Cookie consent rates: what to expect with an honest banner

With a banner that shows Reject all next to Accept all, most sites see between roughly 55 and 75 percent of visitors who make a choice accept non-essential cookies, with France at the low end and Eastern Europe at the high end. Anyone promising 90 percent with a compliant banner is measuring something else, or the banner is not compliant. Here are the numbers that have been published, where they come from, and the levers that move them without crossing into the designs regulators have fined.

What the published studies say

The CNIL's own survey (France, 2019 to 2022). The CNIL commissioned five waves of surveys from IFOP, each with more than 1,000 people representative of the French population. In June 2022, 59% of respondents said they accept cookies and 39% refuse; 49% said they configure their choices, up from 43% in November 2020. Younger users refuse less (34% of under-35s against 41% of over-35s). Audience measurement was accepted by 61%, targeted advertising by 52%. The CNIL's comment: the acceptance rate "remains high", refusal "has not become the majority". These are declared behaviours, not measured clicks, but they are the only regulator-run numbers available.

Didomi's benchmark (consent platform data, 2025). A consent platform's data on its own customers, published in early 2026 for banners displayed during 2025: consent rates from 75.1% in Western Europe to 89.3% in Eastern Europe, with the British Isles at 87.3%, Northern Europe at 84.8% and Southern Europe at 82.5%. France sits at 71% and pulls the Western figure down. Didomi defines the opt-in rate as the number of opt-ins over the number of banners displayed. Vendor benchmarks are useful for comparing regions, less so as an absolute: the customer mix and the banner designs are the vendor's, and a visitor who ignores the banner counts in the denominator.

Nouwens and colleagues (CHI 2020). The most cited academic study scraped the five most popular consent platforms on the top 10,000 UK websites and ran an experiment with real users. Only 11.8% of the sites met minimal legal requirements; only 12.6% had a Reject all button on the first page. In the experiment, 55.2% of participants chose Accept all and 34.1% Reject all when both were offered. Removing the Reject all button from the first page increased the probability of consent by 22 to 23 percentage points, and offering more granular options on the first page lowered it.

Utz and colleagues (CCS 2019). A field study with more than 80,000 users of a German website found that position matters (notices in the lower left of the screen got the most interaction), that a binary choice gets more acceptance than per-category or per-vendor choices, that nudging through highlighted buttons and pre-checked boxes has a large effect, and that in an opt-in setting where nothing was pre-selected, fewer than 0.1% of visitors allowed cookies for all purposes.

Put together: a compliant banner in France lands near 60 to 70 percent acceptance among those who choose; the same banner in the UK or Northern Europe lands higher; a banner that hides the refusal adds 20 points and the risk of a fine.

What is a "good" rate?

The question assumes acceptance is the goal. For a regulator, the goal is a free choice, and a rate near 100 percent is evidence against you. For a site owner, the useful number is the share of visitors who make any choice at all, and whether analytics and advertising still produce usable data at the rate you get. The CNIL survey suggests a floor: when visitors are asked plainly, roughly four in ten say no.

Levers that are legitimate

• Clarity. One sentence that says what you use cookies for, with plain purposes, outperforms a legal paragraph. Visitors who understand the trade accept more often than visitors who feel tricked.
• Fewer categories on the first screen. Both studies found that granular choices on the first layer lower acceptance. Keep Accept all, Reject all and Customize on the first layer; put the categories behind Customize. Regulators ask for the same structure.
• Language. A banner in the visitor's language. Cookiequiet picks from 24 languages based on the browser.
• Position and layout. Utz found more interaction with notices in the lower part of the screen; a centred modal gets a decision faster but is more intrusive. Test both; measure the share of visitors who choose, not only the share who accept.
• Remember the choice. Asking again before six months lowers acceptance and is a pressure tactic the EDPB calls continuous prompting.
• Show the banner only where it is required. Visitors outside consent countries do not need to see it. This does not change your European rate, but it removes a lot of needless friction.
• Trust. A recognisable brand, a clean banner and a working Reject all make people more willing to say yes. The reverse is also true.

Levers that are not

Hiding Reject all behind Settings, a grey "continue without accepting" link, a bright Accept next to a pale Reject, pre-ticked categories, a banner that reappears on every page, or text that describes refusing as degrading the site. Each of these is in the EDPB taskforce report or the CNIL's formal notices as a reason consent is invalid, and the fines of the last five years, from Google and Facebook in 2021 to the 2026 simplified sanctions, are about exactly these designs. Our article on dark patterns goes through them.

Living with a 60 percent rate

A 40 percent refusal means 40 percent of visits are missing from Google Analytics and from ad attribution. Two honest ways to cope:

1. Modeling. Google's Consent Mode in advanced mode sends cookieless pings for visitors who refuse and models conversions from them; basic mode sends nothing. Whether that is acceptable to your authority is discussed in the Consent Mode guide and our article on the March 2024 change.
2. Consent-free measurement. In France, audience measurement that produces only anonymous statistics for the publisher can run without consent when configured to the CNIL's conditions; tools such as Matomo in its CNIL mode, Plausible or Fathom are built for it. The UK has a narrower statistical exception. Analytics without consent explains the conditions.

Cookiequiet's dashboard shows daily counts of banners shown, Accept all, Reject all, custom choices and withdrawals, so you can see your own rate rather than guess from benchmarks.