Consent Patterns
Cookie Banner
- Equal visual weight for Accept and Reject
- Don't use dark patterns (tiny reject link, pre-checked boxes)
- Granular options (essential, analytics, marketing)
- Remember choice (don't ask every visit)
Permission Requests
- Ask in context (when user is about to use the feature)
- Explain why you need it (before the system prompt)
- Show what they get in return
- Allow using the product without granting (degrade gracefully)
Data Collection Rules
- Collect minimum necessary data
- Explain what you collect and why (plain language, not legal)
- Show what data you have about the user (data export)
- Allow deletion (right to be forgotten)
- Don't pre-check marketing consent boxes
- Separate essential consent from optional consent
Transparency
- Privacy settings easily findable (not buried 5 levels deep)
- Clear labels: 'We share this with partners' not 'Third-party data sharing'
- Notify users of policy changes before they take effect
- Show data retention periods
Anti-Patterns
- Dark patterns that make opting out difficult
- 'Accept All' as the only prominent button
- Requiring account creation to view privacy policy
- Collecting data not needed for the service