The Privacy Placebo: Diagnosing Consent Burden through Performative Scrolling
Pith reviewed 2026-05-10 06:13 UTC · model grok-4.3
The pith
Structural design choices in consent interfaces raise user effort without providing meaningful control.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The Performative Scrolling Index (PSI) is a reproducible interface-audit metric that quantifies pre-choice burden by summing four observable components—distance, time, focus loops, and hidden reveals—before a meaningful non-accepting alternative becomes visible and actionable. Companion signals such as AAI, CSI, and divergence serve only as interpretive aids. Application of PSI to common consent flows demonstrates that structural choices like offscreen alternatives, fragmented disclosure, and staged modal flows increase this measurable friction without improving meaningful control.
What carries the argument
The Performative Scrolling Index (PSI), a metric that quantifies pre-choice burden by combining four observable interface costs (distance, time, focus loops, hidden reveals) before a non-accept option appears.
Load-bearing premise
The four observable components form a sufficient and unbiased proxy for burden independent of actual user comprehension or decision outcomes.
What would settle it
A controlled comparison in which users achieve equivalent or higher comprehension and different choice distributions under high-PSI flows versus low-PSI flows would undermine the claim that added friction does not improve control.
Figures
read the original abstract
While consent banners and privacy policies invite users to read and choose, many choices are shaped by repeated, low-yield interaction routines rather than deliberation. This paper studies performative scrolling: slow, low-information interaction that can signal attention to consent without substantially improving understanding. We present the Performative Scrolling Index (PSI), a reproducible interface-audit metric for measuring pre-choice burden before a meaningful non-accepting alternative becomes visible and actionable. PSI decomposes burden into four observable components: distance, time, focus loops, and hidden reveals. In this paper, PSI is the primary burden metric, while companion signals such as AAI, CSI, and divergence are used as secondary interpretive audit aids rather than standalone validated scales. We also provide a least-effort audit protocol, design-side invariants, a worked example, and a medium-scale live deployment across desktop and mobile conditions under pointer and keyboard traversal policies. Together, these analyses show how structural choices such as offscreen alternatives, fragmented disclosure, and staged modal flows can increase pre-choice friction without improving meaningful control. PSI is not a measure of comprehension or legal sufficiency; rather, it is a diagnostic of interface-side burden intended to support reproducible audits and redesigns.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript introduces the Performative Scrolling Index (PSI) as a reproducible interface-audit metric to quantify pre-choice burden from performative scrolling in consent banners. PSI decomposes burden into four observable components (distance, time, focus loops, hidden reveals) and is supported by a least-effort audit protocol, a worked example, and a medium-scale live deployment across desktop/mobile under pointer/keyboard policies. The central claim is that structural choices such as offscreen alternatives, fragmented disclosure, and staged modal flows increase friction as measured by PSI without improving meaningful control, while explicitly noting that PSI itself is not a measure of comprehension or legal sufficiency.
Significance. If the PSI proxy can be linked to actual user outcomes, this work would supply a practical, observable-based tool for auditing consent interfaces in HCI and privacy research, enabling more consistent redesigns and policy evaluation. The emphasis on structural invariants and a documented audit protocol is a concrete strength that supports reproducibility and adoption.
major comments (2)
- [Abstract] Abstract: the claim that structural choices 'can increase pre-choice friction without improving meaningful control' is load-bearing for the paper's contribution yet rests on an untested inference. The manuscript states that PSI is not a measure of comprehension and describes only audit protocol, worked example, and deployment results with no paired data on user understanding, choice accuracy, or post-interaction outcomes.
- [Live deployment analysis] Live deployment analysis: PSI scores are reported under pointer and keyboard traversal policies, but the section provides no error analysis, inter-auditor reliability metrics, or comparison against low-PSI baseline interfaces, weakening the ability to interpret the magnitude of reported burden increases.
minor comments (2)
- The abstract references companion signals AAI, CSI, and divergence as secondary interpretive aids; these should be defined with explicit formulas or operational rules in the methods section to prevent reader confusion.
