What is consent fatigue?

Consent is designed to protect us

Thankfully for consumers, the GDPR (as well as its global counterparts) prevents businesses from gathering, storing, or using personal data without a lawful basis for doing so. Although consent is not technically the only way to satisfy this, other avenues (including legal obligation or legitimate interest) do not generally apply within a marketing or advertising context.

As of today, and despite some limitations, consent banners are the best and only way to collect informed consent effectively. They have thus become the default mechanism allowing companies to collect consumer data while staying on the right side of the law. 

To learn about the most common types of consent banners, head to our dedicated article on the topic:

Consumer side: Over-exposition to consent banners 

Over the last few years and ever since the advent of the GDPR, European Union users have been repeatedly exposed to consent requests. 

While consent banners are designed to empower users with control over their personal data, the frequency of these consent requests can sometimes be overwhelming. This situation, although challenging, is a necessary part of maintaining user privacy and adhering to legal standards. It's a balance between ensuring user autonomy and complying with privacy regulations.

There is also a concern about the reduction in mindful decision-making. 

With the multiplication and recurrence of consent banners, users might find themselves habitually clicking ‘accept’ without fully engaging with the details. While this response might suggest a certain level of consent fatigue, it's important to remember that these measures are in place to protect user privacy. 

Consent banners are the best tools we currently have to ensure transparency and control in the digital realm.

Organization side: Poor Privacy UX practices 

The responsibility lies on organizations that must implement exemplary Privacy UX practices to communicate transparently with their users.

Privacy UX is a subset of User Experience focused on building privacy-first experiences that create lasting relationships between brands and their users and, in turn, generate revenue for organizations.

‍

One of the focuses of Privacy UX has long been dark patterns, deceitful design elements that seek to manipulate users into making uninformed choices. 

Despite increased scrutiny, these often illegal UX practices are still commonplace online, negatively impacting user perception and reinforcing negative bias towards consent collection mechanisms. At the start of 2023, the European Commission reported that almost half of major online shops operating in the EU used manipulative tactics to maximize data yields.

These two issues - over-exposition and poor Privacy UX - are the root cause of consent fatigue. But what are some of the changes and industry initiatives that could help get past it? 

1) Tightening the net

The first (and most obvious) solution to consent fatigue is the one outlined by regulators - simply filling in the gray zones with more granular legislation.

With a precedent already set by the updated CPRA, we are already taking steps toward developing laws that reflect the realities of modern threats to consumer choice and autonomy.

However, there are problems with this approach. To be effective, these laws must consider the realities of unconscious bias and the power of UX and AI to manipulate our choices. Unfortunately, many feel that this is like building a house on sand. A Pennsylvania study argues that informed consent at scale has become a myth that is “beyond repair—and could even be harmful to individuals and society.”  

It also remains to be seen whether upcoming legislation will be robust enough to rein in the tech industry, which is already pushing back. In June this year, the European Commission received an open letter from over 150 key commercial stakeholders warning against the anti-competitive and anti-innovation impact of the proposed AI Act. 

Striking the right balance between consumer and commercial rights will be key to the success or otherwise of new legal frameworks.

2) A softer approach

Some argue that, given the inherent complexity of the task at hand, the consent model itself is irreversibly broken and that education is the only real answer to consent fatigue. 

Proceeding on the basis that it is unrealistic to expect any meaningful level of agency or understanding from a pop-up, a front-end approach would presumably aim to instill clearer knowledge in the population about how companies use their data - with an emphasis on the consequences of getting it wrong. 

This could come from public service messaging connecting consent behavior with the rise of spam calls and emails. However, with the rise of sophisticated AI tools, this is extremely unlikely to be effective against almost impossible techniques to spot online.

3) Browser-based solutions

One of the most realistic options on the table is that of shifting towards browser-based, “one-stop-shop” solutions to consent.

The most recent European Commission discussion paper asks, “Can certain alternatives to tracking-based advertising models be chosen by consumers as a default option not requiring giving consent each time a new website is visited (or revisited), for example, in choosing settings on their browsers or by using some automated solution?”.

While the idea is great in theory, it quickly becomes tricky in practice. Our Chief Privacy Officer, Thomas Adhumeau, explained the challenges of this approach in an opinion piece titled “Cookies, consent fatigue, and industry standards: What's next in privacy for the AdTech industry?”:

The lack of standardization makes the idea very impractical: When user choices can reach a high level of complexity, how can we ensure that they are accurately respected and carried over without a clear framework to refer to?- Thomas Adhumeau, Chief Privacy Officer at Didomi (Source: Yes We Trust)

In the article, the CPO mentions the challenges associated with the idea, from carrying consent from one website or service to the next and to maintaining valid, informed consent. However, he uses it to introduce the idea of a potential framework to address the issue.

4) A new industry framework

In the footsteps of the Transparency and Consent Framework (TCF), the initiative from IAB Europe that has been able to assist publishers, technology vendors, agencies, and advertisers in meeting the requirements of the GDPR and ePrivacy Directive, a possible development to face consent fatigue could be the emergence of a new framework to enable the standardization of consent choices online.

This is the idea brought up by our CPO, Thomas Adhumeau:

“Imagine a digital ecosystem where users, just once, use a browser extension to define their advertising and data-sharing preferences. (...) The browser extension and the website, irrespective of its nature or content, recognize and understand this language, ensuring a smooth communication of user preferences. 


Such an arrangement drastically reduces the problem of cookie banners and consent pop-ups users typically encounter. They're spared the repetitive chore of setting their preferences over and over again, as their choices are universally recognized and applied.”

- Thomas Adhumeau, Chief Privacy Officer at Didomi (Source: Yes We Trust)

While enticing, such a project would require massive adoption throughout the data privacy and advertising industry, with the support of major organizations and institutions.

To read more about the idea, read our CPO’s open letter on the topic: