Persetujuan Cookie: Pengguna Mengklik 'Terima' Tanpa Membaca & Regulator Mengetahuinya

Cookie consent was supposed to give people control over tracking. Instead it has become the clearest example of a legal mechanism collapsing into ritual. The same choice is presented on every site, through cluttered interfaces, vague wording and buttons of deliberately unequal weight, and most people resolve it the same way: click the biggest button and get on with the page.

Regulators are not blind to this. Across 2025 and 2026 the debate moved away from the polite fiction of "informed consent" toward a blunter question authorities now ask directly: was the consent real, or was it manufactured by the interface? Fines in France, a sweep of the UK's thousand busiest sites, and coordinated US action on opt-out signals all point the same way.

This article sets out what the law requires in the EU, the UK and California, what the evidence says about how people behave in front of a banner, what regulators did in 2025 and 2026, and what changes next. It is general information, not legal advice; specific compliance questions belong with a qualified privacy lawyer in your jurisdiction.

What the law actually requires

Two separate rules apply in Europe, and conflating them is the most common source of confusion.

The ePrivacy Directive (2002/58/EC) governs storing information on, or reading it from, a user's device. Article 5(3) permits this only with the user's consent after clear and comprehensive information, subject to two narrow exceptions: storage or access strictly necessary to transmit a communication, or strictly necessary to provide a service the user explicitly requested. It applies whether or not the information is personal data, so a device fingerprint, a pixel or a local storage key is caught the same way a cookie is.

The GDPR supplies the standard that consent must meet. Article 4(11) defines it as a freely given, specific, informed and unambiguous indication of the user's wishes, made by a statement or clear affirmative action. Recital 32 says silence, pre-ticked boxes and inactivity do not amount to consent. Article 7(3) gives a right to withdraw at any time and requires withdrawal to be as easy as giving consent.

Together these explain why so many banners fail. Loading analytics and advertising tags before any interaction breaches Article 5(3) whatever the banner later says. A one-click "Accept all" against a two-click refusal strains "freely given". A site with no way to change your mind later runs against Article 7(3).

The UK position after the Data (Use and Access) Act

The UK applies the same structure through the Privacy and Electronic Communications Regulations, and the Data (Use and Access) Act 2025 widened the exceptions. ICO guidance now describes five: transmission of a communication; strictly necessary provision of a requested service; collecting information solely for statistical purposes about how a service is used; adapting how a service appears or functions to a user's preference; and locating a device to provide emergency assistance.

The statistical and appearance exceptions are the practical change, and narrower than they look. Both are conditional on clear and comprehensive information plus a simple, free means of objecting, and the statistical exception does not cover tracking individuals or advertising. Analytics used to build advertising audiences is not analytics for this purpose.

California works the other way around

The CCPA, as amended by the CPRA, does not use a consent-before-tracking model for most adult data. It gives consumers a right to opt out of the sale or sharing of personal information, requires at least two designated methods for making that request, and treats opt-out preference signals such as the Global Privacy Control as valid requests. The California Attorney General's guidance states that GPC "must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information."

California also legislates against manipulative design: where the statute requires consent, agreement obtained through dark patterns is not consent. The two regimes converge on one test from opposite directions. Europe asks whether the yes was real; California asks whether the no was respected.

Question	EU / UK	California
Default before any user action	No non-essential storage or access permitted	Tracking may occur until the consumer opts out
Model	Opt-in consent, with narrow exceptions	Opt-out of sale or sharing
Browser signals	Not currently mandatory; proposed for the future	Global Privacy Control must be honoured
Withdrawal	Must be as easy as giving consent (GDPR Art. 7(3))	Opt-out must be easy to exercise and honoured
Manipulative design	Undermines "freely given" and "unambiguous" consent	Consent obtained via dark patterns is not consent
Scope of the device rule	All information on terminal equipment, personal or not	Tied to personal information as defined by the CCPA

What the evidence says about how people actually decide

The behavioural picture is not flattering. In DataReportal's Digital 2025 privacy analysis, drawing on GWI research, only 34.5% of online adults said they reject cookies at least some of the time, implying that around two-thirds routinely accept and move on.

UK research commissioned by the ICO from Savanta, surveying 2,316 adults with fieldwork in March 2024, fills in the detail: 46% accept cookies specifically to dismiss the notice quickly, 24% sometimes read notices but find them confusing, and only 7% read them regularly to understand how their information will be used. Forty-seven per cent report limited or no understanding of what happens to their data once cookies are accepted, and 44% had shared more personal information than they wanted at least once a week to access a site or app.

