1 Introduction

Increasing traffic on the Internet and the more widespread use of applications poses serious threats to individuals’ privacy and security. The role of social networks, websites, and apps in disrupting the way people disclose information is evident: not only do users consciously share information through posts and photos, but they may also inadvertently share sensitive information such as their IP address, current location, passwords, and interests. The unwitting sharing of sensitive information is facilitated by the fact that privacy decisions are typically complex, and users may lack the time or mental resources to understand the implications of their decisions, or simply do not consider privacy decisions as their priority when accessing an app or website. Nonetheless, with technological advances in aggregating and analyzing data, the trails of information left behind by web users can be maliciously utilized by other individuals and companies for profiling purposes, fueling the concern for protecting one’s informational privacy (see, e.g., Acquisti et al. 2015, 2017).

One of the avenues through which sensitive information is shared, and that seems to have received less attention compared to others, is consenting to the use of cookies on websites. Cookies are pieces of information saved by the browser; they store data about the user’s IP address, time spent on webpages, searches performed, and credentials for later access. Companies use these data to ensure better technical functioning of their webpages and for advertising and marketing purposes.

In several countries, the use of cookies is regulated by privacy and security laws such as the General Data Protection Regulation (GDPR), which has been effective in the twenty-seven countries of the European Union since May 2018 (see https://gdpr.eu/cookies/). Among other things, GDPR requires that companies receive the users’ consent before they can process the data stored by cookies. The request for consent is typically administered through a cookie banner that pops up when users first visit the website. Although the banner warns users about the use of cookies, potentially making them aware of the issue of privacy, the typical banner is designed to lead the user to accept all cookies and not only those that are necessary for the website to function (Utz et al. 2019; Bruns and Gaudeul 2022).Footnote 1 This objective is usually achieved by making the button to accept all cookies larger and/or in a different color than the button to reject or customize non-necessary cookies. Such a design ensures that the option to accept all cookies is “salient,” that is, stands out from the remaining stimuli (Higgins 1996; Bordalo et al. 2022), and is accessible with low effort (e.g., Gehrt and Yale 1993; Berry et al. 2002). Yet, accepting non-necessary cookies exposes web users to potential privacy risks, even though the website could be accessed without consenting to them.

The idea for the present paper arises from consideration of two facts reported in the literature on cookies. First, surveys indicate that individuals recognize that sharing personal information poses a severe threat to their privacy, but most of them reject non-necessary cookies only occasionally (Boerman et al. 2021; see also Utz et al. 2019). Second, providing users with information about cookies does not significantly increase their willingness to reject non-necessary cookies (see Strycharz et al. 2021). If providing more information does not reduce cookie acceptance, what would? In this paper, we experimentally test whether certain designs of cookie banner that decrease the accessibility of the acceptance option without changing the information provided to users can reduce the rate of acceptance of all cookies.

Our design of cookie banners was driven by the theory of nudges. Nudges are aspects of the decisional context that leverage a cognitive limitation or bias of decision makers to steer their behavior in directions that improve their well-being or that of society (Thaler and Sunstein 2009; Hansen 2016; Congiu and Moscati 2020, 2022). The archetypal example of a nudge is the positioning of healthy foods in cafeteria lines to increase their prominence, thereby making it more likely that the customer selects them (see Thaler and Sunstein 2009, pp. 1–4). Nudges do not need to be material or physical. For instance, in online security, “digital nudges” (Weinmann et al. 2016; see also Acquisti et al. 2017) have been devised to increase password strength (e.g., Egelman et al. 2013; Peer et al. 2020), decrease vulnerability to cyberattacks (e.g., van Bavel et al. 2019; Rodríguez-Priego et al. 2020), prevent the sharing of sensitive data in apps (e.g., Wang et al. 2013; Zhang and Xu 2016), and reduce the acceptance rates of cookies (e.g., Bauer et al. 2021; Graßl et al. 2021).

Our experiment fits in the literature on digital nudging, and applies two nudges, a salience nudge and a framing nudge, to the design of a cookie banner to reduce the rate at which users accept all cookies or, equivalently, increasing the rate at which users reject non-necessary cookies. Participants (N = 358) were recruited on Amazon Mechanical Turk, a popular online recruitment platform for surveys and experiments, in February 2022, and invited to take part in a study on personality traits and online decisions. On the welcome screen, participants were presented with a cookie banner. Following a common practice on many websites, in a pilot that we conducted in July 2021 we displayed a banner with two options: “Customize cookies” and “Accept all cookies.” However, we noticed that the proportion of users customizing cookies was low (around 10%) and stable across treatments. Therefore, in the subsequent experiment, we decided to replace the button to customize cookies with a button to straightforwardly reject non-necessary cookies. Ultimately, we offered two options: “Reject non-necessary” or “Accept all cookies.”

