Most cookie banner decisions are already over before a visitor has finished reading the first sentence. A field study of 82,890 real website visitors, published at ACM CCS 2019, found a median time of just 4 to 8 seconds between a banner appearing and a visitor clicking accept, reject, or dismiss. That number holds up as the largest, most rigorous dataset available on this exact question, and it explains a lot about why cookie consent still looks the way it does in 2026.
How long does it actually take to decide on a cookie banner?
The median decision time across every notice type tested was 4 to 8 seconds, measured from page load to a visitor clicking any interactive element on the notice. Researchers Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz logged real interaction events on a German e-commerce site over four months, covering 82,890 unique visitors across three separate experiments. Because the timestamps came from actual clickstream logs rather than a lab or a survey, the numbers reflect what visitors do, not what they say they would do.
Figure 1: Outcome of a bottom-left binary cookie banner shown to mobile visitors, non-nudging condition. Source: Utz et al., ACM CCS 2019, Experiment 2, roughly 4,000 visitors per condition (n=36,530 total).
Most visitors in that binary-choice condition never clicked anything at all. The 44.7% who took no action either left the page, scrolled past the notice, or kept browsing while it sat unresolved, which is its own kind of decision even though it produces no explicit consent record. The 4-to-8-second window belongs to the visitors who did click something, and it is short enough that reading the banner’s text in full is unlikely for most of them.
Does banner position change how long visitors take to engage?
Position determines whether a cookie banner gets touched at all, more than any other design factor tested. A notice placed in the bottom-left corner of the screen was interacted with by 37.1% of visitors regardless of device or the choice offered, while a full-width bar at the top of the page was interacted with by only 2.9%.
Figure 2: Share of visitors who clicked any element on the notice, by screen position. Source: Utz et al., ACM CCS 2019, Experiment 1, n=14,135.
The researchers point to two likely causes. A bottom-positioned notice is more likely to physically block part of the page content a visitor wants to reach, prompting a faster, more deliberate click just to get it out of the way. A left-aligned notice also sits closer to where left-to-right readers naturally scan first. Device and screen size mattered too: on desktop, only 5.5% of visitors with a screen resolution of 1,920 by 1,080 pixels or higher ever interacted with a notice, compared with an average of 25.6% on smaller screens, since a bigger monitor leaves more room for the banner to sit unobtrusively in a corner. Ad blocker use had a smaller effect, at 12.6% interaction versus 15.8% for visitors without one.
A banner in a visitor’s way gets a fast reaction. A banner in a corner of a large monitor gets ignored.
Why do granular cookie choices take almost twice as long?
Notices that let visitors turn categories or specific vendors on and off individually took a median of 7 to 8 seconds to resolve, compared with 4 to 5 seconds for a no-option, confirm-only, or plain binary accept/reject notice. That gap makes sense: scanning a list of toggles and deciding what to keep takes longer than clicking one of two buttons.
What is more revealing is how rarely anyone actually uses that extra time to make a real selection. In the granular conditions, only 0.1% to 4% of visitors who saw category- or vendor-level controls chose specific options rather than accepting or declining everything at once.
Figure 3: Granular notices roughly double the time to a decision. Source: Utz et al., ACM CCS 2019, reported as 4-5 seconds and 7-8 seconds; chart shows range midpoints.
The researchers also audited 1,000 real consent notices sampled from 5,087 collected across the EU and found that 86% offered nothing but a bare confirmation button, no reject option at all, meaning the 4-to-8-second decision most visitors face is rarely a genuine choice between meaningfully different outcomes to begin with.
Granular controls cost visitors extra seconds that almost none of them spend on granularity.
Do pre-checked boxes make consent happen even faster?
Pre-selecting cookie categories by default turns a slow, deliberate opt-in into a near-instant rubber stamp. External validation data from Cookiebot, covering more than 3 million real visitor sessions, found a 5.59% accept rate for cookie categories when none were pre-checked, against a 98.84% accept rate when every category was pre-checked by default.
| Default state | Accept rate | Sessions measured |
|---|---|---|
| No categories pre-selected | 5.59% | 1,135,090 |
| All categories pre-selected | 98.84% | 1,988,681 |
Source: Cookiebot dataset, cited in Utz et al., ACM CCS 2019, as external validation of the paper’s own category-notice findings.
Figure 4: A single default-checkbox setting swings the measured accept rate by more than 90 percentage points. Source: Cookiebot dataset via Utz et al., ACM CCS 2019 external validation.
A related lab study by Nouwens et al. at CHI 2020 found the same lever works in a controlled setting: removing the opt-out option from a consent pop-up’s first page increased measured consent by 22 to 23 percentage points among 40 study participants. The same paper’s broader web audit found only 11.8% of the top 10,000 UK websites met minimal legal consent requirements when it scraped 680 live consent tools in 2019. A pre-checked box does not just save a visitor time, it produces a very different, and far less meaningful, kind of accept rate. Publishing a clear cookie policy generator alongside a banner that defaults to opt-out, rather than opt-in, keeps the disclosure honest even when the interface is nudging visitors toward accepting.
