Between Compliance and Illusion: A Comparative Study of Cookie Consent Mechanisms Across Regulatory Frameworks

To understand the challenges of cookie banners and consent, it is necessary to review the technical and legal basis for online data collection [9]. In this section, we will first present the role of cookies and how they function, then discuss the regulations regarding consent, and conclude with a comparison of the regulatory frameworks between the five countries selected: France, Germany, the United States, Japan and Morocco.

2.1 Definition and functioning of cookies

Cookies are small data files that are stored on the browsers of the user. The main purpose of cookies is to facilitate user navigation by storing information about preferences, for example [9]. However, over time, they have been used for other purposes. Nowadays, they are a very important tool for understanding how users behave online and for advertising [2].

Table 1 shows some types of cookies and their functions.

Technically, cookies are typically created and understood by the browser. They can be created by JavaScript or sent in the HTTP header by the server. Certain cookies are destroyed as soon as the session is terminated, while others can linger on for months or even years. Visibility and destruction of cookies depend on browser options, but most individuals have no idea of their existence or operation [10].

Table 1. Types of cookies according to their function [10]

2.2 The concept of consent in the context of data protection

Whether through cookies or any other means, the collection of personal data from online users is very strictly regulated in terms of consent. The GDPR [4], which came into force in May 2018 in the European Union, stipulates in Article 4 that "Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her" [11].

This definition implies a number of cumulative conditions [11]:

1. Consent must be freely given: this implies that users must give their consent without any pressure. Also, the provision of services must not be conditional on the acceptance of cookies.
2. Consent must be specific: users must know which cookies they wish to accept, for instance, advertising or analytical cookies, etc.
3. Consent must be informed: users must be provided with clear, coherent, and accessible information, especially concerning the aim and objectives of data collection.
4. Consent must be unambiguous: it cannot be obtained solely through silence, continued browsing, or a pre-checked box.

In addition, if the user wants to refuse, the action must be simple and visible, as is the case for acceptance, in accordance with the recommendations of the Commission Nationale de l’Informatique et des Libertés (CNIL) [12], and other data protection authorities. Any alteration to the interface or design, such as hidden buttons or the use of less visible colors, can be interpreted as a violation, known as “dark patterns.” This is a way of manipulating the user into making a decision that is contrary to their interests [13].

2.3 Legal frameworks in the five countries studied

2.3.1 France

France, as part of the European Union, applies the GDPR. It also has a very active supervisory authority, known as the CNIL [12]. In addition to the requirements of the GDPR, CNIL guidelines specifically regulate cookies. For example, refusing cookies must be as easy as accepting them, consent must be explicit, and no non-essential cookies may be present before the user has made a choice. The CNIL conducts regular checks and has already imposed significant penalties on several companies [14].

2.3.2 Germany

Germany also applies the GDPR, like France, as well as the ePrivacy Directive. What sets this country apart is its culture of protecting the privacy of online users, which is deeply rooted in its history, as well as the rigor of its authorities [11]. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) and regional authorities (Länder) enforce strict oversight, and German users are generally better informed about their rights. This results in websites that are more compliant and a more faithful adherence to the principles of the GDPR [15].

2.3.3 United States

In the United States, there is no single, comprehensive law like the EU's GDPR. However, there are several federal and state laws regulate data protection and safeguard the privacy of online users. The most advanced law is the CCPA [4], which grants online users certain rights, including the right to delete or opt out of sharing their data. Since there is no mandatory cookie banner at the national level, this leads to a wide variety of practices, often unsafe, particularly outside California [16].

2.3.4 Japan

Japan has laws such as APPI [5] that mandate certain obligations for the protection of users' data online, in particular when shared with third parties. However, the law is generally viewed as more flexible than the GDPR, as its requirements have a tendency to be less specific. Cookie banners are present on some websites, but the concern remains that their content is often too vague, and it is rare to find granular consent. There is a Japanese supervisory authority, the Personal Information Protection Commission (PPC) [16], which issues recommendations but exercises less strict control than in Europe.

2.3.5 Morocco

In 2009, Morocco adopted Law 09-08 [6] to regulate the personal data protection, requiring clear user consent before collecting any personal data, including cookies. The National Commission for the Control of PPC oversees the law's application. On paper, Morocco has a framework closely mirrors the GDPR; in practice, however, enforcement is weak, and most Moroccan websites lack compliant or even visible cookie banners. Digital players largely ignore the issue, and official oversight is minimal [16].

2.4 Comparative summary

Table 2 summarizes and presents the significant differences identified between the countries studied in terms of cookie consent.