Consenting to cookies through the banner did not have any real-life consequence, that is, did not lead to having cookies actually saved on the participants’ browser. We made this decision to avoid intruding on the participants’ computer by saving files that served no actual purpose in the experiment. Nonetheless, to avoid compromising the truthfulness of the responses collected, participants were informed of this only at the end of the experiment, in a debriefing screen, as is typical in experiments in which information is withheld from participants (e.g., Greenspan and Loftus 2022).

The experiment employed a 2 × 2 between-subject design in which we applied either the salience nudge or the framing nudge or both and measured their individual and combined efficacy in increasing the cookie rejection rate. The salience nudge consisted of making the button for rejecting cookies more visible and accessible, and therefore more likely to be selected, than the acceptance button. This was done by coloring the rejection button in black and leaving the acceptance button in light gray. The framing nudge consisted of rephrasing button labels as negations rather than affirmations: “Don’t accept non-necessary” and “Don’t reject non-necessary.” This nudge relies on the insight that labels framed as negations are cognitively more demanding, and thus take longer to be interpreted, than labels framed as affirmations (see, e.g., Orenes et al. 2016). Accordingly, the framing nudge should deter decision makers from unthinkingly consenting to accepting all cookies and therefore steer them to choose the rejection option more frequently. The element common to these two nudges is that they both seek to increase the rate of cookie rejection by reducing the accessibility of the acceptance option; however, the former does so at the visual level and the latter at the verbal level (on the distinction between visual and verbal nudges, see Congiu and Moscati 2020).

Our experiment shows that the salience nudge alone, i.e., making the rejection button salient while framing button labels as affirmations, increases the cookie rejection rate by 7 percentage points (pp), that is, from 27% (control banner) to 34%. However, this effect is not statistically significant (p = 0.305). The framing nudge alone, i.e., framing labels as negations while maintaining the acceptance button as the salient one, increases the cookie rejection rate by 18 pp (p = 0.009). Finally, the combination of the two nudges raises the rate of cookie rejection by 53 pp (p < 0.001), i.e., from 27 to 80%. These findings indicate that making the rejection button visually salient and framing options in a more cognitively demanding way, that is, decreasing the accessibility of the acceptance option at both the visual and verbal level, can indeed significantly increase the proportion of users who reject non-necessary cookies. To further explore the low customization rate elicited in the July 2021 pilot and enhance our primary investigation, in October 2023 we conducted an additional experimental session (N = 188; details in Appendix 5). We tested two cookie banners in which the rejection button was replaced by a customization button (“Manage cookies”) and was made either salient or not salient.Footnote 2 We found that only 3% of participants rejected non-necessary cookies, regardless of the button salience. This finding indicates that the availability of the customization option in cookie banners does not foster cookie rejection, and that the latter can be fostered more effectively by replacing the customization option with a button to directly reject cookies. Finally, we explore how the frequency with which users reject cookies is related to the time they spend making the decision and to their personality traits.

Ultimately, our experiment suggests that to be effective, legislation about online privacy and security should introduce specific guidelines for the design of cookie banners.

The remainder of this article is structured as follows. Section 2 reviews the relevant literature. Section 3 presents the experiment and Sect. 4 discusses the experimental results. The implications of our findings are discussed in Sect. 5.

2 Literature Review

Cookie rejection is a type of digital behavior, that is, of the behavior of individuals when they navigate the internet using their devices. Digital behavior may be driven by the aspects of webpages that draw attention, that is, that are salient, and by the way the written content is phrased, that is, by its framing. It may also depend on the personal characteristics of the decision makers, such as their age or gender; in particular, the psychological literature has investigated the role of personality traits in determining digital decisions. Accordingly, we review the literature on salience (Sect. 2.1), framing (Sect. 2.2), personality traits as determinants of digital behavior (Sect. 2.3), and three previous experiments on cookie rejection (Sect. 2.4).

