference found consent interfaces on 67 percent of the websites it examined, a higher prevalence than any previous study. Averaging across earlier studies with different methods, roughly half of sites show some form of consent interface. Most banners are not hand-built: about two thirds come from CMPs, with Usercentrics, OneTrust, and CookieYes among the market leaders.

Acceptance and rejection rates

The headline numbers from 2024 and 2025 studies, as compiled by Ignite's review of 26 cookie banner studies:

• Average acceptance across recent datasets sits between roughly 42 and 47 percent.
• Where a one-click Reject all button is offered, academic studies and CMP data converge on 50 to 60 percent rejection.
• When rejection requires opening a preferences menu, acceptance climbs to around 90 percent. Friction, not preference, drives most acceptance.
• A share of visitors interact with neither button. They ignore the banner or leave, which for consent-gated analytics counts the same as a rejection.

The direction of travel is clear: as regulators have forced reject buttons onto the first layer, measured consent rates have fallen.

Consent rates by region

Regional differences are large and mostly track the underlying legal model:

• Germany and France show the lowest acceptance in published data, with fewer than 25 percent of users accepting cookies in some studies.
• Northern and central Europe generally shows high rejection wherever banners offer a genuine choice.
• The United States shows acceptance above 80 percent in several studies. US state laws like the CCPA use opt-out rather than opt-in, so US banners rarely block anything by default and users click through.

For a site with mixed traffic, this means consent-gated analytics undercounts European visitors far more than American ones, which quietly skews geographic and campaign reporting.

Banner design and dark patterns

Design remains the single biggest lever on consent rates, and regulators know it:

• The share of websites offering equally visible accept and reject buttons rose from 27 percent in 2023 to 52 percent in 2025, according to Ignite's study compilation, reflecting enforcement pressure from French, German, and other EU authorities.
• A 2025 study still found that 38 percent of technically compliant banners make the accept button the main visual focal point.
• Compliance overall remains poor. A large-scale analysis of more than 250,000 websites found only about 15 percent of banners met minimum GDPR requirements, and over 60 percent of sites using a CMP set trackers before the user had consented.

Impact on measured traffic

For analytics, consent is not an abstract legal question; it is a data question. If the analytics script only runs after opt-in, everyone who rejects, ignores, or bounces before interacting simply vanishes from reports. Industry write-ups on consent-gated GA4 setups consistently report recorded-traffic drops of 30 to 50 percent for European audiences, with some configurations losing more. Even Google's own modeling features exist because of this gap: consent mode estimates the missing sessions statistically rather than measuring them.

The practical consequence is that two sites with identical real traffic can report very different numbers depending on their banner design and audience geography. Broader context on analytics measurement gaps is on the web analytics statistics page.

There is a second path: analytics that sets no cookies and stores no personal data does not need a consent banner for measurement at all, so nobody disappears from the numbers. That is how Analyse works, and the GDPR-compliant analytics guide walks through the legal basis.

Sources

• Ignite: 26 studies on cookie banners, consent rates, and compliance
• CHI 2025: A cross-country analysis of GDPR cookie banners
• Advance Metrics: Cookie behaviour study, five years after GDPR
• ScienceDirect: Accepting cookies, nudging and deceptive patterns (2025)
• arXiv: Navigating cookie consent violations across the globe