Table 2. Comparison of legal frameworks for cookie consent

According to Table 2 we can see that despite having the same legal basis, France and Germany differ in the strictness of their enforcement. The U.S. still very tolerant. It has no rigorous federal structure. Japan and Morocco, have taken an intermediate and still evolving approach.

This study uses a comparative approach to determine if websites are truly willing to follow user preferences regarding the acceptance or rejection of cookies. Our approach combines technical analyses with a detailed analysis of local regulatory requirements in the five selected countries, which have different approaches to user privacy on the Internet.

4.1 Website selection

The Tranco list was used to select most of the websites analyzed in this study, which incorporates several popularity rankings to minimize the bias associated with a single source. Websites from each country studied, namely France, Germany, the United States, Japan, and Morocco, were ranked according to their country code top-level domain (e.g., .fr, .de, .jp, .ma).

Subsequently, websites were automatically classified into five functional categories—media, e-commerce, health, education, and public administration—using heuristic rules based on domain names. Sites in each category were tested according to their Tranco ranking until a fixed number of accessible sites was reached. Sites that were not accessible or that caused technical errors were removed from the final corpus.

In the case of Morocco, the number of accessible websites in the Tranco list is insufficient for certain categories. In order to ensure comparable coverage across categories, we have added a limited number of additional sites. The sites selected are widely used public and private services that have a national domain (.ma) and strictly correspond to the categories studied. All these sites underwent the same automated testing protocol as those from the Tranco list.

4.2 Experimental environment and geolocation

The Chromium browser was employed during the testing process, which was automate with the use of the Playwright library to provide a real-world browsing experience. The testing occurred in a protected environment, where each test was conducted on a new session of the Chromium browser that had not been cached or had any previous cookies.

To take into account the different ways that consent and tracking are done throughout countries, all measurements were done through country-specific VPN's. Therefore, for each series of tests, a Proton VPN server that was physically located in the country being tested was activated. This approach allows us to observe consent interfaces and technical behaviors as they are actually presented to local users.

Some sites are known to detect or block VPNs. However, this effect is considered similar across the countries studied and therefore does not introduce significant bias into the comparison.

4.3 Automated test procedure

To enhance the understanding of the experimental protocol, Figure 1 demonstrates the various phases of the automated procedure for assessing consent mechanisms.

Figure 1. Diagram of the automated process for evaluating cookie consent mechanisms

For each website, the homepage was accessed via HTTP or HTTPS protocols, with requests repeated to minimize the risk of errors caused by loading issues. We then waited a few seconds to ensure that all banners were properly displayed and scripts were activated.

We then performed an initial collection of trackers. A consent banner was detected when text regarding the use of cookies was associated with visible action buttons (e.g., «Accept», «Reject», or «Settings») on the page.

The user simulated an interaction as much as possible by clicking the link corresponding to the option to reject. A new collection of trackers was then implemented, with the aim of identifying persistent cookies after refusal.

In this way, it will be easy to compare the traces collected before the interaction with those that exist afterward, thereby determining to what extent the user’s choice is implemented from a technical standpoint.

4.4 Detection of third-party trackers and deceptive design patterns

Third-party cookies were identified based on their domains by cross-referencing domain discrepancies (where the cookie’s domain does not match the website’s main domain) with a list of the most commonly used tracking services (Google Analytics, Facebook, Criteo, Taboola, Hotjar, etc.).

In addition, several dark patterns are identified by heuristic rules. For example, on some sites, the "Accept" button is highlighted in terms of color or size, while the "Reject" option appears less accessible or requires several additional clicks to reach. Other interfaces rely on visible checkboxes or ambiguous wording that can be misleading. More subtly, the outright absence of an explicits opt-out option or the use of implied consent is also encountered.

These examples illustrate the main dark patterns identified in this study. This approach is not intended to be exhaustive, but rather to highlight fairly obvious mechanisms that may influence the user’s choice.

4.5 Construction and calculation of the Cookie Compliance Score

By summarizing these observations collaboratively, a CCS was calculated for each website. This binary score, ranging from 0 to 5, is derived from five binary criteria designed to cover the most critical aspects of the technical robustness of cookie consent mechanisms.

The selection of these criteria is based on both regulatory principles and existing research on consent mechanisms. More specifically, the GDPR requires that consent be freely given, specific, informed, and unambiguous. The selected criteria were therefore defined to verify whether websites technically respect the user’s choice. In particular, they include the absence of third-party cookies prior to obtaining consent, the presence of a clear and accessible opt-out options, the absence of implied consent or pre-checked options, as well as the presence of a visible opt-in option.

A website that meets each criterion receives a score of 1; otherwise, it receives a score of 0. Another decision made was to avoid gray areas as much as possible in order to ensure a simple and reproducible evaluation. These criteria are combined to provide a summary measure (the CCS) for each site, making it easier to compare the differents sites examined.