2.1 Salience

Salience refers to an aspect of a stimulus that for some reason stands out from the rest (e.g., Higgins 1996). For example, a colored button on a white background is salient because it is easily spotted and separated from the other stimuli. In decision theory, Salience Theory (see Bordalo et al. 2022 for a comprehensive review) states that economic options such as financial assets and commodity bundles are more likely to be selected the more salient they are and that the salience of an option depends on its contrast with the other options and the prominence with which it is displayed. Studies in marketing and consumer behavior also show that consumers pay more attention to options that are more visually salient and choose them more frequently (e.g., Armel et al. 2008; Milosavljevic et al. 2012; Janiszewski et al. 2013). Moreover, the salience of options influences the effort required to make decisions and ultimately contribute to the perceived accessibility of these options: the more salient an option is, the lower is the effort to select it. Extensive research in marketing and consumer behavior has shown that the accessibility of an option relates to the amount of time and effort required to mentally or physically access it and that options that have few barriers and require minimal mental or physical effort to access are chosen more frequently (Gehrt and Yale 1993; Berry et al. 2002; Clulow and Reimers 2009).

2.2 Framing

Framing refers to how a choice scenario is described. What has often been observed in experiments is that different but logically equivalent descriptions of the same choice scenario can elicit different behavioral responses from decision makers, resulting in what are termed “framing effects” (Tversky and Kahneman 1981, 1986). Probably the most renowned case of framing effect is that associated with the Asian disease problem posed by Tversky and Kahneman (1981). In this problem, presenting the outcomes of two alternative health policies in terms of gains (“200 lives [out of 600] will be saved”) rather than in term of losses (“400 lives [out of 600] will be lost”) significantly affects which policy is preferred, although the policies are logically equivalent. Framing effects stemming from descriptions that emphasize the gains or losses of the same options have proved a recurring finding in many diverse settings (e.g., Andreoni 1995; Gamliel and Peer 2006; Shamaskin et al. 2010; Hossain and List 2012). Specific to cookie consent decisions, the experiment by Ma and Birrell (2022) shows that web users are more likely to reject cookies when the frame emphasizes the harmful effects of acceptance (“Accept cookies to allow this website and its partners to access and sell your personal information”) compared to the situation in which the frame emphasizes the beneficial effects of rejection (“Deny cookies to prevent this website and its partners from accessing or selling your personal information”).

A type of framing effect that has received less attention is that arising from the description of alternatives as negations rather than affirmations, such as “not be saved” vs. “die” (Yao et al. 2018) or “not left” vs. “right” (Dudschig and Kaup 2021). It is evident that, in both examples, the two options are logically equivalent, since interpreting the negation essentially leads back to the affirmation. Nonetheless, a rich psycholinguistic literature indicates that negations are cognitively more demanding and require more time to be interpreted than affirmations (e.g., Hoosain 1973; Orenes et al. 2016; Dudschig and Kaup 2021). Thus, using a negation frame to describe an option (e.g., “don’t accept” rather than “reject”) might make the option mentally less accessible than using an affirmative frame. As a consequence, decision makers may spend extra time in decoding the meaning of the options and take a more careful decision with respect to accepting non-necessary cookies.

2.3 Personality Traits

The psychological literature on digital behavior has investigated how the personality traits of decision makers affect their adoption of cybersecurity behaviors, that is, of conducts aimed at protecting their own online security. In particular, this literature has focused on the impact of the Big Five personality traits: Openness, Conscientiousness, Extraversion, Agreeableness, and Neuroticism (see Goldberg 1993).

Openness is related to open-mindedness, preference for variety, and active imagination. Conscientiousness refers to trustworthiness, sense of responsibility, purposefulness, and achievement orientation. Extraversion captures sociability, assertiveness, and the predisposition to working with others. Agreeable individuals tend to be trusting, tolerant, and respectful of other people’s beliefs and ideas. Neuroticism is related to emotional instability and proneness to experiencing negative feelings such as embarrassment, guilt, pessimism, and low self-esteem.

Although findings about the relationships between the Big Five and digital behavior are far from conclusive, there is strong evidence that Conscientiousness is positively correlated with the adoption of cybersecurity conducts, whereas the evidence is less robust for the other traits. Shappie et al. (2020) present evidence of a positive correlation between cybersecurity behaviors and scores in Conscientiousness, Openness, and Agreeableness; Bansal (2011) and Gratian et al. (2018) find a positive correlation with Conscientiousness and Extraversion, Shropshire et al. (2015) with Conscientiousness and Agreeableness, and Halevi et al. (2017) only with Conscientiousness. Finally, Neuroticism seems also to be correlated with cybersecurity behaviors, but the direction of the correlation varies from study to study: Bansal (2011) shows a negative correlation, but Halevi et al. (2017) and Shappie et al. (2020) provide evidence suggesting a positive correlation.

