This is another piece in my series on using the internet a bit more deliberately. The previous one was about what our phones and routers broadcast. This one is about a smaller thing we do dozens of times a week: the click that closes a cookie banner.
The easy path is still "accept"
For most of the years since the GDPR, the EU privacy law from 2018, took effect, the banner did not even offer a real choice. Dimova and colleagues tracked more than eleven thousand websites across 30 countries through archived copies of their pages. Among the 2,479 sites that showed a banner in every capture, the share offering both an accept and a reject option grew from 2.94% in September 2018 to 30.66% in September 2024. As late as 2024, roughly seven in ten of those sites still had no reject button on the first layer of the banner, and the alternative to "accept" was a settings page. The authors treat their numbers as a lower bound, because the archive did not replay every banner.
In a study published in 2025, Nouwens and colleagues scanned the most popular websites in 31 countries covered by EU privacy law, between August and September 2024. Two thirds of the sites they reached show a consent interface, but only 15% of those interfaces meet the authors' minimal compliance requirements, mostly because there is no reject option. At least two thirds of the interfaces are not built by the publisher at all but by outside companies that sell consent banners to publishers.
And where the choice is "accept or subscribe," the gap is wider still. noyb, a privacy advocacy group, wrote in July 2025 that industry papers put the consent rates of such "pay or okay" banners at 99% to 99.9%, and set that against separate studies in which only 0.16% to 7% of people said they wanted to be tracked.
So the click is mostly a reflex, shaped by the button layout and by the options the banner shows at all. The more interesting question is what the list behind that button contains.
What sits behind "accept all"
You are rarely being asked about one company. A banner on a large news site asks for consent to your data being processed by the publisher and by a list of third parties it calls "partners," sometimes "trusted partners." These are mostly advertising and measurement companies. Each of them may then process data from your visit, provided it takes part in loading the page or its ads.
Many large European publishers, and all 18 sites in this piece, run this through one shared rulebook, the IAB Europe Transparency and Consent Framework, version 2.3, kept by an advertising industry body. The framework comes with a public directory, the Global Vendor List, which I will call the registry. Each entry in it, usually one company, declares what it does: which purposes it processes data for, which categories of data it uses, and how long it keeps that data. Some banners also list names that are not in the registry at all. For the size of a list I count the records the banner's configuration returns. For the overlap between sites I count each partner once, by registry entry where it has one and by name otherwise.
At the end of August 2026 that registry had 1,019 active entries. Which of them appear in a given banner is a setting chosen by the publisher, or by the company that builds and runs its banner, the consent management platform.
In a banner built on this framework, "accept all" normally records consent for the consent-based purposes and partners the publisher enabled, opts into the optional extras such as precise location, and raises no objection to the processing some partners run without consent, on what the law calls legitimate interest. I did not click. I read the partner lists and settings the banners disclose, and I did not decode what a click would have recorded on these 18 sites.
A declaration in that registry is the company's own description of what it does with data once it is allowed to. It does not prove that any data reached that company during your visit, and I did not measure any data flows.
Eighteen sites, eighteen partner lists
I collected the partner lists behind the banners of 18 large news sites at the end of August 2026, three per country in Poland, the United Kingdom, the United States, Germany, France, and Spain. Everything was fetched from a Polish IP address, so for the American and British sites this is the banner they show to visitors from Europe. I do not name the sites; they appear by country code (PL-A, PL-B and so on), because the point is the scale of the list, not any one publisher.
| Country | Site A | Site B | Site C |
|---|---|---|---|
| Poland | 1,855 | 1,345 | 1,164 |
| Spain | 1,107 | 1,022 | 690 |
| Germany | 345 | 180 | 172 |
| France | 305 | 249 | 126 |
| United States | 334 | 203 | 60 |
| United Kingdom | 139 | 131 | 54 |
The lists are far apart in size. The list behind one "accept" runs from 54 to 1,855 partner entries, with a median of 277 across the 18 sites. Seven sites list 200 or fewer. Five, all three Polish sites and two of the Spanish ones, list more than 900 of the registry's 1,019 active entries, at least 95% of it.
Averaged per country, the numbers look like this.
| Country | Average per site | Smallest list | Largest list |
|---|---|---|---|
| Poland | 1,455 | 1,164 | 1,855 |
| Spain | 940 | 690 | 1,107 |
| Germany | 232 | 172 | 345 |
| France | 227 | 126 | 305 |
| United States | 199 | 60 | 334 |
| United Kingdom | 108 | 54 | 139 |
Behind each average are three hand-picked sites, so this is not a country ranking.
The same names, in every country
Across all 18 banners I counted 2,405 distinct partner identities. Most of them are not shared widely: 1,068, or 44%, appear on a single site, and 56% appear on three sites or fewer.
