The ultimate guide to consent banner formats

Since 2018 and the advent of the European General Data Protection Regulation (GDPR), consent has been established as the most common legal basis for online data collection. We should know, as we provide a leading Consent Management Platform (CMP) and help thousands of organizations worldwide comply with data privacy regulations.

But as more regulations are introduced, each with its own intricacies and specificities, it can be hard to determine what a compliant consent banner looks like. If your organization collects consent in various countries, the waters get even muddier: What consent banner should you implement? What buttons should it feature? How many layers of information should it contain?

In this article, we review the various types of consent banners and where they apply and take a quick look at what you should avoid when creating yours (dark patterns) before introducing how you can build it with Didomi.

Summary

• The 4 main types of consent banners (with examples)

• What are dark patterns?

• Multi-regulation: the easiest way to build a compliant consent banner

The 4 main types of consent banners (with examples)

There are many possibilities when it comes to creating a consent banner (sometimes also called a consent notice) for your website.

Generally speaking, we can single out 4 types of approaches to data collection and, thus, 4 types of consent banners you can go for:

• Opt-in 

• Opt-out 

• Mixed 

• Informational 

Let’s take a closer look at each, consider which regulations they are generally advised for, and bring up some examples.

Opt-in consent banners 

Opt-in consent banners require users to provide explicit consent for data collection and processing.

They are found under strict data protection regimes such as the European Union’s General Data Protection Regulation (GDPR) and have a few key characteristics:

• Consent is required immediately upon entering the website 

• The first layer of the banner generally provides a choice to either accept or reject consent and another to configure choices by going to a second layer

• In that second layer, purposes for data collection are neither set to “disagree” nor “agree” by default (unless for some legitimate interest purposes)

By virtue of being one of the most thorough formats available, it is sometimes adopted by organizations around the world as their default banner for every customer, regardless of their location. 

Example of an opt-in consent banner 

Opt-out consent banners 

Opt-out consent banners are used in data protection regimes where data collection happens by default.

They can be found under data privacy laws similar to California’s CCPA (now amended by the CPRA) and other U.S. regulations. Some key components of opt-out banners include:

• An optional button where users can ask the company not to share/their data 

• All purposes for data collection in the second layer are agreed upon by default

While this type of banner can be found in less stringent consumer data protection laws, they offer some amount of control to consumers.

Example of an opt-out consent banner

Mixed consent banner

Mixed consent banners are somewhere in between the opt-in and opt-out banners.

Much like opt-out banners, they favor data collection for organizations, but they also add a new layer of privacy settings for consumers. The key characteristics of a mixed consent banner are:

• Purposes are all agreed upon by default 

• A new button gives consumers control over “sensitive” personal data (definition varies depending on the regulation)

• Upon clicking the “sensitive personal information” button, users have access to a second layer to control the usage of that data

You’ll find this type of banner in several U.S. states that have passed consumer data privacy laws, starting with the California Privacy Regulation Act (CPRA). It provides an added element of control for consumers and introduces the notion of sensitive personal information.

Example of a mixed consent banner

Informational consent banner

Finally, informational consent banners are very general, cookie-cutter (pun intended) banners that provide little information and don’t allow customers to have control over their data.

They are merely a displayed message and are used, for the most part, in places where the data privacy landscape is still in a state of limbo.

You’ll recognize an informational consent banner by these basic identifiers:

• Small message informing of cookie collection

• Few or no options to accept, deny, or configure your choices

We advise against implementing an information consent banner unless your data protection regime requires you to do so.

Example of an informational consent banner

What are dark patterns?

When talking about consent banner best practices, it's important to highlight best practices but also what you should avoid doing. Dark patterns are a type of deceiving design element that is looking to manipulate users into making certain decisions online.

In the infancy of the GDPR, unknowing (or sometimes unscrupulous) organizations notoriously used design tricks in their consent banners to influence users into providing consent for data collection, which we strongly recommend against.

Here are 4 things to avoid when creating your consent banner:

1. Manipulative buttons: Using specific wording in the choices to guilt-trip users into making a decision over another (e.g., “I’m happy to accept”)

2. Hidden choices: Influencing users by making one or several of the choices harder to see (e.g., different font or color to blend one of the choices in the banner)

3. Confusing banner text: Offering a description that doesn’t accurately describe what the consent collection entails (e.g., “Data collection is boring, don’t worry, we won’t really use your data”)

4. Influencing design: Misleading users with the design of the banner itself (e.g., visual elements that clearly push the user to go towards one of the options)

Interested to learn more about dark patterns? Read our article on the topic:

Multi-regulation: the easiest way to build a compliant consent banner

Our flagship product, the Didomi Consent Management Platform (CMP), is the highest-performing CMP on the market. With opt-in rates up to 99% and a 95% client retention rate, we are deployed in over two hundred thousand websites and are collecting consent in over a hundred billion (!) pages on the internet. 

See for yourself by browsing our customer reviews on software review aggregator G2, which rated us the #1 consent management platform provider in its 2023 Summer Report.

Thanks to our experience in the field, we know that different countries and regions have different privacy requirements and that figuring out which banner to display to which users can be daunting for organizations operating on a massive scale.

Our multi-regulations consent flow helps you manage consent for all privacy regulations across multiple channels,  devices, frameworks, and touchpoints from a single platform. Our solutions help you: 

• Display the right banner based on user location with geo-targeting 

• Automatically detect industry standards like Global Privacy Controls (GDP)

• Streamlines and manage end-user privacy requests (DSAR) with our Privacy Request module

• Measure the impact of your banner and run A/B tests using our Advanced analytics

• Interact with privacy experts who can help you implement and optimize your data privacy practices

To learn more about multi-regulations and how Didomi can help with your compliance and data privacy challenges, visit our dedicated CMP page: