Month: November 2018

…and a few presumptions you might need to rethink

Banners, pop-ins, confirmation through clicking or scrolling…how does the way you collect consent influence a user’s decision to give it? How successful are the various opt-in mechanisms being used to comply with the GDPR?

This study was conducted over 14 days, from 6th to 19th August 2018. In total, we analysed the behaviour of 10,450,000 visitors to 16 websites across a variety of industries (finance, media, manufacturing, distribution, travel, energy).

And let’s start with the first surprise: while many websites tended to choose more discrete methods, either as a precaution of through fear of scaring away visitors, the barometer’s results show that they would actually be better off being upfront and transparent.

Lesson #1: Properly evaluate the pros and cons of the collection method

In practice, websites use 3 methods for collecting consent:

• Strict consent
  This involves a direct expression of consent – typically a click on an ‘accept’ button.
• Soft consent
  This is where the consent is given when the user explores the website further i.e. views a second page.
• Super-soft consent
  Consent is given when the user scrolls down the page the first page they view. This method complies with one possible interpretation of the GDPR and is currently accepted by the regulatory authorities until clarification from the ePrivacy directive.

Unsurprisingly, conversion rates for strict consent are lower (28%) than the two others: 69% for soft consent and 78% for super-soft.

Given how small the difference between these two is, it begs the question: why choose the super soft method and thus a ‘tolerated’ interpretation of the regulation? Especially since soft consent results in 39% of visitors giving their direct consent (by clicking on an ‘accept’ button) compared to only 10% with super soft.

Lesson #2: Make the first impression count – cause it does

No considering strict consent, here are the 4 other lessons from the study.

A user reads the consent text on average 1.8 times before making a decision. This figure remains the same regardless of the final decision (opt-in or opt-out) and the consent mechanism used (strict, soft or super soft). In other words, the user makes their choice after seeing the consent banner or pop-in for the first time.

Only 0.1% of users – yes, you read that right – go further by visiting the pages with the privacy policy or where they can make a granular choice cookie by cookie.

 Lesson #3: For consent banners, bigger is better

The average opt-in rate is 65%, but it varies. The main factor behind the differences between desktop, mobile and tablet is the size of the consent banner – which is mechanically more imposing on mobiles and tablets. The result is that of the devices that display consent banners, 37% are desktops, 51% are mobiles and 12% are tablets. Opt-in rates for these devices reach 56%, 59% and 76% respectively.

In general, one surprising conclusion from this barometer is that secrecy doesn’t pay off. Instead of fleeting banners whose background colour blends into the website, it’s better to choose contrasting blocks with an easy-to-read font.

Lesson #4: Don’t hide your content

The correlation between consent banner size and opt-in rate obviously has its limits: when the content of the site is no longer visible, either around or behind the banner, users tend to stop browsing rather than give their consent. This occurs in particular when the banner looks like a pop-in which obscures the whole background i.e. the website content.

Lesson #5: Take into consideration your visitors’ and industry’s practices

Each sector has its preferred method for collecting consent. While finance and energy companies prefer strict consent, and thus a tight interpretation of the GPDR, media and travel sites emphasise optimisation by using a super-soft method. These preferences can be explained by each party’s individual needs (for media, opt-ins partly influence advertising revenue) but are not set in stone.

Changes in the regulations (the ePrivacy text is still being written), technology (browsers) and, obviously, user behaviour could mean such choices may have to be reviewed in the upcoming months.

Banners, pop-ins, confirmation through clicking or scrolling…in the GDPR era, how does the way consent is collected influence a user’s decision to give it?

Paris, November 20th 2018 – Commanders Act, the European leader in SaaS Tag and Data Management solutions, has published its Online Consent Barometer (OCB), the first barometer on the matter of Privacy Management that measures the results of various opt-in mechanisms used to conform with the GDPR.

10,450,000 visitors to 16 websites over 14 days

The barometer is based on the observed behaviour of visitors to 16 websites over 14 days (6th to 19^th August 2018), drawing from a total of 10,450,000 visitors.  A sample made even more representative by the fact that the websites examined cover a wide range of fields: finance, media, industry, retail, travel and energy.

“Despite its usefulness, the GDPR is a frightening subject for digital teams. We decided to carry out this study to debunk some myths and provide marketers with concrete answers regarding the impact of asking for consent, a few months after the GDPR came into effect,” explains Michael Froment, Commanders Act CEO.

The first impression is the only one that counts

In general, the size, colour, position and font of the consent banner, as well as the choice of a strict or soft collection method, could all have an influence on a user’s behaviour. But regardless of the format used, just like in real life, the first impression is the only one that counts. Except for when a strict collection method is used, users read the consent message an average of 1.8 times before making their decision. This figure remains the same regardless of the final decision (opt-in or opt-out) or the consent mechanism employed (soft or super-soft). In other words, users make their choice after seeing the consent banner or pop-in for the first time. And rarely do they go further and configure they consent…

Only 0.1% of users visit the page where they can activate or disable the various cookies. And only 0.07% view the page that explains how to change their browser’s acceptance settings.

Adapting to the visitor and industry

Each industry has its own method for collecting consent in keeping with the expectations, practices and habits of its users. Thereby, those in finance and energy follow a narrow interpretation of the GDPR and thus favour strict consent, which meets the requirements for a user to have formally given their agreement to access the website’s content. On the other hand, media and travel sites choose the path of optimisation, opting for the ‘super-soft’ method where consent is given as soon as a user scrolls down the page. Such choices depend on each one’s objectives (ad revenue for media websites is partly dependant on getting opt-in consent), but they are not definitive.

Changes in regulations (the ePrivacy text is still being written), browser technology and, obviously, user behaviour could make a review of these choices necessary in the coming months.

At the same time, we must refine the notion of consent in order to comply with the spirit and wording of the GDPR. Consent must be a voluntary and informed act. In many cases, it is still not completely in line with the founding text on personal data protection.