- [Live deployment analysis] Clarify the exact number of interfaces and users in the 'medium-scale' deployment to allow assessment of statistical power and generalizability.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback. We address each major comment below and commit to revisions that improve precision and robustness without altering the manuscript's core scope or claims.
read point-by-point responses
-
Referee: [Abstract] Abstract: the claim that structural choices 'can increase pre-choice friction without improving meaningful control' is load-bearing for the paper's contribution yet rests on an untested inference. The manuscript states that PSI is not a measure of comprehension and describes only audit protocol, worked example, and deployment results with no paired data on user understanding, choice accuracy, or post-interaction outcomes.
Authors: We agree the original phrasing could be read as implying effects on user comprehension or choice quality, which the paper explicitly disclaims. The claim is instead based on the audit observation that the cited structural choices (offscreen alternatives, fragmented disclosure, staged modals) produce higher PSI scores while the set of available control options remains substantively identical to lower-PSI designs. To eliminate any overstatement, we will revise the abstract and discussion to read that these choices 'increase pre-choice friction without providing more accessible or additional control options.' We will also insert a clarifying sentence in the abstract and limitations section reiterating that PSI diagnoses interface burden only. revision: yes
-
Referee: [Live deployment analysis] Live deployment analysis: PSI scores are reported under pointer and keyboard traversal policies, but the section provides no error analysis, inter-auditor reliability metrics, or comparison against low-PSI baseline interfaces, weakening the ability to interpret the magnitude of reported burden increases.
Authors: We accept this point. The deployment section relied on the documented least-effort audit protocol for reproducibility but omitted quantitative reliability checks and baseline comparisons. In the revision we will add: (1) inter-auditor agreement (Cohen's kappa) computed on a 20% random sample of audited interfaces, (2) standard deviation and range of PSI scores across repeated audits of the same interfaces, and (3) a side-by-side PSI comparison against the low-burden baseline interface presented in the worked example. These additions will be placed in a new subsection of the deployment analysis. revision: yes
Circularity Check
No significant circularity: PSI introduced as novel observable metric without reduction to inputs or self-referential claims.
full rationale
The paper defines the Performative Scrolling Index (PSI) explicitly as a new interface-audit metric decomposed into four observable components (distance, time, focus loops, hidden reveals) and states that it is not a measure of comprehension or legal sufficiency. No equations, fitted parameters, or derivations are presented that reduce PSI or the central claims to prior inputs by construction. The analyses rely on audit protocols, worked examples, and deployments rather than self-citations or tautological inferences. The interpretive claim that high-PSI designs increase friction without improving control follows from the metric's stated scope rather than any self-definitional loop or fitted prediction renamed as result. The derivation chain is self-contained against external benchmarks.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption Observable interaction patterns (distance, time, focus loops, hidden reveals) are valid proxies for pre-choice burden in consent flows
invented entities (1)
-
Performative Scrolling Index (PSI)
no independent evidence
Reference graph
Works this paper leans on
-
[1]
Alessandro Acquisti, Laura Brandimarte, and George Loewenstein. 2015. Privacy and human behavior in the information age.Science347, 6221 (2015), 509–514
2015
-
[2]
Idris Adjerid, Eyal Peer, Alessandro Acquisti, and George Loewenstein. 2013. Sleights of Privacy: Framing, Nudge, and the Revelation of Information. InWEIS
2013
-
[3]
Susanne Barth and Menno D. T. de Jong. 2017. The privacy paradox—Investigating discrepancies between expressed privacy concerns and actual online behavior: A systematic literature review.Telematics and Informatics34, 7 (2017), 1038–1058. doi:10.1016/j.tele.2017.04.013
-
[4]
Nataliia Bielova, Laura Litvine, Anysia Nguyen, Mariam Chammat, Vincent Toubiana, and Estelle Hary. 2024. The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions. InUSENIX Security Symposium (USENIX Security ’24). USENIX Association
2024
-
[5]
Tom Biselli, Laura Utz, and Christian Reuter. 2024. Supporting Informed Choices about Browser Cookies: The Impact of Personalised Cookie Banners.Proceedings on Privacy Enhancing Technologies2024, 1 (2024), 171–191. doi:10.56553/popets- 2024-0011
-
[6]
Rainer Böhme and Stefan Köpsell. 2010. Trained to accept? A field experiment on consent dialogs. InProceedings of the SIGCHI Conference on Human Factors in Computing Systems. ACM, 2403–2406. doi:10.1145/1753326.1753689
-
[7]
Dino Bollinger, Shitong Hao, Brendan Kells, Shweta Shinde, and Anwar Hithnawi
-
[8]
In31st USENIX Security Symposium (USENIX Security ’22)
Automating Cookie Consent and GDPR Violation Detection. In31st USENIX Security Symposium (USENIX Security ’22). https://www.usenix.org/conference/ usenixsecurity22/presentation/bollinger
-
[9]
Elijah Robert Bouma-Sims, Megan Li, Yanzi Lin, Adia Sakura-Lemessy, Alexandra Nisenoff, Ellie Young, Eleanor Birrell, Lorrie Faith Cranor, and Hana Habib. 2023. A US–UK Usability Evaluation of CMP Cookie Consent Interface Design on Desktop and Mobile. InProceedings of the 2023 CHI Conference on Human Factors in Computing Systems. ACM, New York, NY, USA. d...