That is not informed consent. It is friction management. A tool such as Clideo's video maker may set out its cookie practices plainly, but be honest about your own habits: you almost certainly did not read the last agreement you accepted either.

Academic work agrees. "Accepting cookies: Nudging, deceptive patterns and personal preference", published in Computers in Human Behavior in 2025, found that design factors such as the effort a choice requires and the visual prominence of buttons materially shaped acceptance, and that many participants behaved consistently across banners rather than deliberating each time. For those users the banner is not a privacy decision at all. It is a trigger for a habit, and the interface designer largely decides which habit forms.

What regulators did in 2025 and 2026

Enforcement has moved from isolated examples to systematic scrutiny, and the decisions define where the line now sits.

On 1 September 2025 France's CNIL fined SHEIN €150 million under Article 82 of the French Data Protection Act for placing cookies before consent, giving incomplete information about their purposes, failing to identify the third parties setting them, and continuing to place cookies despite refusals. The regulator cited the scale of processing, roughly 12 million French visitors a month. No compliance order followed, as the company changed its site during proceedings.

The same day, the CNIL fined Google €325 million in total, split as €200 million against Google LLC and €125 million against Google Ireland, over advertisements displayed between emails in Gmail without consent and over an account-creation flow in which accepting personalised advertising cookies was easier than refusing them. Google was given six months to comply, with a penalty of €100,000 per day per company for delay.

In the UK the ICO ran a programme across the 1,000 most-visited websites, testing three things: that non-essential cookies are not set before consent, that refusing is as easy as accepting, and that cookies are not placed without consent. Its 4 December 2025 update reported 979 of those sites passing: 415 already compliant, 564 improved after ICO engagement, 17 enforcement notices issued, and 21 still non-compliant. On 29 April 2026 the ICO published final guidance on the use of storage and access technologies, covering cookies, pixels and device fingerprinting under PECR as amended by the DUAA, reporting that 99% of the top 1,000 UK sites now meet its banner standards.

US enforcement targeted the other end of the process. In May 2025 the California Privacy Protection Agency fined the retailer Todd Snyder $345,178 after a misconfigured privacy portal blocked opt-out requests for forty days and the company demanded identity verification before allowing an opt-out; the agency's enforcement head noted that using a consent management platform does not remove your own responsibility. In July 2025 the California Attorney General announced the largest CCPA settlement to date, $1.55 million from Healthline, for failing to honour opt-outs including GPC signals, sharing article titles that revealed likely medical diagnoses, missing contractual terms with third parties, and a consent banner that claimed to disable tracking cookies but did not. That September, California, Colorado and Connecticut launched a joint sweep of businesses not processing GPC opt-outs.

Where banners fail in practice

A 2026 measurement study of roughly 14,000 websites across the EU, the US and top-ranked global domains catalogued how these failures evolved. Cookies are frequently set before consent or despite explicit rejection, revocation is routinely obstructed, and opt-out interfaces often fail to stop third-party tracking. On sites that obstruct withdrawal, the researchers measured cookies increasing by 25% on average, alongside newer patterns including pay-to-opt-out schemes and fake opt-outs that change the interface without changing the tracking. The recurring failures cluster into a short list:

Pre-consent loading. Tags fire on page load, before any interaction, which is a breach regardless of banner wording.
Asymmetric effort. One click to accept, two or more clicks and a scroll to refuse.
Visual weighting. A saturated "Accept all" button beside a low-contrast, text-only reject link.
Obstructed revocation. No persistent way to reopen preferences once the banner is gone.
Ineffective rejection. The interface records a refusal while third-party scripts keep running.
Vague purposes. "Improve your experience" instead of a description of who receives the data and why.

