New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.

中文翻译：

---

GDPR 之后的黑暗模式：抓取同意弹出窗口并展示其影响

网络中引入了新的同意管理平台 (CMP) 以符合欧盟的《通用数据保护条例》，特别是其在公司收集和处理用户个人数据时对同意的要求。这项工作分析了最流行的 CMP 设计如何影响人们的同意选择。我们在英国排名前 10,000 的网站（n=680）上抓取了五个最受欢迎的 CMP 的设计。我们发现黑暗模式和默示同意无处不在。只有 11.8% 符合我们根据欧洲法律设定的最低要求。其次，我们对 40 名参与者进行了现场实验，以调查八种最常见的设计如何影响同意选择。我们发现通知样式（banner 或barrier）没有效果；从第一页删除选择退出按钮会使同意率提高 22--23 个百分点；并在第一页上提供更细化的控制将同意减少 8--20 个百分点。这项研究为强制执行 GDPR 的必要监管行动提供了经验基础，特别是将集中的第三方 CMP 服务作为提高合规性的有效方式的可能性。