Web Consent Patterns & ConsentDiff Taxonomy

• The paper presents a rigorous taxonomy defining five distinct web consent UI patterns based on user flows and DOM features.
• It details a reproducible measurement pipeline that audits policy-UI alignment using semantic policy parsing and visual feature extraction.
• It reveals significant regional and vertical variations in compliance, with dark patterns frequently biasing consent rates in real-world settings.

Web consent patterns constitute the set of user interface designs and implementation strategies that websites employ to obtain, record, and manage user consent for the collection and processing of personal data—typically in the context of regulatory compliance with frameworks such as the General Data Protection Regulation (GDPR). The ConsentDiff taxonomy provides a formal, reproducible framework for describing, measuring, and auditing these consent-management interfaces (CMIs) at scale. It systematically categorizes both standard and manipulation-prone (dark pattern) designs, measures the correspondence between website privacy policies and actual consent flows, and enables fine-grained longitudinal, regional, and sectoral analyses of UI friction and compliance (Guo, 3 Dec 2025, Nouwens et al., 2020, Soe et al., 2020).

1. ConsentDiff UI Pattern Taxonomy

The ConsentDiff taxonomy recognizes five mutually exclusive, functionally and visually distinct CMI types, each precisely defined by their user flows and DOM/screenshot characteristics (Guo, 3 Dec 2025):

Pattern	Defining Characteristics	Example Triggers
Scroll-Wall	Full-page overlay; scrollable policy/banner text; fixed "Accept all"/"Reject all" at bottom; no collapse controls	Modal ≥ viewport, scrollable, fixed btns
Accordion	One-step banner; collapsible panels labeled by category; toggles in panels; bottom action buttons	Headers, chevron icons, toggles
Multi-Step	Wizard-style; multi-screen sequential flow; step indicator (progress bar); navigational controls	Progress bar, "Next"/"Back" btns
Pre-ticked	Any consent toggle/checkbox checked for non-essential purposes on load; often no/disabled "Reject all" and secondary-focused labels	Preselected toggles, absent reject btn
Reject-Hidden	"Reject all" not visible; additional click(s) required (e.g., "Manage settings"); reject in nested modals/menus	Nested reject, visibility flags

This system captures UI friction, discoverability of refusal paths, and intentional or unintentional bias in consent elicitation.

2. Dark Patterns in Consent Interfaces

Beyond the standard taxonomy, empirical audits (particularly of news outlets and UK web properties) have documented a spectrum of dark patterns—design tactics intentionally or structurally subverting informed consent (Soe et al., 2020, Nouwens et al., 2020):

• Does Not Count: Collects/records consent irrespective of user interaction or even with explicit opt-out.
• No Choice: Lacks in-widget opt-out; pushes user toward external browser settings for refusal.
• Multiple Choice Panels: Opt-in and opt-out split across panels; secondary panel required to refuse.
• Choice Cascade: Opt-out/reject is concealed behind nested menus or multiple clicks.
• Widget Inequality: Accept/decline presented with unequal visual prominence.
• Unlabeled Sliders: Toggle states ambiguous due to lack of labels.
• Unmarked X: Closing the CMI gives no clear indication whether consent is given, denied, or dismissed.
• No Antonyms: Only accepting verbiage provided; rejecting options omitted or renamed.

Prevalence studies indicate that, for instance, hidden opt-out mechanisms affected 50.1% of cases ($n=341/680$), pre-ticked boxes 56.2% ($n=382/680$), and implied consent 32.5% ($n=221/680$) in leading UK CMPs (Nouwens et al., 2020).

3. ConsentDiff Measurement Pipeline

ConsentDiff’s reproducible pipeline comprises (Guo, 3 Dec 2025):

• Monthly Website Snapshots: 2,400 domains (stratified by Tranco rank, vertical, and region) are visited using a headless browser, capturing DOM, full-page screenshots, and network logs.
• Semantic Policy Clause Alignment: Privacy policies are parsed into clause candidates and semantically matched (SBERT similarity, Levenshtein distance) across time, categorized, and labeled for churn measurement.
• Consent-UI Pattern Classification:
  • DOM/screenshot feature extraction (scroll, visibility, toggle states)
  • Snorkel-style labeling functions assign weak supervision
  • Lightweight classifier predicts pattern from features and embeddings (calibrated: macro-F1 ≈ 0.84 on $n=240$ labeled).
• Metric Calculation: All relevant metrics—including claim–UI alignment (Section 4)—are computed for each site/month.

