Cookie banners were meant to give people a choice and instead taught a generation to click whatever makes the overlay disappear. The mechanism by which a consent requirement became a consent ritual, and what would have to change for the word to mean anything.
What consent is supposed to mean
Four properties, and the rest of this measures the banner against them one at a time.
Consent is freely given — refusing costs you nothing meaningful. It is specific — it covers a described thing rather than everything. It is informed — you could know what you agreed to. And it is revocable — you can withdraw as easily as you gave it.
How the banner fails each one
Not freely given. Accepting is one click. Refusing is a click, then a panel, then sometimes a list of toggles, then a save. The asymmetry is the point.
Not specific. One button covers hundreds of recipients, described as partners and counted rather than named.
Not informed. Reading the list would take longer than the visit. Information that cannot be read in the time available has been disclosed without being communicated.
Not revocable. Withdrawal is buried, and withdrawing does not reach back to what was already collected and shared onward. The door opens one way.
Why it is tiring on purpose
Friction asymmetry is a design achievement, not a design failure. Accept is large and coloured. Refuse is grey, small, or one level down behind a word like manage.
Fatigue is the mechanism rather than a side effect. The banner does not need to persuade anybody. It needs to be present at a moment when the visitor wants something else, and to make one path shorter than the other.
The part that is not the site's fault
Worth saying, because it is usually left out.
A publisher funded by advertising cannot unilaterally leave the system it depends on. The banner reflects a supply chain the site did not build and mostly cannot inspect.
Rule-makers wanted people to have a choice. The industry supplied the cheapest artefact that satisfied the letter of the requirement. That outcome was predictable from who bore the cost: compliance was paid for in the user's attention, which does not appear on anybody's balance sheet, so nothing pushed back against spending it.
What real consent would require
No collection by default. Everything else follows from reversing the starting position.
Parity of effort. Refusing takes exactly as many actions as accepting, in controls of the same size and prominence.
Named recipients. Not a count. Names, where the data goes.
Asked when it matters. At the point a thing is collected and for a stated reason, rather than as a toll gate on arrival before anything has happened.
Expiry. A choice made once, while distracted, should not bind indefinitely.
What a person can do meanwhile
Browser-level controls accomplish more than any answer to a banner, because they act on what loads rather than on what is promised.
Refusing is worth the extra clicks on sites you use repeatedly. On a site you will never see again, the arithmetic is genuinely different and it is not weakness to notice that.
And read the banner as information rather than as a decision. A site declaring several hundred partners has told you something useful about itself before you have clicked anything at all.
Close
The word consent is doing unpaid work in this arrangement — lending the vocabulary of autonomy to a process arranged so that one answer is easier than the other.
Noticing that is most of the defence, and it costs nothing.