The purpose of the CCS is not to assess whether websites are legally compliant or not, but rather to quantify the gap between the consent expressed by the user and the tracking practices deployed. Thus, a low score indicates that the user’s choice and the site’s technical behavior are more likely to be inconsistent, which could be associated with a higher risk to privacy and personal data protection.

4.6 Collection, traceability, and ethical considerations

All results are recorded in a CSV/Excel file, accompanied by a detailed log summarizing all browsing activity, cookies found, actions performed, and any errors that occurred. This ensures that experiments can be reproduced and that results data can be consulted retrospectively.

The research focused exclusively on public websites, with no interaction between websites and user accounts and no personal data. No individual information was retrieved during the test. The detailed automated data collection protocol is provided in Appendix.

6.1 Effect of the regulatory framework and institutional pressure

These highlight the considerable differences between the countries analyzed, suggesting a strong correlation between the regulations to which they are subject and the level of compliance observed. France and Germany obtaining high scores has bolstered the idea that there exists a positive correlation between a stringent regulatory environment, such as the GDPR, and the procedural implementation of explicit consent mechanisms.

One could see this as coercive isomorphism being manifested through institutional theory. Organization operating in highly regulated environments tend to adopt compliant practices in order to avoid legal or reputational sanctions. The significant differences observed between European Union countries and non-EU countries can be taken as an indication of the structural effect of regulatory constraints in the development of these methods of formalizing consent management systems.

However, caution should be exercised in interpreting the causal conclusions drawn. This article highlights strong correlation between the regulatory context and observed compliance, but other variables, such as digital maturity, societal pressure, and organizational culture, may also explain some of the differences observed.

6.2 Sectoral differences and economic incentives

Analysis by category reveals that educational and government websites generally show higher compliance with laws and regulations compared to economic sectors like media and e-commerce. One reason for this could be different incentive structure. Public institutions, usually, not only have stricter transparency requirements, but they are also subject to stronger institutional controls which may lead to the implementation of compliant mechanisms.

However, sectors that rely primarily on behavioral advertising and datas revenue may face a strategic trade-off between formal compliance and more effective value creation. The collection of behavioral data is the key lever for value creation in the media and e-commerce sectors. Consequently, the design of consent mechanisms is influenced by the desire for maximum acceptability, rather than the administration of a perfectly neutral choice.

These findings are consistent with research on data governance and the tensions between legal compliance and digital business models.

6.3 Formal compliance and dark patterns: The paradox of regulation

One of the most striking aspects of this study concerns the coexistence, in certain countries, of a high level of formal compliance and a high incidence of dark patterns. European countries, which have the highest average scores, also have the highest rates of potentially manipulative design mechanisms.

This phenomenon can be interpreted as one type of “strategic compliance” or “regulatory gaming.” For example, if the regulation requires the explicit inclusion of both accept and decline buttons, the designer can be getting the formal part of the rule right though at the same time designing the choice architecture in a way which will influence the user's choice. This first is related to the studies done on nudge theory and choice architecture which highlight that the way options are presented can be a major factor in the decision-making of people even those who explicitly consent.

It could therefore be said that regulation has a paradoxical effect: the higher the level of procedural compliance, the more sophisticated the influencing strategies. This confirms that, at all times, there is a fundamental distinction between formal compliance (compliance with the written requirements of the rules) and substantive compliance (compliance with the principles of the GDPR and the principles of decision-making autonomy).

6.4 Implications for regulation and interface design

This study shows that privacy laws should require not just consent banners but also stipulate exact specifications on user interface design. Just making choices visible is insufficient, as this may lead to only shallow or strategic compliance behaviors ("compliance" here being the minimum threshold of behavior required for sites to meet their requirements whilst still manipulating users' decisions).

The research results particularly highlight the necessity of enforcing principles such as visual neutrality, equal visibility of the accept and refuse options, and banning manipulating interfaces. From this point of view, the elaboration of automated auditing instruments that facilitate the assessment of interface compliance has a huge potential to significantly improve the regulatory control effectiveness.

Besides the regulatory and ergonomic issues, these findings also reveal serious safety and data protection challenges. If consent mechanisms are poorly designed, especially when third-party cookies are involved, users may be more exposed to cross-site tracking, profiling of their habits, and leaking of data to external players. And when, on the technical side, the choices expressed by users are not effectively implemented, a gap arises between what they think they have decided and what the system does. This may then be seen not only as a compliance issue but also as a security vulnerability.