The core is shared. Twelve identities appear on every one of the 18 banners, in all six countries: Adform, Amazon Ads, Google Advertising Products, Index Exchange, Integral Ad Science, LiveRamp, Magnite, OpenX, PubMatic, Teads, The Trade Desk, and Xandr. These are global advertising technology companies, among them ad exchanges, sell-side and buy-side platforms, a measurement firm and an identity provider.
This is part of why ads seem to know so much about you, at least on paper. If both banners gave a partner consent, and it can recognize your browser on both sites, it could see your activity on each of them. Recognition works through a third-party cookie where the browser still allows one, or through an identifier tied to a login or email address. That is the capability described by the purpose the registry calls "Create profiles for personalised advertising," which ten of those twelve declare, as do 61% to 77% of the partner records with purpose data, depending on the country.
Papadopoulos, Kourtellis and Markatos followed a year of web traffic from 850 real mobile users and found that 97% of regular users were exposed to cookie synchronization, the mechanism by which two trackers match their separate ids for the same person, most of them within their first week of browsing. Once ids were matched, the number of domains tracking a user grew by a factor of 6.75.
Source: Papadopoulos, Kourtellis, Markatos, "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask" (WWW 2019)
Each row of the next table is one country's three sites pooled together, and each cell says what share of their partners also appear in the column country's banners. The UK row, for example, says that 81% of the British sites' partners also appear in the Polish banners.
| Partners of | PL | UK | US | DE | FR | ES |
|---|---|---|---|---|---|---|
| Poland | 100% | 8% | 21% | 13% | 16% | 50% |
| United Kingdom | 81% | 100% | 59% | 61% | 64% | 79% |
| United States | 96% | 26% | 100% | 35% | 38% | 76% |
| Germany | 70% | 31% | 41% | 100% | 46% | 64% |
| France | 96% | 37% | 51% | 52% | 100% | 85% |
| Spain | 98% | 15% | 33% | 24% | 28% | 100% |
The matrix is asymmetric because the lists differ so much in size. Only 8% of the Polish sites' partners appear in the British banners, simply because the pooled Polish list is roughly ten times longer.
What data the partners declare
The registry has eleven data categories, and every company declares which ones it uses. The table gives, for each country, the share of the pooled partner records that declare a category, with the whole registry as a reference column. The shares are counted among the records for which the banner or the registry supplied category data, which covers between 71% and 94% of the pooled records depending on the country, and about half of the list on the largest Polish site; the last row of the table gives those counts. A partner listed on all three sites of a country counts three times.
The three identifier rows are different ways of recognizing the same device or person again. A device identifier is a stable id of the phone or browser, a probabilistic one is guessed from patterns such as screen size and settings, and an authentication-derived one comes from a login or email address.
| Data category | PL | UK | US | DE | FR | ES | Registry |
|---|---|---|---|---|---|---|---|
| IP addresses | 89% | 98% | 94% | 94% | 95% | 90% | 89% |
| Device characteristics | 80% | 90% | 83% | 84% | 89% | 80% | 80% |
| Device identifiers | 68% | 79% | 80% | 79% | 83% | 70% | 70% |
| Probabilistic identifiers | 38% | 51% | 43% | 48% | 51% | 40% | 39% |
| Authentication-derived identifiers | 26% | 40% | 31% | 35% | 41% | 27% | 26% |
| Browsing and interaction data | 62% | 82% | 71% | 77% | 78% | 63% | 62% |
| User-provided data | 31% | 32% | 30% | 35% | 36% | 31% | 31% |
| Non-precise location | 67% | 80% | 75% | 76% | 81% | 68% | 68% |
| Precise location | 22% | 26% | 24% | 26% | 29% | 22% | 22% |
| Users’ profiles | 37% | 49% | 44% | 54% | 53% | 38% | 38% |
| Privacy choices | 63% | 84% | 72% | 78% | 81% | 64% | 64% |
| Records with data (n) | 3,186 | 254 | 465 | 496 | 591 | 2,664 | 1,019 |
IP addresses are declared by almost everyone, 89% to 98% of those records depending on the country. Device characteristics, such as whether you are on a phone or a laptop, and device identifiers come next in the registry as a whole.
Browsing and interaction data, meaning the pages you visit and what you click, is declared by 62% to 82%. Precise location is declared by 22% to 29%, roughly one partner in four, and user profiles, meaning a description of you built from earlier data, by 37% to 54%.
The Polish and Spanish columns are almost identical to the registry column, because those five lists are nearly the whole registry. The shorter lists in the UK, Germany, and France have a higher share of partners declaring almost every category, the sensitive ones included. That could be deliberate curation by those publishers, or simply that a shorter list leaves out the registry entries that declare very little, which raises every share. The data can't tell the two apart.
