Marko Saric's honest GDPR banner test: only 9% of 18,700 visitors consented to tracking

Under GDPR, websites must ask before tracking visitors, and by 2020 the standard answer was a consent banner engineered with dark patterns — buried opt-outs, pre-ticked boxes, nagging walls — on the unspoken assumption that a fair choice would destroy tracking-based revenue. The irony was unmeasured: nobody had published what share of visitors actually grants consent when the banner is legal, small, ignorable, and refuses as easily as it accepts. Marko Saric, founder of the cookieless analytics startup Plausible, decided to run that experiment himself.

In June 2020 Saric installed Metomic's fully compliant GDPR banner on two websites with deliberately different audiences: one tech-focused site whose traffic was roughly 60% Google organic and mostly desktop, and one lifestyle site whose traffic was roughly 70% organic social and mostly mobile. Visitors could browse without answering, and refusing took the same single action as consenting. Across 18,700 unique visitors the banners logged opt-ins and opt-outs per site, which Saric published as raw tables.

48% of visitors engaged with the banner at all, and 19% of those who engaged gave consent — 9% of all visitors. Mobile visitors engaged far more often than desktop users (59% versus 40%) yet consented less (16% versus 22%). On the lifestyle site, where visitors could accept statistics, personalized advertising and social sharing separately, only one person out of 774 opt-ins drilled down to customize; everyone else took or refused the whole bundle. Saric's summary: 90%+ of visitors will not give GDPR consent.

Because the banners were compliant and the two sites shared little traffic or audience, the ~9% figure could not be dismissed as one niche readership or as a hostile design. It became the missing measure of what users do when the law's choice is real. Saric concluded that business models needing mass consent — behavioral profiling, personalized advertising — rest on dark patterns rather than demand, predicted tracking permissions would move to browser-wide defaults, and pointed to contextual advertising and cookieless analytics as models that need no consent at all.

Run the honest banner and count: consent falls to 9%

It measures revealed preference, not opinion: real visitors chose on working websites, so the 91% refusal rate answers what users would do rather than what they say in surveys.

Two contrasting audiences make the result robust: a tech, desktop, search-fed site and a lifestyle, mobile, social-fed site both landed near 9%, so it is not one readership's artifact.

A compliant banner removes the standing excuse: small, ignorable, with “no” as easy as “yes”, so low consent cannot be blamed on hostile UX — it indicts the tracking model itself.

Publishing the raw per-site table makes the study checkable and reusable: any reader can recompute 48% engagement and 9% consent from the counts, so the number can be re-used as evidence.

When an industry rests on an untested assumption, measure it honestly and publish the raw numbers: one experiment can reprice a business model and clear the ground for your alternative

The post reached Hacker News on 7 July 2020 and drew 651 points and 446 comments, with readers debating dark patterns, enforcement and the ad-funded web. In the article Saric argued the industry would keep riding personalized advertising until enforcement or browser-level tracking defaults force the shift, and that publishers should move early to contextual advertising or cookieless analytics — the category his own Plausible occupied. Its founding pitch was that a tool which does not track or identify visitors needs no consent banner at all, a claim the experiment's numbers made concrete.