Who Really Rejects
Cookies in 2026

Most "consent rate" statistics collapse five distinct visitor outcomes into a binary. A visitor who clicks "Reject all" made an active privacy choice. A visitor who closed the banner made none — and in a compliant EU setup, both leave you without non-essential cookies. Conflating them overstates how many people actively object and understates how many simply disengage.

• Accept all — grants all non-essential categories. The only group fully trackable.
• Accept selected — grants some categories (e.g. analytics but not marketing). Small but real; ~0.4% open settings at all on typical banners.
• Reject all — an explicit, one-click "no." Legally clean, fully counted as non-consent.
• No choice (close/ignore) — dismisses via X, clicks away, or ignores. Under GDPR/ePrivacy this is not consent; under US opt-out it often counts as consent.
• Abandonment — leaves the site before interacting at all. Frequently invisible in CMP dashboards, which only log rendered-and-interacted sessions.

The largest behavioral dataset (1.2M interactions) shows only 25.4% accept and 68.9% close or ignore — an extreme case worth separating from CMP averages. That study skews B2B and toward banners without a first-layer reject button, which inflates the "no-choice" share. Where a one-click reject exists, academic and CMP data converge on ~50–60% rejection.

• Advance Metrics (1.2M B2B interactions, 2018–2023): 25.4% accept all, 0.4% open settings, 68.9% close/ignore. [1]Advance Metrics Cookie Behaviour Study
• etracker Consent Benchmark 2025 (500 German sites, data to May 2025): 40–54% consent; ~60% of visit data lost on average with a compliant banner. [2]etracker Consent Benchmark 2025
• EU CMP longitudinal (EU domains, 2015–2023, pub. 2024): ~60% reject with one-click reject-all; ~90% accept if reject needs >1 click. [3]Longitudinal Analysis of CMPs in the EU
• Aarhus cross-country study (254,148 sites, 31 EU + UK, 2025): 67% show a banner, only 15% GDPR-compliant, 45% offer a reject option. [4]A Cross-Country Analysis of GDPR Cookie Banners
• ICO (its own UK site, 2019): tracked traffic fell 90.8% after adopting a fully compliant banner — the ceiling for non-consent. [5]ICO consent rate dropped 90% after best practices

Read the incentive behind every number. CMP vendors and cookieless-analytics tools both have reasons to shape the framing.

• CMP vendors (etracker, Usercentrics/Cookiebot, CookieYes) sell consent tooling — some emphasize how recoverable data is via Consent Mode, softening loss figures.
• Cookieless-analytics vendors (Plausible, Matomo, Clickport) headline the highest loss figures (60–70%, "90.8%") to sell banner-free measurement.
• Academic studies carry the least commercial bias but often use lab panels or synthetic banners rather than live traffic, limiting generalizability.
• CMP dashboards undercount abandonment — they typically log only sessions where the banner rendered and was interacted with, hiding pre-choice leavers.

Friction is the strongest suppressor of rejection. When "Reject all" sits on the first layer, ~60% reject. When it hides behind "Manage preferences," acceptance climbs to ~90% — most people click whatever ends the interruption fastest, regardless of privacy preference. [3]Longitudinal Analysis of CMPs in the EU

• Only ~0.4% of visitors ever open the second-layer settings on a typical banner. [1]Advance Metrics
• Even among "GDPR-compliant" banners, 38% still visually steer toward Accept through color and contrast. [7]Salient Object Detection / GDPR banners 2025

Germany and France sit at the low-acceptance extreme; the US at the high extreme. In Germany and France, fewer than 25% accept analytics cookies on a compliant banner; US acceptance exceeds 80% under the opt-out model, where ignoring the banner counts as consent. A global site's blended rate is just a weighted average of these poles. [8]Kukie.io 2026 Benchmarks

• Returning > first-time: logged-in and returning visitors accept more; a site's new/returning mix shifts its aggregate rate. [8]Kukie.io 2026
• Industry range is ~40 points: healthcare 60–67% and finance 55–62% at the top; ad-supported media 23–30% and real estate/energy 20–30% at the bottom.
• Blocking access ("cookie walls"/pay-or-consent): forces acceptance far higher, but is increasingly challenged by EU regulators as not "freely given."
• Legitimate interest: when vendors are set to LI rather than consent (common in IAB TCF), tracking can proceed without an explicit opt-in — inflating apparent "coverage" even as opt-in consent stays low.
• Age: younger users accept less often; privacy attitudes track behavior. [9]Accepting cookies: Nudging, deceptive patterns and personal preference, 2025

For a general EU/UK site with a compliant banner, plan on tracking ~40% of real traffic — treat 60% as invisible to cookie-based analytics and marketing. Split that 60% roughly as: ~35 pts explicit reject, ~20 pts no-choice, ~5 pts abandonment (higher on mobile). Build measurement around this, not around what your CMP dashboard reports.

• Analytics: assume your cookie-based tool sees 30–45% of sessions; adopt cookieless or server-side measurement for a 100% baseline, and reconcile the two.
• Attribution: non-consented users convert ~33% faster and carry ~5% higher basket value — the visitors you can't see are disproportionately your best, so cookie-based ROAS is biased upward. [11]Exactag non-consent bias study
• A/B testing: a 40% sample cuts statistical power and lengthens tests; run experiments on consent-independent (server-side / first-party) instrumentation where possible, and never assume the consented cohort represents all users.

Published consent rates range from 4% to 96% because the studies are measuring different things under different conditions — not because users are inconsistent. A single visitor pool produces wildly different numbers depending on five levers:

• Banner design — the dominant variable; 4% to 47% rejection on identical audiences (Fig. 3).
• Denominator — some rates exclude abandonment and no-choice sessions entirely, inflating "acceptance."
• Geography — a US-blended dataset can read 80%+ acceptance; a German one under 25%.
• Definition of "consent" — opt-out regimes count ignoring as consent; opt-in regimes do not. This alone flips the headline number.
• Method — live CMP logs, design audits, lab experiments, and attitudinal surveys are not comparable, yet get quoted interchangeably.

On a compliant EU/UK banner in 2026, plan for ~40% of visitors trackable and ~60% not — with explicit rejection (~30–45%) being the largest but not the only reason. The remaining non-consent comes from people who close, ignore, or leave before choosing; treating them as "rejecters" overstates active privacy intent, while treating "did not accept" as fully understood understates how much of it is disengagement and friction.

• The single most defensible claim: banner design, not user preference, sets your consent rate. Give an equal one-click reject and expect ~50% acceptance; hide it and expect ~90%.
• Country dominates after design: Germany/France under 25% acceptance, US over 80%.
• Never plan analytics, attribution, or experimentation on the consented sample alone — it is a biased minority, tilted toward your highest-value, fastest-converting users.
• The safest single planning number for a general EU/UK site: ~60% untrackable.