Can cookie banners be made more understandable? A feasibility study on simplification using plain language
When visiting a website, users are often greeted by a cookie banner. These are intended to inform users about how their data is processed using cookies, and to obtain their consent for the processing of personal data. However, a survey has found that very few users understand the content of this consent. In her master’s thesis at the Institute for Application Security at Technische Universität Braunschweig, under the supervision of Alexandra Dirksen, Minela Bećirović investigated how this can be improved.
Symbolic representation of a cookie banner. Photo: Generated with AI
The General Data Protection Regulation (GDPR) stipulates that consent must be obtained “in an understandable and easily accessible form, using clear and plain language”. The ePrivacy Directive supports this requirement by stipulating that users must receive “clear and comprehensive information” about the purpose of the processing in order to make an informed decision. Despite these clear guidelines, a 2024 survey by the Bitkom industry association showed that three-quarters of participants did not understand the content of cookie banners.
Vague wording and technical terms
The problem of lack of comprehensibility can be attributed to the fact that vague wording and technical terms are often used in practice, which increases the complexity of the banners. In my master’s thesis, I therefore conducted a feasibility study to investigate the extent to which cookie banners can be made more understandable by using simple language, taking into account the Transparency & Consent Framework (IAB TCF). This is a voluntary technical standard of the Interactive Advertising Bureau intended to support website operators and advertisers, in particular, with legally compliant data processing.
For the study, 200 websites with English-language cookie banners were analysed as a sample. The text content of the first level of each banner was extracted using an in-house developed browser extension. To determine which personal data processing purposes (according to the IAB TCF) were reflected in the extracted banner texts, statistical and AI-based categorisation methods were employed. Descriptions in plain language were created for each purpose using AI tools.
Based on these, modified cookie banner texts were generated by assigning the identified purposes to the corresponding plain language descriptions. Finally, the comprehensibility of the original and modified banner texts was measured and compared.
The results showed that the lack of uniform implementation of cookie banners severely limits the scope for analysis. In some cases, it was not possible to detect and extract the banner texts. Categorisation was also challenging due to vague wording and different terms used for the same purpose. The AI model (OpenAI o3) often had to make assumptions and draw conclusions, leading to inconsistencies in the assignment process.
Comprehensibility significantly improved
On the other hand, the comprehensibility of the descriptions in plain language developed as part of the master’s thesis significantly improved. The modified cookie banner texts also achieved better scores for comprehensibility overall than the original texts. Nevertheless, the study shows that, with the current implementation of cookie banners, making their textual content more comprehensible by using plain language alone is not enough.
Although plain language has the potential to make cookie banner texts more comprehensible, it is only effective if the texts contain all the information users need to make an informed decision about how their personal data is processed. Linguistic simplification cannot compensate for missing information. A banner can achieve high comprehensibility scores yet still fail to provide specific information about data processing.
Important for informed decisions
The study therefore highlights the need for binding guidelines or standards for implementing cookie banners, to ensure that users can make informed decisions. Plain language could then help make this information accessible to a wider audience. Additionally, it can prevent the deliberate use of misleading and unnecessarily complex texts that mislead users into making decisions that are not in their best interests, a practice known as dark patterns.
Text: Minela Bećirović