Security & Privacy
How many cookie consent banners are clicked every day? (EU)
A live estimate of GDPR cookie consent prompts shown to EU internet users today
Roughly 13K clicks every second.
Source: Legiscope 2023 analysis; GDPR/ePrivacy Directive. View on dashboard →
The pop-up that cost the EU €14 billion in productivity
GDPR forces cookie banners on every EU site visit. Legiscope (2023): 404 million EU users see ~1,020 banners per year, 5 seconds each. That's 575 million hours per year, €14.4 billion in lost productivity. 287,500 full-time workers doing nothing but clicking "Accept."
What cookie consent actually gives you - and what it doesn't
You have seen this banner thousands of times. A box appears. It says something about cookies and privacy. You click "Accept all" because rejecting or customising takes three more clicks. A study by the Norwegian Consumer Council found that dark patterns in cookie banners were specifically designed to make rejection harder - and it works: acceptance rates exceed 90% on many major sites despite GDPR's intent.
What you are actually consenting to when you click "Accept all" is the deployment of tracking cookies that follow your behaviour across hundreds or thousands of sites, building a profile used to target advertising. The consent is genuine in legal terms. Whether it is meaningful in practical terms is a different question - most users have no idea what they just agreed to.
The alternative - clicking "Manage preferences" - can take 30 seconds or more, and the interface is often intentionally confusing. Researchers at MIT found the median time for users to navigate cookie preference panels was 76 seconds. Across a billion daily banners, that represents an enormous collective tax on human attention.
Cookie banners vs. the ads they were designed to regulate, today
Cookie banners and ads compete for the same fraction-of-a-second of user attention. Both are a product of the online tracking ecosystem the GDPR was designed to regulate.
How GDPR created an industry of compliance theatre
- 2011EU ePrivacy Directive (Cookie Law) requires consent for non-essential cookies; first wave of basic cookie banners
- 2018GDPR effective May 25; cookie consent requirements tighten; banners multiply across EU websites
- 2019CJEU Planet49 ruling: pre-ticked cookie consent boxes unlawful; banners must request active consent
- 2022Belgian DPA rules IAB TCF violates GDPR; forces redesign of consent flows for 40,000+ websites
- 2023Legiscope: EU users spend 575 million hours/year on cookie banners; €14.4B productivity drain
- 2026IAB TCF v2.3 compliance deadline; ePrivacy Regulation (proposed replacement for Directive) still pending EU Parliament approval
Key cookie banner statistics
EU internet users collectively spend 575 million hours per year clicking cookie banners, equivalent to €14.4B in lost productivity
LegiscopeThe average EU internet user encounters ~1,020 cookie banners per year (100 sites/month × 12 months × 85% banner rate)
LegiscopeOver 40% of European websites use a Consent Management Platform (CMP); GDPR compliance is the primary driver
Norbert Pohlmann Institute / arXivWhen a "Reject All" button is equally prominent as "Accept All", ~60% of users reject; when rejection requires extra clicks, ~90% accept
Norbert Pohlmann Institute / arXivIAB's TCF framework, used by over 40,000 websites, was itself ruled GDPR non-compliant by the Belgian DPA in February 2022, forcing a major redesign
Consent ObservatoryCookie banner volume since GDPR enforcement began
Cookie banners became mandatory across the EU after the GDPR came into force in 2018, and the collective time Europeans now spend clicking them has grown to over 575 million hours per year, roughly the GDP equivalent of a small country.
| Year | Rate | Est. per day | Context |
|---|---|---|---|
| 2018 | 50K/min | 72M | Pre-enforcement; banner quality inconsistent |
| 2020 | 120K/min | 173M | Banner proliferation; enforcement begins |
| 2023 | 783K/min | 1.1B | Mature banner regime; enforcement peak |
| 2027 (forecast) | 266K/min | 383M | More countries adopting GDPR-style regulations; banner interactions grow |
The GDPR consent theatre: why cookie banners cost €14 billion per year
The cost of consent
Cookie banners were not anticipated by GDPR drafters as a meaningful burden. The regulation was designed to prevent silent data harvesting, not to require active acknowledgement of every page load. However, the combination of broad consent requirements, advertising-driven business models, and a lack of standardised browser-level consent mechanisms resulted in an explosion of banner implementations. The GDPR's 'freely given, specific, informed and unambiguous' consent standard, strictly interpreted, precludes pre-ticked boxes and bundled consents, leading to complex multi-layer designs that slow page loads and frustrate users.
