DarkDialogs Study: 89.5% of Sites Use Dark Patterns in Cookie Banners

The Study DPAs Should Be Citing in Every Cookie Banner Audit

The DarkDialogs study by Kirkman, Mathur, Narayanan, and Kshirsagar (2023) is not another academic survey of annoying UX. It is a large-scale, machine-learning-powered audit of 10,000 websites that produces legally consequential results: 89.5% of analysed sites deploy at least one dark pattern in their consent dialogs. With a reported classification accuracy of 99%, the methodology is robust enough to withstand evidentiary scrutiny. For GDPR enforcement bodies, this study functions as a blueprint for scalable, automated non-compliance detection — and for controllers, it is a liability map.

Methodology: Why 99% Accuracy Matters Legally

The researchers trained a multi-class classifier on a labelled corpus of cookie consent dialogs, extracting features from DOM structure, CSS properties (including color contrast ratios and button sizing), and visible text strings. The classifier identifies seven dark pattern categories: visual asymmetry, pre-selected options, misleading wording, hidden opt-out, forced action, trick questions, and nagging.

A 99% classification accuracy on a held-out test set is significant for a specific legal reason: it approaches the threshold where automated findings can serve as prima facie evidence in regulatory proceedings without requiring manual review of every individual case. Under Art. 57(1)(a) GDPR, supervisory authorities have a duty to monitor and enforce compliance. Automated tooling with this accuracy profile enables proportionate, scalable monitoring — a function the EDPB has encouraged through its Coordinated Enforcement Framework (CEF, first activated in 2022 on cookie banners, document ref. EDPB 01/2023).

The Seven Dark Patterns and Their Specific GDPR Violations

Each dark pattern category identified by DarkDialogs maps to a concrete GDPR requirement:

• Pre-selected options: Directly violates Art. 4(11) GDPR and Art. 7(2) GDPR. Consent is not valid when it is pre-ticked. The CJEU confirmed this in Planet49 (C-673/17), holding that a pre-checked checkbox does not constitute valid consent.
• Visual asymmetry: The "Accept All" button is rendered in a high-contrast color (e.g., background-color: #0057b7) while "Reject All" uses low-contrast gray (color: #9e9e9e) or is absent entirely. The EDPB Guidelines 05/2020 on consent (adopted 4 May 2020) explicitly state that withdrawing consent must be as easy as giving it — a principle violated when the reject path requires three additional clicks.
• Hidden opt-out: Reject functionality buried under "Manage Preferences" → "Legitimate Interests" → individual toggle switches per vendor. This architecture violates the granularity and transparency requirements of Art. 13(1)(c) and Recital 42 GDPR.
• Misleading wording: Phrases like "We value your privacy" on an accept-only dialog, or "Continue" as the sole visible action (implying consent by browsing). The French SA (CNIL) issued a €150 million fine against Google (SAN-2022-001) and €60 million against Facebook (SAN-2022-002) partly on the basis of asymmetric ease of accepting versus rejecting cookies.
• Nagging: Repeated re-presentation of consent dialogs after rejection, exploiting consent fatigue. This implicates Art. 7(3) GDPR's principle that withdrawal must not lead to detriment, and the general good-faith requirement implicit in Art. 5(1)(a).

Scale Findings: What 89.5% Actually Tells Enforcement

The 89.5% prevalence figure is not evidence that most controllers are deliberately deceptive — it is evidence that the consent management platform (CMP) ecosystem has normalised non-compliance as a default configuration. The study found that sites using Cookiebot, OneTrust, and TrustArc as CMPs still exhibited dark patterns, because the dark patterns were introduced through platform templates and default settings, not bespoke controller choices.

This has a direct implication for Art. 28 GDPR processor relationships. Where a CMP is configured as a data processor and its default templates systematically produce non-compliant consent flows, the controller remains liable under Art. 24 GDPR for failing to implement appropriate technical measures. The processor's default configuration cannot exonerate the controller. DPOs relying on a CMP vendor's "GDPR-ready" marketing copy without auditing the rendered HTML output are exposed.

Technical Audit Indicators to Check Right Now

The DarkDialogs feature set provides a practical audit checklist. Inspect the following in your own consent dialog:

1. Button contrast ratio: Measure accept vs. reject button contrast using the WCAG 2.1 algorithm. A contrast delta greater than 2:1 between the two buttons is a dark pattern signal and an accessibility violation simultaneously.
2. Click depth to rejection: Count the number of user interactions required to reject all non-essential cookies. More than one click violates the EDPB's "as easy" standard from Guidelines 05/2020.
3. DOM pre-selection state: Query document.querySelectorAll('input[type="checkbox"][checked]') on page load before any user interaction. Any checked consent checkbox is a Planet49 violation.
4. Network requests before consent: Capture HAR logs on first page load. Any third-party request to domains associated with advertising or analytics (identifiable via DNS TXT records, specifically ads.txt entries) before a consent signal is fired is a violation of Art. 6(1) GDPR.
5. Re-prompt interval: If your CMP re-displays the consent banner to users who previously rejected, document the interval. There is no legitimate basis for repeated prompting of a user who has clearly expressed a preference.

Enforcement Trajectory: From Study to Sanction

The EDPB's coordinated enforcement action on cookie banners (CEF 2022) resulted in national DPAs opening 270 cases across the EEA. The DarkDialogs methodology — automated DOM analysis, classifier-based pattern detection — is precisely the kind of tooling DPAs need to scale beyond manual spot-checks. The Irish DPC, the CNIL, and the German DPAs (acting through the DSK) have all issued guidance treating dark patterns as per-se violations of the consent validity requirements.

Controllers should anticipate that enforcement in 2024–2025 will increasingly rely on automated scanning. A site that fails the DarkDialogs classifier is likely to fail a DPA scanner. The study's seven-category taxonomy is already being referenced in regulatory guidance documents as a non-exhaustive typology of non-compliant design.

Action Items for DPOs and Privacy Counsel

• Commission a technical audit of your CMP's rendered output — not the vendor's documentation — using DOM inspection and HAR analysis before your next consent configuration review.
• Amend your Art. 28 DPA with your CMP vendor to include an explicit warranty that default templates comply with EDPB Guidelines 05/2020 and the DarkDialogs taxonomy of prohibited patterns.
• Document your design rationale. Under Art. 5(2) GDPR's accountability principle, you must be able to demonstrate compliance. A written record of why your reject button has equal visual weight to your accept button is the kind of evidence that mitigates fines.
• Run the DarkDialogs feature checklist as a standing item in your quarterly privacy review, particularly after any CMP update or A/B test that touches the consent dialog layout.
• Treat CMP default settings as a liability risk, not a compliance shortcut. The study shows that default configurations are the primary vector through which dark patterns enter production environments.

The DarkDialogs study does not introduce new legal obligations. It quantifies how systematically existing obligations are being ignored — and provides regulators with the technical infrastructure to act at scale. Controllers who treat cookie consent as a checkbox exercise are now operating in an environment where that checkbox can be audited automatically, accurately, and at industrial scale.