On a single site the numbers add up quickly. On one of the Polish sites the list holds 1,345 entries, among them 219 that declare precise location among the data they use, 383 that declare user profiles, and 627 that declare profiling for advertising. In the framework, using precise location also needs a separate opt-in, which "accept all" normally includes. On the site with the shortest list in the sample, 54 entries, the same three numbers are 11, 20, and 25.
The Irish Council for Civil Liberties, an advocacy group, estimated in 2022, from 30 days of confidential industry figures and public population data, that real-time bidding, the automated auction that sells ad space on many websites, exposes a person's online activity and location 376 times a day on average in Europe and 747 times a day in the United States. That is a market-wide estimate and a count of broadcasts, not a measurement of these 18 sites or of what any single partner keeps.
Source: ICCL, "The scale of Real-Time Bidding data broadcasts in the U.S. and Europe" (May 2022)
What they say they do with it
The registry also lists eleven purposes, and the next table shows what the partners say they do with the data, counted the same way, among the records with purpose data.
| Purpose | PL | UK | US | DE | FR | ES | Registry |
|---|---|---|---|---|---|---|---|
| Store or access information on a device | 82% | 89% | 84% | 86% | 93% | 85% | 83% |
| Use limited data to select advertising | 76% | 77% | 77% | 68% | 82% | 73% | 77% |
| Create profiles for personalized advertising | 61% | 69% | 67% | 70% | 77% | 64% | 62% |
| Use profiles to select personalized advertising | 62% | 69% | 66% | 66% | 75% | 65% | 62% |
| Create profiles to personalize content | 26% | 18% | 10% | 21% | 29% | 25% | 25% |
| Use profiles to select personalized content | 23% | 16% | 8% | 18% | 25% | 22% | 23% |
| Measure advertising performance | 88% | 86% | 92% | 78% | 90% | 80% | 89% |
| Measure content performance | 40% | 32% | 30% | 33% | 38% | 34% | 40% |
| Understand audiences (statistics, combining data) | 56% | 57% | 57% | 53% | 64% | 54% | 56% |
| Develop and improve services | 66% | 78% | 75% | 63% | 78% | 60% | 66% |
| Use limited data to select content | 18% | 11% | 8% | 16% | 15% | 14% | 18% |
| Records with data (n) | 3,186 | 299 | 468 | 635 | 599 | 2,816 | 1,019 |
Storing or reading information on your device, which is what setting or reading a cookie is, and measuring advertising performance are the two most common purposes, declared by 78% to 93% of those records depending on the country. Creating profiles for personalized advertising and then using those profiles are declared by 61% to 77%. Personalizing content, as opposed to ads, is much rarer, 8% to 29%.
How long they keep it
Almost every active registry entry declares a retention period, though a few dozen declare zero, which I left out, and most names outside the registry declare none. So the shares below are of the partners that disclose one, between about half and nearly all of each list. The retention counted here is the longest period a partner declares for any purpose.
The median is 365 days at every one of the 18 sites, because declarations cluster on a few round values and one year sits in the middle of them. Depending on the site, 11% to 24% of partners declare exactly one year, and 14% to 25% declare two years or more.
The longest declaration in the sample is 12 years, for at least one purpose, in 20 active registry entries. For about half of those the standard retention is shorter and the 12 years apply to a single purpose. These fields are declarations typed in by the companies themselves, and I did not verify them, so a number like this can be a policy or a typo. Either way, by those declarations, some data from a page you open today may be kept for a year or more.
The legal layer
I am not going to go into the legal side, but two things show up in the banners. First, for some purposes some partners rely on "legitimate interest" instead of your consent, a basis the law allows as long as you can object; 36% of registry entries declare it for at least one purpose, and in seven of the 18 banners it does not appear for any of the eleven purposes. Storing or reading information on your device always needs consent under the framework, so legitimate interest can only cover what happens to the data afterwards. Second, eight of the 18 sites used a "pay or consent" banner at the time, judging by the buttons or, where I could not see them, the site's banner settings.
Morel, Santos, Fredholm and Thunberg crawled the top one million websites in 2023 and identified 431 cookie paywalls, every one of them built on the same consent framework as the sites here. Looking at what those paywalls communicated through the framework, the authors found that most of them leaned on legitimate interest and mixed it up with consent.
Source: Morel, Santos, Fredholm, Thunberg, "Legitimate Interest is the New Consent" (WPES 2023)
What this does not show
- It does not measure tracking. Partner lists, purposes, data categories, and retention are what the banners and the registry declare, not a log of what happened on a page view.
- It does not describe countries. Three sites per country, chosen by hand, seen from a Polish IP on two days. Country and banner vendor are confounded too: the British and German sites all use one consent platform, the Spanish ones another.