Dark patterns and enforcement
Multiple studies have documented widespread dark pattern use in cookie banners: burying "Reject All" behind multiple clicks, using bright colours for "Accept" and grey for "Reject", presenting walls of legal text, and pre-selecting all cookies. French regulator CNIL and the Spanish AEPD have fined companies including Google, Facebook, and Microsoft for non-compliant consent mechanisms. The shift toward stricter enforcement, combined with browser-based consent proposals like Privacy Sandbox, may eventually reduce the banner burden, but compliance complexity continues to grow.
Research data
| Year | Finding | Value | Source |
|---|---|---|---|
| 2018 | GDPR takes effect May 25, 2018; cookie banners proliferate across EU websites; initial enforcement light | GDPR effective date | Consent Observatory |
| 2020 | Large-scale study of cookie banner design patterns; ~95% of top EU websites have a consent banner; dark patterns widespread | 95 % of major EU sites with banner (2020) | Norbert Pohlmann Institute / arXiv |
| 2022 | Belgian DPA rules IAB TCF violates GDPR; 40,000+ websites must redesign consent flows; enforcement accelerates across EU | Enforcement milestone 2022 | Consent Observatory |
| 2023 | Legiscope: 404M EU internet users × 1,020 banners/year × 5 seconds = 575 million hours/year; €14.4B productivity loss | 575M EU hours/year on cookie banners (2023) | Legiscope |
| 2024 | IAB TCF Compliance Report 2024: ongoing monitoring of CMP compliance; TCF v2.2 adoption complete; TCF v2.3 update due 2026 | TCF compliance status 2024 | Consent Observatory |
In perspective
575 million hours/year is equivalent to 287,500 full-time employees doing nothing but clicking cookie consent buttons all year
At €14.4 billion annually, EU cookie banner compliance costs more than the GDP of several small European nations
How the number is calculated
Legiscope 2023 analysis: 404 million EU internet users × 1,020 banners/year = 412 billion interactions/year ÷ 31,557,600 seconds = approximately 13,054 banner clicks/second. Converting to hours of time: 412 billion × 5 seconds ÷ 3,600 = 575 million hours/year. The 1,020 banners/year estimate uses 100 sites/month × 12 months × 85% showing banners.
Sources used: Consent Observatory - EU Cookie Consent Research - A Large-Scale Study of Cookie Banner Interaction Tools and Their Impact on Users' Privacy - Legiscope - Cookie banners: 575 million hours. Full methodology: methodology page.
Frequently asked questions
- How many cookie banners does the average EU user click per year?
- A Legiscope 2023 estimate calculates approximately 1,020 cookie banner interactions per EU internet user per year, based on visiting ~100 websites/month and ~85% of those displaying a consent banner. At 5 seconds per banner, that totals ~1.42 hours per year per user.
- How much productivity does the EU lose to cookie banners?
- Legiscope estimates 575 million hours per year of EU citizens' time spent on cookie consent interactions, worth approximately €14.4 billion in productivity at the average European hourly wage of €25. This is roughly 0.10% of total EU GDP.
- Do users actually read cookie banners before clicking?
- Research consistently shows the vast majority do not. Studies find that when a "Reject All" button requires extra clicks vs. "Accept All", acceptance rates jump from ~40% to over 90%. Dark patterns (asymmetric button placement, pre-ticked boxes, buried reject options) manipulate consent, which is why regulators have been imposing increasingly strict design requirements.
Why trust this data
The 575 million hours figure comes from Legiscope's 2023 analysis, a leading GDPR compliance and technology firm. Their methodology is transparent and has been cited by the European Data Protection Board (EDPB) and referenced in EU Parliament discussions about the ePrivacy Regulation. The €14.4 billion GDP cost figure uses Eurostat average EU hourly wage data.
Sources
Consent Observatory - EU Cookie Consent Research - A Large-Scale Study of Cookie Banner Interaction Tools and Their Impact on Users' Privacy - Legiscope - Cookie banners: 575 million hours.
Explore related statistics: Phishing emails - Online scam victims - Ads blocked, and the live AnythingCounter dashboard.