To date only one experiment, by Coventry et al. (2016), has explored the role of personality traits in cookie rejection. The experimental results show a positive correlation of cookie rejection with Neuroticism and a negative correlation with Agreeableness.

Our experiment relates to this literature by assessing the impact of the Big Five personality traits on the decision to reject cookies.

2.4 Other Experiments on Nudges and Cookie Rejection

To the best of our knowledge, only three other experiments have assessed the impact on cookie rejection of nudges that alter the salience and accessibility of options: those of Utz et al. (2019), Bauer et al. (2021), and Graßl et al. (2021).

In their Experiment 2, Utz et al. (2019) present a cookie banner with two buttons, one to accept all cookies (“accept”) and the other to reject non-necessary ones (“decline”). In the control version, the buttons have the same size and background color and thus have equal salience and accessibility. In the treatment version, the authors reduce the visual salience of the rejection button by displaying it with a colorless background, increasing in turn the visual salience of the acceptance option. They show that increasing the relative salience of the acceptance button slightly augments the share of users clicking it (45.6% vs. 41% in the control), but only for those accessing the website from mobile. By contrast, the share of users consenting to cookies among those accessing the website from a computer is lower in the treatment than in the control (20.1% vs. 20.9%, respectively), although the difference is negligible.

Bauer et al. (2021) implement a similar design: in the control, both buttons have the same size and background color. In the treatment, they present the option to accept cookies as a large, green button, and decrease the accessibility of the rejection button by removing it and including the option as a link in the notice (“You can reject cookies by clicking here”). Compared to the control, the treatment banner increases the cookie acceptance rate by 17 percentage points (from 20.15 to 37.25%).

Graßl et al. (2021) use a control banner with two options, “Agree” and “Do not Agree,” presented as two colorless buttons of the same size. In the first treatment, the acceptance button (“Agree”) was colored in blue to increase its visual salience. In the second treatment, the acceptance button was made less accessible by substituting it with a button to customize cookies (“Manage options”), so that the participant could consent to cookies only after clicking on this button. The evidence shows that the visual nudge was ineffective, whereas the accessibility nudge reduced the frequency of cookie acceptance (OR = 0.38; p < 0.05). Importantly, the authors found no significant differences in cookie rejection rates when the two nudges were applied to the rejection option (“Do not Agree”) rather than the acceptance option (third treatment) or when the option to reject cookies was made available only after clicking on “Manage Options” (fourth treatment).

Our experiment differs from those of Utz et al. (2019), Bauer et al. (2021) and Graßl et al. (2021) in several respects. First, we do not use a situation in which the two options have equal visual salience as control. Instead, we make one of the two options more salient than the other in each of our banners. This design was suggested by one of the experimental findings of Utz et al. (2019) and Graßl et al. (2021), who show that when the two options have equal visual salience, increasing the salience of either of them is ineffective. Second, the experiments by Bauer et al. (2021) and Graßl et al. (2021) alter the accessibility of an option by acting on a structural feature of the banner: Bauer et al. (2021) transform the rejection button into a link, and Graßl et al. (2021) substitute the acceptance or rejection button with one to customize cookies. In our experiment, we reduce the accessibility of either the acceptance or rejection option by changing its verbal aspect while leaving the nonverbal appearance unaffected. Finally, Utz et al. (2019) and Graßl et al. (2021), gave participants the option to customize cookies. As mentioned in the Introduction, the pilot we conducted in July 2021 suggested that users tend to avoid the customization option and accept all cookies. In fact, we found that the rate of customization was low (around 10%) and stable across treatments. Therefore, we decided not to present this option in the main experiment but only in the additional session we conducted in October 2023 (details in Appendix 5).

3 Method

3.1 Experimental Design

The experiment involved alterations to a cookie banner. The cookie banner we designed displays an introductory notice that informs participants about how the information collected by cookies is employed; this notice does not change over treatments. Below the notice, the banner presents two options: “Reject non-necessary” or “Accept all cookies.” The visual aspect of these two options and/or the verbal text describing them differ between treatments.

In the control treatment, represented in Fig. 1, the button to accept all cookies is black, and the button to reject them is light gray. Therefore, in this banner the acceptance button is more visually salient than the rejection one. Note also that the buttons’ labels are framed as affirmations.