Has cookie banner compliance improved since GDPR started?
Figure 5: Compliance research milestones since GDPR enforcement began. Sources: Degeling et al.; Utz et al., ACM CCS 2019; Nouwens et al., CHI 2020; CHI 2025 cross-country study cited in our companion cookie consent post.
Not by much. Degeling et al. found cookie consent notices on popular EU websites rose from 46.1% in January 2018 to 62.1% shortly after GDPR enforcement began in May 2018, but simply showing a notice is not the same as showing a compliant one. Nouwens et al.’s CHI 2020 audit found only 11.8% of the top 10,000 UK sites met minimal legal requirements. Five years later, our own cookie consent statistics for 2026 covers a 2025 study of 254,148 websites across 31 countries that put minimal compliance at just 15%. More sites show a notice than ever before; the share that does it correctly has barely moved.
The 4-to-8-second decision window has stayed remarkably stable across this entire period, which suggests the problem is not that visitors need more time. It is that most of the banners they see are not designed to give them a meaningful choice within that time.
How the numbers compare across notice types
| Notice complexity | Examples | Median decision time |
|---|---|---|
| Simple, 1-2 options | No-option, confirm-only, binary | 4-5 seconds |
| Granular, multiple options | Category-based, vendor-based | 7-8 seconds |
| All notice types combined | Full 82,890-visitor dataset | 4-8 seconds |
Source: Utz et al., ACM CCS 2019.
Warning
Treat 4 to 8 seconds as the best available field measurement, not a fixed constant. It comes from one German e-commerce site studied across three experiments between November 2018 and March 2019, using clickstream logs rather than eye-tracking, so it captures when a visitor clicked, not necessarily how long they spent looking at the text before clicking. No larger or more recent field study of this kind has replicated the measurement at comparable scale, which is itself worth flagging rather than glossing over.
The Bottom Line
Visitors decide on a cookie banner in about the time it takes to read a headline, not a document. The median 4-to-8-second window holds across notice types, and the extra seconds a granular notice demands are rarely spent making a granular choice: 86% of real banners do not even offer a genuine reject option, and pre-checked defaults can push an accept rate from under 6% to nearly 99% without changing the underlying question at all. For site owners, the practical lesson is that banner design, not visitor patience, sets the outcome. A banner that states its purpose plainly, offers a real reject button, and defaults to opt-in rather than opt-out produces consent that will hold up to scrutiny, in roughly the same handful of seconds a weaker banner takes to produce consent that will not.
Frequently Asked Questions
How long do users actually spend deciding on a cookie banner? The median time from a banner loading to a visitor clicking any button is 4 to 8 seconds, according to a field study of 82,890 real website visitors published at ACM CCS 2019. Simple accept/reject notices land at the low end, granular category notices at the high end.
Does banner position change how many people even touch it? Yes. A bottom-left dialog notice was interacted with by 37.1% of visitors, versus just 2.9% for a full-width bar at the top of the page, in the same 14,135-visitor position experiment.
Do pre-checked boxes make cookies get accepted faster? Dramatically so. Cookiebot’s dataset of over 3 million sessions found a 5.59% accept rate for cookie categories when none were pre-selected, versus 98.84% when all categories were pre-checked by default.
Are cookie banners more compliant now than when GDPR started? Barely. Only 11.8% of the top 10,000 UK websites met minimal legal consent requirements in 2020, and a 2025 study of 254,148 EU sites still found just 15% minimally compliant, five years later.
Sources and References
- Utz, Degeling, Fahl, Schaub, and Holz. (2019). “(Un)informed Consent: Studying GDPR Consent Notices in the Field.” ACM CCS 2019. Field study of 82,890 unique visitors across three experiments, plus a manual audit of 1,000 consent notices sampled from 5,087 collected across the EU.
- Nouwens, Liccardi, Veale, Karger, and Kagal. (2020). “Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence.” CHI 2020, ACM. Audit of 680 consent tools among the top 10,000 UK websites, plus a 40-participant field experiment.
- Degeling, Utz, Lentzsch, Hosseini, and Schaub. (2019). “We Value Your Privacy … Now Take Some Cookies: Measuring the GDPR’s Impact on Web Privacy.” NDSS 2019. Measurement of consent notice prevalence across 6,579 popular EU websites, January to May 2018.
Note: All figures verified as of September 2026. The core timing dataset dates to a 2019 field study; no larger-scale replication has published more recent per-second timing data, so this figure is refreshed with newer compliance and adoption data at least twice a year while the underlying decision-time measurement remains the best available.