This pipeline enables scalable, temporally fine-grained auditing of both policy and UI evolution.

4. Weighted Claim–UI Alignment Score

To quantify the consistency between privacy-policy claims and the actual consent interface, ConsentDiff introduces a weighted claim–UI alignment score:

$$S_{\mathrm{alignment}} = \frac{\sum_{i=1}^{n} w_i \cdot \mathbf{1}[c_i \Rightarrow u_i]}{\sum_{i=1}^{n} w_i}$$

where:

• $c_i$ indicates the presence of policy claim $i$
• $u_i$ signals whether the corresponding UI predicate is met
• $w_i$ assigns regulatory/empirical importance to each claim–UI pair

Weights commonly reflect regulatory priorities (e.g., "Reject all" visibility: $w_i=0.4$). The score is normalized to $n=382/680$0. Empirically, the presence of a "Reject all" button increases $n=382/680$1 by +0.12, default-off toggles by +0.05, and keeping reject actions to $n=382/680$2 steps by +0.07 (Guo, 3 Dec 2025).

5. Empirical Findings: Dynamics, Regional and Vertical Variation

ConsentDiff reveals persistent policy and UI churn, structural breaks around enforcement, and substantial regional/vertical variance (Guo, 3 Dec 2025, Nouwens et al., 2020):

• Policy clause churn: 15–20% of clauses rewritten quarterly, especially for Purpose and Sharing.
• UI shifts: In the EU, high-friction Scroll-Walls dropped from >50% to a minority, replaced by Accordion (+15 pp) and Multi-Step patterns; pre-ticked defaults fell by 4.8 pp post-enforcement.
• Alignment distribution: Median $n=382/680$3 is higher in the EU (≈0.68) than US–CA (≈0.59, $n=382/680$4, Cliff’s $n=382/680$5); news/social exceeds retail by 0.06.
• Event studies: Post-enforcement, visibility of "Reject all" jumped 9.3 pp and $n=382/680$6 by 0.04 (site/month FE).
• Prevalence of dark patterns: Only 11.8% of UK CMP instances were minimally compliant (explicit consent, equal clicks, no pre-ticked) (Nouwens et al., 2020); reject-friction inflated accept rates by +22–23 pp in controlled experiments.

These results are robust to banner-detection errors, alternative alignment weightings, and classification uncertainty.

6. Representative Examples and Pattern Operationalization

Illustrative instances from the audits demonstrate the spectrum of ConsentDiff patterns (Guo, 3 Dec 2025, Soe et al., 2020):

• Scroll-Wall (News): Full-page overlay with policy text, fixed-action buttons.
• Accordion (EU Retail): Four collapsible, labeled panels for each cookie purpose, toggles, side-by-side accept/reject.
• Multi-Step (Video): Progress-bar wizard; sequential access to granular controls.
• Pre-ticked (Social add-on): All non-essential toggles checked by default, "Reject all" buried or disabled.
• Reject-Hidden (Blog): "Reject all" accessible only through nested "Cookie settings" after an initial dismissal.

Field studies confirm that users are substantially more likely to accept when refusal is less discoverable, and that patterns such as implied consent and pre-ticked boxes systematically bias observed consent rates. Regulatory and practical compliance with informed, freely-given refusal is rare without prescriptive overrides at the browser or CMP level (Nouwens et al., 2020, Soe et al., 2020).

---

The ConsentDiff taxonomy, measurement pipeline, and alignment framework operationalize a rigorous, repeatable standard for empirical audits of consent UIs, bridging the observable friction of web consent flows with policy semantics and regulatory criteria. This approach scaffolds future comparative work across jurisdictions, verticals, and time, and grounds ongoing policy discourse in reproducible, quantitatively-defensible metrics (Guo, 3 Dec 2025, Nouwens et al., 2020, Soe et al., 2020).