Fig. 1
figure 1

The control banner

Full size image

In the second treatment, represented in Fig. 2 without the introductory notice, only the salience nudge is applied. Accordingly, the rejection button is black, the acceptance button is light gray, and the buttons’ labels are still framed as affirmations.

Fig. 2
figure 2

The banner with the salience nudge

Full size image

In the third treatment, represented in Fig. 3 without the introductory notice, only the framing nudge is applied. The button to accept all cookies is black, the button to reject them is light gray, but the labels are framed as negations: “Don’t accept non-necessary” and “Don’t reject non-necessary.” Such framing does not alter the outcomes of the two options: “Don’t accept non-necessary” is equivalent to “Reject non-necessary,” and “Don’t reject non-necessary” is equivalent to “Accept non-necessary” and to “Accept all cookies.”

Fig. 3
figure 3

The banner with the framing nudge

Full size image

In the fourth treatment, represented in Fig. 4 without the introductory notice, both the salience nudge and the framing nudge are applied.

Fig. 4
figure 4

The banner with both the salience and the framing nudge

Full size image

If we use capital letters to denote which option is visually salient, and employ the tag “Neg” when the buttons’ labels are framed as negations, we can name treatments 1–4 ACCEPT, REJECT, ACCEPT–Neg, and REJECT–Neg, respectively. The treatments are summarized in Table 1.

Table 1 Salience and framing across treatments
Full size table

3.2 Hypotheses

We expect that participants click the more visually salient button more often. Therefore, when the rejection button is more visually salient, cookie rejection rates will be higher than when the acceptance button is salient.

Hypothesis 1: Rejection of non-necessary cookies is higher (lower) when the rejection (acceptance) button is visually salient. Accordingly, rejection rates are higher in REJECT than in ACCEPT (H1a), and higher in REJECT–Neg than in ACCEPT–Neg (H1b).

We also expect that framing button labels as negations deters users from unthinkingly accepting all cookies, and therefore increases rejection rates:

Hypothesis 2: Rejection of non-necessary cookies is higher (lower) when labels are framed as negations (affirmations). Accordingly, rejection rates are higher in ACCEPT–Neg than in ACCEPT (H2a), and higher in REJECT–Neg than in REJECT (H2b).

Since both the salience and the framing nudge aim at reducing the accessibility of the acceptance option, we posit that their simultaneous use in a cookie banner results in the strongest reduction of acceptance rates:

Hypothesis 3: Rejection of non-necessary cookies is the highest when the rejection button is visually salient and labels are framed as negations, that is, in REJECT–Neg.

The effectiveness of both the salience and framing nudges may be related to the time users spend making the decision. Our Hypothesis 4, articulated in three subhypotheses, addresses the possible relationships between decision times and rejection rates.

First, users may want to access the content of the website in the shortest possible time, and to do so they might click on the most visually salient button without paying too much attention to the written content of the banner. Thus, we hypothesize that the shorter participants’ decision time, the higher the probability that they click the most visually salient button.

Hypothesis 4a: The shorter the decision time, the higher the frequency with which the salient option is chosen.

Second, because the framing of button labels as negations makes it more difficult for users to understand what the two alternatives actually are, we expect longer decision times in negation-framed treatments than affirmation-framed treatments.

Hypothesis 4b: Decision time will be longer in ACCEPT–Neg and REJECT–Neg than in ACCEPT and REJECT.

Third, assuming that the reasoned preference of most users is to reject non-necessary cookies (see the Introduction) and that implementing such reasoned preferences takes more time than unthinkingly accepting all cookies, we expect a positive correlation between decision time and rejection rates.

Hypothesis 4c: The longer the decision time, the higher the frequency with which the rejection option is chosen.

Finally, in the section on personality traits we have seen that they may affect the probability of adopting cybersecurity behaviors. In particular, the results of Coventry et al.’s (2016) study on cookie rejection lead us to expect that the probability of rejecting cookies increases with higher Neuroticism and decreases with higher Agreeableness.

Hypothesis 5: Rejection of non-necessary cookies correlates positively with Neuroticism and negatively with Agreeableness.