-
[10]
Laura Brandimarte, Alessandro Acquisti, and George Loewenstein. 2013. Mis- placed Confidences: Privacy and the Control Paradox.Social Psychological and Personality Science(2013)
2013
-
[11]
Cristian Bravo-Lillo, Lorrie Cranor, Julie Downs, and Saranga Komanduri. 2013. Your Attention Please: Designing Warnings for Security and Privacy. InSOUPS
2013
-
[12]
McDonald, and Norman Sadeh
Rex Chen, Fei Fang, Thomas Norton, Aleecia M. McDonald, and Norman Sadeh
- [13]
-
[14]
Martin Degeling, Christine Utz, Florian Schaub, and Thorsten Holz. 2019. We Value Your Privacy... Now Take Some Cookies: Measuring the GDPR’s Impact on Web Privacy. InNDSS
2019
-
[15]
Nurullah Demir, Tobias Urban, Norbert Pohlmann, and Christian Wressnegger
-
[16]
A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users’ Privacy.Proceedings on Privacy Enhancing Technologies2024, 1 (2024), 5–20. doi:10.56553/popets-2024-0002
-
[17]
Serge Egelman, Lorrie Faith Cranor, and Jason Hong. 2009. You’ve Been Warned: An Empirical Study of the Effectiveness of Web Browser Phishing Warnings. In CHI
2009
-
[18]
Adrienne Porter Felt, Elizabeth Ha, Serge Egelman, Ariel Haney, Erika Chin, and David Wagner. 2012. Android Permissions: User Attention, Comprehension, and Behavior. InSOUPS
2012
-
[19]
Yuanyuan Feng, Yaxing Yao, and Norman Sadeh. 2021. A Design Space for Privacy Choices: Towards Meaningful Privacy Control in the Internet of Things. InCHI Conference on Human Factors in Computing Systems (CHI ’21). ACM, Yokohama, Japan. doi:10.1145/3411764.3445148
-
[20]
B. J. Fogg. 2003.Persuasive Technology: Using Computers to Change What We Think and Do. Morgan Kaufmann
2003
-
[21]
Interaction Design Foundation. 2024. Progressive Disclosure. https://www. interaction-design.org/literature/topics/progressive-disclosure
2024
-
[22]
Paul Graßl, Hanna Schraffenberger, Frederik Zuiderveen Borgesius, and Moniek Buijzen. 2021. Dark and Bright Patterns in Cookie Consent Requests.Journal of Digital Social Research3, 1 (2021), 1–38. doi:10.33621/jdsr.v3i1.54
-
[23]
Colin M Gray, Yubo Kou, Brandon Battles, John Hoggatt, and Austin L Toombs
-
[24]
InCHI Extended Abstracts
The Dark (Patterns) Side of UX Design. InCHI Extended Abstracts
-
[25]
Nielsen Norman Group. 2023. Accordion Menus: When and How to Use Them. https://www.nngroup.com/articles/accordions-complex-content/
2023
-
[26]
Haoze Guo. 2026. ConsentDiff at Scale: Longitudinal Audits of Web Privacy Policy Changes and UI Frictions. InProceedings of the Extended Abstracts of the 2026 CHI Conference on Human Factors in Computing Systems (CHI EA ’26). Association for Computing Machinery, New York, NY, USA, Article 185, 5 pages. doi:10.1145/3772363.3798570
-
[27]
Haoze Guo and Ziqi Wei. 2026. Temporal Drift in Privacy Recall: Users Misremem- ber From Verbatim Loss to Gist-Based Overexposure. arXiv:2509.16962 [cs.HC] https://arxiv.org/abs/2509.16962
work page internal anchor Pith review Pith/arXiv arXiv 2026
-
[28]
Hana Habib and Lorrie Faith Cranor. 2022. Evaluating the Usability of Privacy Choice Mechanisms. InEighteenth Symposium on Usable Privacy and Security (SOUPS 2022). USENIX Association, Boston, MA, USA, 273–289. https://www. usenix.org/conference/soups2022/presentation/habib The Privacy Placebo: Diagnosing Consent Burden through Performative Scrolling Conf...