Opening up the discussion, this paper is one of the wider discourses that discuss digital regulation efficiency. On one hand, legal frameworks can really help enforcement; however, they are not guaranteed to be successful protection of user freedom. For future regulations, this is a very good point for consideration of behavioral, ergonomic, and technical issues, including safety ones.

6.5 Interpretive synthesis

Overall, the findings suggest that user-consent levels for cookie-consent tools that ask users for their permission differ significantly not only between various legal systems but also between different industries. We can observe formal compliance practices more frequently in the well-supervised scenarios. Yet, it is such cases only where the greatest number of design-based ways of obtaining users' consent can be found. On the whole, people tend to be more compliant with rules in public places than in private shops, which may be a reflection of different levels of institutional pressure and incentives for organizations.

Besides highlighting the difficulty of measuring compliance in the digital world, these results emphasize that the presence of a rule alone is not sufficient for its success. Besides merely existing, a regulation's effectiveness hinges on the capacity to give clear guidance to the interface methods and the corresponding technical solutions.

Therefore, the CCS can be considered a measure of how well the user's consent expression is aligned with the system's permission. A high score reflects well-designed consent-gathering methods. On the other hand, a low score points to a strong discrepancy between users' understanding of their choices and the reality of the tracking behavior.

But these differences, however, are not only rule-breaking issues; in fact, they can become threats to data protection as well. It is a fact that non-compliant consent collection can be a cause of cross-site tracking, marketing-oriented tracking, and data exposure to resource pools. Therefore, CCS is not simply narrative description but also a way to discover privacy and security challenges brought about by particular conducts.

Therefore, the CCS may be considered a reflection of the degree of alignment between what users have declared as their consent and what the system actually allows them. A high score indicates that the consent collection methods employed are appropriate. Conversely, a low score implies that there is a significant divergence between user-perceived choices and the actual tracking methods used. But beyond just rule compliance problems, these misunderstandings can even endanger data protection. Indeed, not adhering to consent collection guidelines can result in cross-site tracking, marketing tracking, and even data leaks to resource pools. Hence, the CCS is not only a way of describing matters but it is also a means to identify privacy and security issues linked with human behaviors.

6.6 Study limitations

Although this study is wide-ranging and comparative in nature, it nonetheless has certain limitation that must be highlighted in order to interpret the results with caution.

First, this analysis is based on automated data collection carried out at a specific point in time. However, cookie consent collection mechanisms are constantly changing and can evolve very quickly due to technical update, regulatory changes, or court decisions. This is therefore a snapshot of current practices and in no way a permanent state of affairs. A longitudinal study would be needed to analyze the evolution of compliance strategies and the effect of regulations.

Subsequently, the choice of sites is based primarily on the Tranco site ranking, supplemented to achieve a fixed number of samples per category and per country. While this approach has the merit of covering most of the most visited sites, it is not without bias. Indeed, the habits of high-traffic sites, which can rely on often large technical teams, may differ from those of small structures or sites with a local audience. Care must therefore be taken not to extrapolate the findings beyond the sites selected in each country.

The sample utilized for some countries has another constraint; i.e. the sample chosen for Morocco is limited by the daily selection method used to identify the websites in the sample. Because the chosen websites do not represent the larger national web ecosystem, the results from the Moroccan websites should be used with caution and compared directly with results from other countries.

Secondly, the CCS and dark pattern detection are based on criteria defined in the literature and recommendations issued by regulatory authorities. While they enable standardized and reproducible compliance measurement, they necessarily simplify the complexity of digital interfaces. There are some subtle things, such as a slightly different visual hierarchy, typography detail, lexical choices, and animation dynamics, that content detection software may simply not catch. Conversely, features that are identified as potentially indicative of manipulation may actually be the result of technical limitations rather than intentional strategic decisions.

Furthermore, the study focuses mainly on what is visible in terms of user interface compliance. It does not assess backend compliance, particularly in the case of pre-buffering, to ensure that non-essential cookies are effectively blocked after consent has been refused. The network level (firewall, proxy, clicking on the cross, etc.) would need to be checked to verify that clicking on “refuse” has been taken into account.

Another limitation is that it does not take into account aspects such as digital culture, users' level of awareness of data protection, or the intensity of the actual enforcement of sanctions by country. These differences can be explained by institutional and sociocultural factors, which may be a avenue for future research.

Finally, although significant differences were observed between countries and sectors, this study is essentially limited to a descriptive comparative approach. To substantiate such a causal relationship between the regulatory framework and the level of compliance, it would be necessary to go further in the statistical analyses and use more explanatory variables.

Beyond these weaknesses, this study provides a consistent comparative mapping of current methods for obtaining consent for cookies and represents a rich source of information for future research, whether it concerns the evaluation or monitoring of the implementation or effectiveness of data protection policies.