3.3 Procedure

The experiment was programmed with oTree (Chen et al. 2016) and conducted online in February 2022. Participants were recruited on Amazon Mechanical Turk and invited to participate in a study on the impact of personality traits on online decisions. Participants could only access the experiment from a computer; users accessing from a mobile device were blocked and invited to change device to participate in the experiment. When clicking on the link to start the experiment, participants were redirected to an external webpage where they could read the description of the study (Appendix 1). After 500 ms, a cookie banner popped up at the center of the screen. The banner could only be closed by pressing on either the acceptance or rejection buttons, thereby requiring participants to interact with the banner and decide on the use of cookies before proceeding to the experiment.Footnote 3 However, it is important to note that no cookies were actually stored on the participants’ browsers, even if they gave their consent. This design choice was motivated by the fact that participants in our experiment were not exposed to the consequences of accepting or rejecting cookies (e.g., they did not receive targeted advertising). Since saving cookies would have had no impact on the participants’ behavior, we decided not to install unnecessary files on their browsers. Participants were informed that their interaction with the cookie banner was part of the study and that no cookies were actually installed only at the end of the experiment, to avoid jeopardizing the truthfulness of responses. This kind of disclosure, known as “debriefing,” is a common practice in experiments in which information is withheld from participants (e.g., Greenspan and Loftus 2022).Footnote 4

As discussed above, the experiment employs a 2 × 2 between-subject design so that each participant was presented with only one of the four banners. Subsequently, the participant was required to undertake a short personality test based on the Big Five taxonomy (Appendix 2) and a questionnaire on habits and familiarity with cookies (Appendix 3). For their participation, respondents were paid a fixed sum of $0.25 for a commitment of approximately 5–6 min. The payment is above the median of $2 per hour for a task on Amazon Mechanical Turk (Hara et al. 2018).

A final comment on the experimental procedure is in order. Respondents on Amazon Mechanical Turk have an incentive to complete their tasks as quickly as possible, for they maximize their earnings by maximizing the number of tasks they perform each day. We believe that this attitude does not weaken the significance of our findings because also web users want to access the websites they are interested in as quickly as possible.

3.4 Sample

We collected 362 complete responses. One observation registered a decision time of zero and was excluded because we conjectured that a timing error had occurred in the server. Two observations were excluded because their decision times were considerably longer than those of the observations in the 99th percentile. We also excluded an observation related to a browser bot. Thus, the final sample comprises 358 complete observations.

Sample mean age is 37.87 (SD = 10.92), ranging from 20 to 70 years of age; 196 participants (54.75%) are males. Most participants hold a bachelor’s degree (235, 65.64%), 99 (27.65%) hold a master’s degree, and 24 (6.70%) have a high school diploma or a lower degree. Table 2 reports the descriptive statistics for the main demographic variables by treatment and overall. An ANOVA and chi-squared tests show that differences across treatments are not statistically significant.

Table 2 Descriptive statistics for demographic variables
Full size table

4 Results

4.1 Descriptive Results

Our variable of interest is a dummy, labelled as Rejected, denoting whether a participant has rejected non-necessary cookies or not. Descriptive statistics for Rejected across the four treatments are reported in Table 3 and graphed in Fig. 5.

Table 3 Descriptive statistics for cookie acceptance rate and decision time
Full size table
Fig. 5
figure 5

Cookie rejection rate across treatments

Full size image

Figure 5 reports cookie rejection across treatments, measured as the proportion of subjects who rejected non-necessary cookies. “ACCEPT” and “REJECT” denote which button was visually salient; suffix “Neg” denotes the negation framing.

As Table 3 and Fig. 5 show, the control banner with the salient acceptance button and the affirmation framing (ACCEPT) elicited the lowest rate of cookie rejection (27%). The rejection rate was higher for the visually salient rejection button, REJECT (34%), and it was higher again when the acceptance button was salient but labels were framed as negations, as in ACCEPT–Neg (45%). Finally, the rejection rate was the highest when both manipulations were applied, as in REJECT–Neg (80%).

Table 3 also reports the decision time, measured as the seconds that passed from the instant the banner appeared on participants’ screens to the instant they clicked on either button. On average, participants took approximately 23 s to make their decision. Reading the full introductory notice in the cookie banner takes approximately 15–20 s, but only about 30% of the sample had a decision time longer than that. This suggests that most participants took their decision without reading the full notice, possibly by focusing just on the two options available. Moreover, the median decision time was slightly higher in negation-framed treatments (13.72 s in ACCEPT–Neg and 11.90 in REJECT–Neg) than in affirmation-framed treatments (5.98 in ACCEPT and 8.25 in REJECT). This suggests, as expected, that participants in negation-framed treatments spent some extra seconds interpreting the buttons’ labels.