2022
-
[29]
Hana Habib, Megan Li, Ellie Young, and Lorrie Faith Cranor. 2022. “Okay, What- ever”: An Evaluation of Cookie Consent Interfaces. InProceedings of the 2022 CHI Conference on Human Factors in Computing Systems. ACM, New York, NY, USA. doi:10.1145/3491102.3501985
-
[30]
Hana Habib, Yixin Zou, Aditi Jannu, Neha Sridhar, Chelse Swoopes, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub. 2019. An Empirical Analysis of Data Deletion and Opt-Out Choices on 150 Websites. In Proceedings of the Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). USENIX Association, Santa Clara, CA, USA, 387–...
2019
-
[31]
Reidenberg, Norman Sadeh, and Florian Schaub
Hana Habib, Yixin Zou, Yaxing Yao, Alessandro Acquisti, Lorrie Faith Cranor, Joel R. Reidenberg, Norman Sadeh, and Florian Schaub. 2021. Toggles, Dollar Signs, and Triangles: How to (In)Effectively Convey Privacy Choices with Icons and Link Texts. InCHI Conference on Human Factors in Computing Systems (CHI ’21). ACM, Yokohama, Japan. doi:10.1145/3411764.3445387
-
[32]
Eric J. Johnson, Suzanne B. Shu, Benedict G.C. Dellaert, Craig Fox, Daniel G. Goldstein, Gerald Häubl, Richard P. Larrick, John W. Payne, Ellen Peters, David Schkade, Brian Wansink, and Elke U. Weber. 2012. Beyond Nudges: Tools of a Choice Architecture.Marketing Letters23, 2 (2012), 487–504. doi:10.1007/s11002- 012-9186-1
- [33]
-
[34]
Dominique Machuletz and Rainer Böhme. 2020. Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR.Proceedings on Privacy Enhancing Technologies2020, 2 (2020), 481–498. doi:10.2478/popets-2020-0037
-
[35]
Arunesh Mathur, Gunes Acar, Michael G Friedman, Eli Lucherini, Jonathan Mayer, Marshini Chetty, and Arvind Narayanan. 2019. Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites. InProceedings of the 2019 CHI Conference on Human Factors in Computing Systems
2019
-
[36]
Célestin Matte, Nataliia Bielova, and Cristiana Santos. 2020. Do Cookie Banners Respect My Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework. InProceedings of the 2020 IEEE Symposium on Security and Privacy (SP) Workshops. IEEE. doi:10.1109/SPW50608.2020.00041
-
[37]
Aleecia M McDonald and Lorrie Faith Cranor. 2008. The Cost of Reading Privacy Policies. InWEIS
2008
-
[38]
Patricia A Norberg, Daniel R Horne, and David A Horne. 2007. The Privacy Calculus: An Integrative Literature Review.Journal of Business Research(2007)
2007
-
[39]
Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal
-
[40]
InProceedings of the 2020 CHI Conference on Human Factors in Computing Systems
Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrat- ing their Influence. InProceedings of the 2020 CHI Conference on Human Factors in Computing Systems
2020
-
[41]
noyb – European Center for Digital Rights. 2024. Consent Banner Report 2024. https://noyb.eu/. Mass analysis of illegal consent banners and complaints
2024
-
[42]
Sarah Pearman, Ellie Young, and Lorrie Faith Cranor. 2022. User-friendly yet rarely read: A case study on the redesign of an online HIPAA authorization. Proceedings on Privacy Enhancing Technologies2022, 3 (2022), 558–581. doi:10. 56553/popets-2022-0086