- Counts are the records the banner's configuration returns, not what the banner's own counter shows, and the two can be far apart. On one Polish site the configuration returned 1,164 records while the same configuration declared 2,310 and the banner text of the same day said 1,984; I could not establish why. On one German site it was 345 records against a counter of 308. I use the returned records everywhere, because that is the one count I could take the same way from every consent platform.
- An identity is not always a separate company. One group can sit under several registry entries.
- It is a snapshot from two days. The registry changes weekly and publishers test their banner texts.
What to make of it
The click is small, and what sits behind it varies a lot from site to site. On some of the sites in this sample, one "accept all" sits on top of a list of more than a thousand partner entries, some of which declare precise location or a profile of you among the data they use, and many of which declare retention periods of a year or more. On others the list has fifty.
None of this is an argument to never click accept. Publishers need to earn money, and a lot of the journalism we read is paid for by exactly this. But the length of the list is not something the banner tells you about. The data does not show whether a list of 1,800 entries was picked by the publisher one by one or inherited from a consent platform's configuration. My guess is the second, more often than not, but that is a guess. Either way the banner looks the same at fifty entries and at eighteen hundred. The list behind the word "partners" does not, and it is one tap away.
I would like to run the same count in a year and see which way the lists moved. I'm curious how many of you have ever opened that list, and whether anything in it changed what you clicked.
Thanks for reading!
Glossary
- Consent management platform (CMP) - The company whose software draws the cookie banner and records what you clicked. Publishers rarely build this themselves; a handful of vendors serve most large sites.
- IAB Europe Transparency and Consent Framework (TCF) - An industry standard, currently version 2.3, that defines how a banner asks for consent, how it records the answer, and how that answer is passed on to advertising companies.
- Global Vendor List (the registry) - The public list, kept by IAB Europe, of companies that take part in the framework. Each entry states what the company does with data, which data it uses, and how long it keeps it. Updated weekly.
- Partner (vendor entry) - One entry on the list behind a banner. Usually one company, but a large group can have several entries, and a name that is not in the registry can appear next to registry entries.
- Purpose - One of eleven standard reasons for processing that a partner can declare, from storing a cookie to building an advertising profile. A partner can only use your data for purposes it declared.
- Data category - One of eleven standard kinds of data a partner can declare it uses, such as IP addresses, precise location, or a profile of you.
- Legitimate interest - A legal basis under the GDPR that lets a company process data without asking, as long as you can object. In the framework it is allowed for some purposes but never for storing or reading a cookie.
- Retention period - How long a partner says it keeps data collected for a purpose, in days.
- Pay or consent - A banner with two ways out: accept the partners, or pay for a version of the site without them. Sometimes called "pay or okay" by its critics.
Methodology in brief
- Dataset: the partner lists of 18 large news sites (three each in Poland, the UK, the US, Germany, France, and Spain), read from the consent platforms' configuration files on August 30 and 31, 2026, without accepting any banner. No post-click consent signal was recorded or decoded.
- Reference: IAB Europe Global Vendor List v174 (1,207 entries, 1,019 active). Purposes and data categories are read from the copy of the registry each site's consent platform serves, with the publisher's restrictions applied. Retention for registry partners is taken from v174 by id; for non-registry partners, from the publisher's files.
- List size: records returned by the banner's configuration. Identity, for overlap counts: registry id where available, normalized name otherwise; 2,405 identities in total.
- Country matrices pool the three sites' records, so a partner on all three counts three times; shares are of the records with disclosed category or purpose data (counts in the last row of each table). Averaging the three sites' shares instead of pooling moves no cell by more than four points. Retention is the longest period a partner declares for any purpose; retention shares are computed over partners with a disclosed non-zero period.
Sources
- arXiv, "A history of GDPR cookie banner compliance: the roles of publishers, regulators and CMPs" (Yana Dimova, Vincent Toubiana, Tom Van Goethem, Lieven Desmet, Wouter Joosen), June 2026.
- arXiv, "A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them" (Midas Nouwens, Janus Bager Kristensen, Kristjan Maalt, Rolf Bagge), March 2025.
- noyb, "noyb's 'Pay or Okay' report: How companies make you pay for privacy", July 2025.
- WWW 2019, "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask" (Panagiotis Papadopoulos, Nicolas Kourtellis, Evangelos P. Markatos), May 2019.
- Irish Council for Civil Liberties, "ICCL report on the scale of Real-Time Bidding data broadcasts in the U.S. and Europe", May 2022.
- WPES 2023, "Legitimate Interest is the New Consent: Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls" (Victor Morel, Cristiana Santos, Viktor Fredholm, Adam Thunberg), September 2023.
- IAB Europe, Global Vendor List, version 174, last updated August 2026.
- Author's own analysis of the consent-banner partner lists of 18 news sites in six countries, snapshot August 30-31, 2026.