4.2 Hypothesis Testing

4.2.1 H1 (Visual Salience)

Compared to the control banner (ACCEPT), the salience nudge (REJECT) increases the rejection rate by 7 percentage points (pp). However, this difference is not statistically significant (χ2(1) = 1.05; p = 0.305, Holm–Bonferroni corrected). When labels are framed as negations (as in ACCEPT–Neg), applying the salience nudge (as in REJECT–Neg) increases the rejection rate by 35 pp; this difference is statistically highly significant (χ2(1) = 23.23; p < 0.0001, Holm–Bonferroni corrected). Taken together, these findings suggest that the salience nudge may be effective only when used within a negation frame, providing support for H1b but not for H1a.

4.2.2 H2 (Negation Framing)

Compared to the control banner (ACCEPT), framing the button labels as negations (ACCEPT–Neg) increases the rejection rate by 18 pp (χ2(1) = 6.82; p = 0.018, Holm–Bonferroni corrected). When the rejection button is visually salient (REJECT), the negation framing (REJECT–Neg) increases the rejection rate by 46 pp (χ2(1) = 39.76; p < 0.0001, Holm–Bonferroni corrected). These findings support both H2a and H2b.

4.2.3 H3 (Combined Nudges)

The highest reduction in cookie acceptance occurs when both nudges are applied conjointly. Compared to the control banner (ACCEPT), enhancing the visual salience of the rejection button and framing labels as negations (REJECT–Neg) raises cookie rejection by 53 pp (χ2(1) = 52.18; p < 0.0001, Holm–Bonferroni corrected). This supports Hypothesis 3.

Notably, the combined impact of the two nudges (+ 53 pp in cookie rejection) is larger than the sum of their individual effects (7 pp + 18 pp = 25 pp). This outcome can be explained by hypothesizing that, when users do not understand clearly what the options are, they tend to choose the salient option more frequently than they would do if the meaning of the options was clear. In other words, when users are puzzled about the meaning of the options, the impact of salience on choice behavior is amplified. In our setting, when the framing nudge is applied and the button labels are written as negations (ACCEPT–Neg and REJECT-Neg) users may indeed not understand clearly what the two options are. Therefore, the impact of the framing nudge on rejection rates in ACCEPT–Neg may be partially counteracted by the amplified effect of salience, which could lead some disoriented subjects choosing the salient option and thus accepting all cookies. By contrast, in REJECT–Neg, the impact of the framing nudge is reinforced by the amplified effect of salience, because disoriented subjects choose the salient option and therefore reject non-necessary cookies. At any rate, this hypothesis would require additional research to be thoroughly substantiated.

4.2.4 H4 (Decision Time)

First, we tested whether the time spent deciding is negatively correlated with the frequency with which the salient option is chosen (H4a). To do so, we created a dummy variable, Salient Clicked, specifying whether the button clicked by the participant was the visually salient one, and ran a logistic regression with this variable as dependent variable and Decision Time as regressor. The results from the regression show a positive but very modest impact of decision time on the probability of clicking the most salient button (OR = 1.001); moreover, this effect is not statistically significant (p = 0.639). Therefore, H4a is not validated.

Second, we tested whether framing the button labels as negations increases decision time (H4b). We found that the median decision time is slightly higher in negation-framed treatments (13.36 s in ACCEPT–Neg and 11.90 in REJECT–Neg) than in the corresponding affirmation-framed treatments (5.98 in ACCEPT and 8.25 in REJECT). A pairwise Mann–Whitney test shows statistically highly significant differences between decision time in ACCEPT–Neg and ACCEPT (W = 5331; p < 0.0001, one tail, Holm–Bonferroni corrected), and between REJECT–Neg and REJECT (W = 4704; p = 0.031, one tail, Holm–Bonferroni corrected). Overall, these results support H4b.

Finally, a logistic regression shows that the longer the decision time, the lower the frequency with which the rejection option is chosen (OR = 0.999; p = 0.769). This contrasts with our conjecture in H4c. However, the effect of decision time is not statistically significant, and ultimately H4c is not validated.

4.2.5 H5 (Personality Traits)

To test the impact of personality traits on the decision to reject cookies, we ran a logistic regression using the scores on the Big Five personality test as regressors (see Appendix 4, Table 4). The results show that an increase in the score on Neuroticism raises the probability of rejecting cookies (OR = 1.37; p = 0.054), whereas an increase in Agreeableness decreases it (OR = 0.73; p = 0.048). The direction of the correlation for both traits accords with previous findings on cookie rejection (Coventry et al. 2016). Nevertheless, there appears to be a statistically modest association between cookie rejection and these two traits. In any case, for Agreeableness we consider Hypothesis 5 to be validated.

