How Website Owners Use Consent Management Platforms: An Interview Study

Website owners must bring their consent interfaces into compliance with EU privacy and data protection regulation. Previous research indicates consent interfaces are often designed to manipulate users, violating consent requirements under GDPR. However, little empirical work has investigated how website owners configure, implement, and maintain consent interfaces, or what causes their (non)compliance. We conducted 12 interviews with website owners in Denmark from websites where their compliance had improved over the course of three years. Our results show that while they cared about privacy and legal compliance, most knew or cared little about their consent interface. Rather, the configuration and maintenance of the interfaces happened in collaboration with a diverse network of actors, with third-party consent management platforms playing a central role. We discuss the implications of this distribution of responsibility for regulators aiming to improve compliance, for legal attribution of controllership, and for researchers untangling the incentive structures and power dynamics surrounding online privacy.