  New consent management platforms (CMPs) have been introduced to the web to
conform with the EU's General Data Protection Regulation, particularly its
requirements for consent when companies collect and process users' personal
data. This work analyses how the most prevalent CMP designs affect people's
consent choices. We scraped the designs of the five most popular CMPs on the
top 10,000 websites in the UK (n=680). We found that dark patterns and implied
consent are ubiquitous; only 11.8% meet the minimal requirements that we set
based on European law. Second, we conducted a field experiment with 40
participants to investigate how the eight most common designs affect consent
choices. We found that notification style (banner or barrier) has no effect;
removing the opt-out button from the first page increases consent by 22--23
percentage points; and providing more granular controls on the first page
decreases consent by 8--20 percentage points. This study provides an empirical
basis for the necessary regulatory action to enforce the GDPR, in particular
the possibility of focusing on the centralised, third-party CMP services as an
effective way to increase compliance.