One possible explanation for the lack of significance in the correlation with Neuroticism is that neurotic individuals in our experiment perceived the request to consent to cookies as less threatening than they would have on other websites, perhaps because they knew they were browsing a website developed for research rather than commercial purposes. The fact that Agreeableness is negatively correlated with cookie rejection is consistent with the knowledge that agreeable individuals tend to be more trusting of people and, in a research setting, they might have been even more trusting of the experimenters and their cookies.

In addition, and beyond the scope of our Hypothesis 5, results show that cookie rejection becomes more likely with increases in Conscientiousness (OR = 1.311; p = 0.089) and Extraversion (OR = 1.44; p = 0.018), although only the latter effect is statistically significant. The positive correlation between Extraversion and cookie rejection is a minor but original finding of our experiment. It may be explained by considering that extroverted individuals tend to be more assertive than introverts and, as a result, they might also be less concerned about rejecting cookies.

5 Conclusions

In this paper, we report an experimental test of individual and combined effectiveness of two digital nudges, a salience nudge and a framing nudge, in increasing the rate at which web users reject non-necessary cookies. The salience nudge increased the cookie rejection rate by 7 percentage points (pp), from 27 to 34%, but this result is not statistically significant. The framing nudge increased the cookie rejection rate by 18 pp (45%) and the combination of the two nudges by 53 pp (80%); these last two results are statistically significant. We also explored how the frequency with which users reject cookies is related to the time they spend deciding and to their personality traits. Only two of our research hypotheses were validated statistically significantly: that decision times are longer in negation-framed treatments than in affirmation-framed treatments and that higher scores in Agreeableness are negatively correlated with rejection rates. These experimental findings appear interesting not only for researchers working on nudges but also for policy makers who seek to enhance the security of web users.

On the research side, our experiment contributes to the literature on nudges and their effectiveness (for a discussion, see Benartzi et al. 2017; Congiu and Moscati 2022), by suggesting that a type of nudge which has so far received limited attention in the literature, namely negation framing, can be quite effective. In contexts in which individuals tend to make decisions in an unthinking and impatient way, negation framing may block impulsive choices, promote cognitive deliberation, and thus lead individuals to consider the options with more attention. This explanation is consistent with the cognitive literature on dual-system theories, and specifically with the literature on the relationship between automatic and reflective thinking (Kahneman 2011). Although there is no full consensus on how the two systems interact (see, e.g., Evans and Stanovich 2013; Kruglanski 2013), the prevalent view is that individuals operate by default through the automatic thinking to solve their decision problems, and then resort to reflective thinking when the automatic one fails to identify a satisfactory solution. Considered from this point of view, negation framing appears an effective tool to block automatic thinking and activate reflective thinking.

In terms of policy implications, the findings of our experiment identify potential avenues for further protecting the privacy and security of web users. Specifically, they suggest that requiring companies to obtain users’ consent to cookies may be ineffective. When cookie banners are designed in a way that leads a large majority of individuals to accept all cookies, their online privacy and security are not well protected. A policy implication of our paper is therefore that, to be effective, legislation about online privacy and security should introduce specific guidelines for the design of cookie banners.

First, the button for customizing cookies should be replaced by, or at least supplemented with, a button for straightforwardly rejecting non-necessary cookies, as users appear to avoid the customization process. The findings of the additional experimental session we conducted in October 2023 (N = 188; see Appendix 5) indicate that a cookie banner featuring buttons labeled “Manage cookies” and “Accept all cookies” results in 97% of users accepting all cookies, regardless of the salience of either button. Thus, when compared to other potential interventions, offering the customization option appears to have a negative effect on cookie rejection.

Second, the design should hinder impulsive choices and lead individuals to engage in some form of deliberation before clicking on a button. With respect to this goal, the results of our paper suggest that simply making the rejection option salient is not very effective, for in REJECT 66% of participants still accepted all cookies. Consequently, some additional modification is needed to the design of cookie banners. In particular, we investigated the efficacy of framing the labels of buttons as negations, and found that the combination of the framing nudge with the salience nudge reduced the proportion of participants who accept all cookies to 20%. Therefore, introducing these kinds of modification to the design of real-world cookie banners may indeed contribute to protecting people’s online privacy and security.