Most of these problems are detectable in an afternoon with a browser and a few free tools. Work through the flow in order:

Open the site in a clean private window with developer tools recording, and do nothing. Anything in the cookie jar or local storage at that point that is not strictly necessary is already a problem.
Inspect the response headers to see what the server sets and with which attributes. A website header checker surfaces Set-Cookie headers and security directives without digging through the network tab.
Confirm secure transport first, since Secure and SameSite attributes only mean something over HTTPS. An HTTPS checker verifies this end to end.
Count the clicks to refuse against the clicks to accept. If they differ, you have an Article 7 problem in Europe and dark-pattern exposure in California.
Measure the buttons, not your impression of them. Run the accept and reject controls through a colour contrast checker; a large gap in contrast ratio is defensible evidence of nudging.
Reject everything, reload, and re-check the cookie jar. Anything that reappears is the failure regulators fined SHEIN and Healthline for.
Find the way back. Confirm a persistent, always-reachable control to change or withdraw consent, and that using it deletes cookies already set.
Capture the evidence. A website screenshot generator gives dated images of each banner state, which is what you will want if a regulator asks what users saw last quarter.
Check the cost to users. Consent platforms are heavy third-party scripts; a Core Web Vitals checker shows what the banner does to loading and responsiveness.

The banner must also agree with your written disclosures; where the two name different purposes or recipients, the mismatch is itself the finding. A privacy policy generator is a reasonable way to draft categories, purposes and recipients in a structure a reviewer can follow, but treat the output as a starting point for legal review, not a finished compliance document.

What is changing next

Policymakers now treat consent fatigue as a structural flaw rather than a user-education failure. In the Digital Omnibus package proposed on 19 November 2025, the European Commission observed that users face countless pop-ups, frequently do not understand what they are agreeing to, and click whatever gets them to the content.

The proposal would move the terminal-equipment rules out of the ePrivacy Directive and into the GDPR, exempt defined low-risk purposes such as aggregate audience measurement, require that a user's choice be respected for at least six months, and support centrally expressed preferences that sites must honour. The Commission estimates savings of more than €800 million a year for businesses, and the shift brings the area under GDPR enforcement levels of up to 4% of global annual turnover.

This is a proposal, not law. In a joint opinion dated 11 February 2026 the EDPB and EDPS supported the goal and backed machine-readable expressions of user choice, while warning of the difficulties of running two regimes for personal and non-personal data. Expect the details to move, and do not build a compliance programme around an unagreed text.

Frequently asked questions

Only if you store or access information on a user's device beyond the narrow exceptions. A site using nothing but strictly necessary cookies, or in the UK the statistical and appearance exceptions with their information and objection conditions, needs clear disclosure but not a consent banner. Many sites could remove the banner by removing the tags behind it.

Is "Accept all" or "Continue browsing" ever enough on its own?

Continuing to browse is not consent under the GDPR standard: it is neither unambiguous nor a clear affirmative action. An "Accept all" button can be valid consent, but only where refusing is equally available. Regulators have repeatedly treated accept-only and accept-versus-buried-settings layouts as defects rather than design preferences.

No. A CMP is a tool, and misconfiguration is common: tags firing outside its control, portals that silently stop processing requests, categories mapped to the wrong purposes. The Todd Snyder decision made the point directly; responsibility stays with the business operating the site.

What is the Global Privacy Control and do I have to honour it?

GPC is a browser-level signal communicating an opt-out of the sale or sharing of personal information. The California Attorney General's position is that covered businesses must honour it, and California, Colorado and Connecticut ran a coordinated sweep in September 2025 looking for those that do not. There is no equivalent binding requirement in the EU or UK today, though the Digital Omnibus points that way.

How long can we keep asking someone who said no?

Current EU law sets no single number, but re-prompting on every page view undermines any argument that the refusal was respected, and the CNIL has long favoured storing a refusal for a meaningful period rather than re-asking immediately. The Commission's proposal would set a floor of six months, a reasonable planning assumption even before it is law.

Are the fines realistic for a small site?

The headline numbers reflect scale: SHEIN's €150 million and Google's €325 million involved millions of users. But the ICO's programme reached 1,000 sites of ordinary size, and California's actions have landed in the hundreds of thousands of dollars for administrative failures rather than deliberate abuse. The realistic risk for a smaller site is a compliance letter, a deadline, and engineering time under pressure.

The question regulators now ask

The web has normalised a pseudo-choice architecture in which speed beats comprehension, repetition kills attention, and compliance is measured by the presence of a banner rather than the quality of the decision it enables. The 2025 and 2026 evidence is consistent: users accept without reading, most do not understand what follows, interface design determines the outcome, and regulators have both the data and the appetite to act.

The era in which a company could end the conversation by saying the user consented is narrowing. The question is no longer whether consent was clicked. It is whether it was real, and whether your own flow would survive somebody checking.