2022
- [43]
-
[44]
Elissa M Redmiles, Sean Kross, and Michelle L Mazurek. 2019. A Multi-Method Study of Privacy Perceptions.ACM Transactions on Computer-Human Interaction (2019)
2019
-
[45]
Reidenberg, Jaspreet Bhatia, Travis D
Joel R. Reidenberg, Jaspreet Bhatia, Travis D. Breaux, and Thomas Norton. 2016. Ambiguity in Privacy Policies and the Impact of Regulation.Journal of Legal Studies45, S2 (2016), S163–S190. doi:10.1086/688669
-
[46]
Cristiana Santos, Nataliia Bielova, and Célestin Matte. 2021. Cookie Banners, What’s the Purpose? Analyzing Adherence to GDPR Purposes in Cookie Notices. InCHI ’21 Extended Abstracts. ACM. doi:10.1145/3411763.3451631
-
[47]
Durity, and Lorrie Faith Cranor
Florian Schaub, Rebecca Balebako, Adam L. Durity, and Lorrie Faith Cranor
-
[48]
InProceedings of the Eleventh Symposium on Usable Privacy and Security (SOUPS 2015)
A Design Space for Effective Privacy Notices. InProceedings of the Eleventh Symposium on Usable Privacy and Security (SOUPS 2015). USENIX Association, Ottawa, Canada. https://www.usenix.org/conference/soups2015/proceedings/ presentation/schaub
2015
-
[49]
Ashutosh Kumar Singh, Nisarg Upadhyaya, Arka Seth, Xuehui Hu, Nishanth Sastry, and Mainack Mondal. 2022. What Cookie Consent Notices Do Users Prefer? A Study In The Wild. InEuroUSEC 2022: European Symposium on Usable Security. doi:10.1145/3549015.3555675
-
[50]
Daniel J Solove. 2021. The Privacy Paradox Revisited.George Washington Law Review(2021)
2021
-
[51]
Joshua Sunshine, Serge Egelman, Hazim Almuhimedi, Nitin Atri, and Lorrie Cranor. 2009. Crying Wolf: An Empirical Study of SSL Warning Effectiveness. In USENIX Security
2009
-
[52]
Brian Tang, Duc Bui, and Kang G. Shin. 2025. Navigating Cookie Consent Violations Across the Globe. In34th USENIX Security Symposium (USENIX Security 2025). USENIX Association. https://www.usenix.org/conference/ usenixsecurity25/presentation/tang
2025
-
[53]
Thaler and Cass R
Richard H. Thaler and Cass R. Sunstein. 2008.Nudge: Improving Decisions About Health, Wealth, and Happiness. Yale University Press, New Haven, CT
2008
-
[54]
Christine Utz, Martin Degeling, Florian Schaub, and Thorsten Holz. 2019. In- formed Consent in Cookie Notices: Evaluating the Effect of Consent Notice Design on End Users.Proceedings on Privacy Enhancing Technologies(2019)
2019
-
[55]
W3C. 2018. Web Content Accessibility Guidelines (WCAG) 2.1. https://www.w3. org/TR/WCAG21/. W3C Recommendation
2018
-
[56]
W3C Web Accessibility Initiative. 2018. Understanding Success Criterion 2.4.3: Focus Order. https://www.w3.org/WAI/WCAG21/Understanding/focus-order. html
2018
-
[57]
Isabelle Wagner. 2023. Content of Privacy Policies 1996–2021.Commun. ACM 66, 9 (2023), 84–92. doi:10.1145/3590152 A Appendix Supplementary Discussion PSI relates to pre-choice burden, not legal sufficiency or down- stream welfare. Accordingly, it may overstate burden when long text is demonstrably optional and honest alternatives are already available on ...
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.