--- title: "Let People See Your Page Before You Ask for Consent" description: "Research puts ten seconds on the decision a visitor makes about your page. My view on what a full-screen consent banner does with those seconds." date: 2026-11-04 author: "David Wippel" tags: ["marketing-tech", "compliance"] url: https://www.essentialcode.eu/blog/let-people-see-your-page-before-you-ask-for-consent/ --- # Let People See Your Page Before You Ask for Consent > Research puts ten seconds on the decision a visitor makes about your page. My view on what a full-screen consent banner does with those seconds. **TL;DR.** Let the visitor see your page first. Nielsen Norman Group reads the research as ten seconds to get your value across, and a full-screen consent banner spends them on a question about cookies. Ask after a meaningful action instead, keep every non-essential script off until the visitor says yes, and give accept and reject the same weight. My view is that a full-screen consent banner pushed at a visitor on arrival costs you more conversion than any ad blocker ever will. The visitor cannot see what the company does until they have answered a question about cookies, and the first screen is where you can least afford to spend their attention. This is not legal advice. It summarises the primary sources linked below. For your own site, talk to a lawyer. ## Ten seconds is the budget the research gives you Jakob Nielsen's [How Long Do Users Stay on Web Pages?](https://www.nngroup.com/articles/how-long-do-users-stay-on-web-pages/) (Nielsen Norman Group, 11 September 2011) puts the design implication in one sentence: "To gain several minutes of user attention, you must clearly communicate your value proposition within 10 seconds." That reading comes from a Microsoft Research study of page-visit durations across 205,873 web pages and more than two billion dwell times. Time on a page turned out to follow a Weibull distribution, and 99% of the pages showed what the researchers call negative aging: the longer someone has already stayed, the less likely they are to leave. The article's own summary of the shape is that the first ten seconds are critical, that visitors are still highly likely to leave through the following twenty, and that the curve only flattens after about thirty seconds. So the first ten seconds are the critical ones, and what the visitor is deciding in them is whether you are worth more of their time. A banner that covers the page spends those seconds on a question about tracking, asked of somebody who does not yet know who you are. ## Ask after the visitor has done something Put the consent request at the first point where the visitor has shown they want to be there: - They scroll past the first screen. - They open a product, a case study or a pricing page. - They start filling a form. - They move to a second page. Any of those is a visitor who has oriented themselves, and it is also the moment measurement starts to be worth something, because there is now a path to measure. The question also reads differently at that point, because a visitor who has spent a minute on the site has some idea what they are agreeing to. Delaying the question is lawful for one reason, and that reason is something you have to build: nothing non-essential runs until the visitor says yes. In Austria, [§ 165 Abs. 3 TKG 2021](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011678&Paragraf=165) allows this data to be collected only once the user „seine Einwilligung dazu aktiv und auf Grundlage von klaren und umfassenden Informationen erteilt hat“, that is, after active consent given on the basis of clear and comprehensive information. Its exemptions cover storage or access whose sole purpose is transmitting a message over a network, and storage or access that is „unbedingt erforderlich“ for a service the user explicitly asked for. An analytics or advertising script is neither of those. The EU rule behind it is Article 5(3) of the [ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02002L0058-20091219), which permits "the storing of information, or the gaining of access to information already stored" on someone's device only where that person "has given his or her consent", or where it is "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". What consent has to look like comes from the [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679): Article 4(11) requires it to be given "by a statement or by a clear affirmative action", and recital 32 says "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." None of that moves because you moved the banner. Build it the other way round, with the tags loading on arrival and the banner collecting a yes afterwards, and the delay stops being a timing choice and becomes tracking without consent. ## The sequence that fits both | Moment in the visit | What is allowed to run | What the visitor sees | | -------------------------------------------------------------------------------------- | ------------------------------------------------------------- | --------------------------------------------------- | | Arrival | Only what the page needs to render | The page | | A meaningful action: past the first screen, into a product, into a form, a second page | Still nothing non-essential | The consent request, accept and reject side by side | | The visitor says yes | Analytics and marketing tags load | The page, and a footer link to change the answer | | The visitor says no | Still nothing non-essential, and every function keeps working | The page, and the same footer link | The last row is the one that gets skipped. A no has to leave the site fully usable, and it has to be as reversible as the yes: Article 7(3) of the GDPR says "It shall be as easy to withdraw as to give consent." A footer link that reopens the request from any page covers it. ## Accept and reject carry the same weight Regulators have already published what they look at. In the European Data Protection Board's [Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf) of 17 January 2023, "a vast majority of authorities considered that the absence of refuse/reject/not consent options on any layer with a consent button of the cookie consent banner is not in line with the requirements for a valid consent and thus constitutes an infringement" (paragraph 8). On colours and contrast the same report declines to set a general standard and says a "case-by-case verification must be carried out in order to check that the contrast and colours used are not obviously misleading" for users (paragraph 17). Those are the coordinated positions of the supervisory authorities sitting in that taskforce, which the report itself calls a minimum threshold that does "not prejudge the analysis that will have to be made by the authorities of each complaint and each website concerned". The binding rules are the ones quoted above. In my view that is where a lot of banner tools leave their defaults: one bright, large accept, and a refusal in low-contrast grey or a layer deeper. Open your own banner on a phone and see which button your thumb reaches for. Three things I would hold the request to: - Accept and reject on the same layer, at the same size and the same visual weight. - Plain words for what each button does, and a third button only where it really opens settings. - A footer link on every page that reopens the request, so changing the answer costs what giving it cost. A yes collected from a banner that steers is worth less than it looks, because whether it was consent at all is arguable, and the measurement built on it inherits that argument. ## The ad blocker is the fight I would not pick first An ad blocker is a browser extension, or a feature built into the browser, that stops tracking and advertising requests before they leave the device. Pi-hole does the same job for a whole home or office network by filtering DNS. Between them, some share of your visitors is never counted, and much of the advice on this is about recovering that share with more engineering. I think the order of that work is wrong. The visitors an ad blocker hides from you arrived, looked at the page and may well have converted. The visitors I think a banner turns away at the first screen never got that far, and nothing downstream reconstructs them. One of those two losses is yours to fix this week with a change to when a request appears. When you get to the measurement question itself, what usually decides whether anything is answerable is how much traffic the page gets, which is the argument in [what A/B testing costs in 2026](/blog/ab-testing-tools-cost-traffic/). The banner is also a real interaction element, so how fast it responds counts towards [the Core Web Vitals a marketing site is judged on](/blog/core-web-vitals-headless-migration/). ## Where to start on your own site Open your home page on a phone, on a connection that is not your office wifi, and time how long it takes to see what the company does. If a banner is in the way, that is the first screen your paid traffic is landing on, and moving the request to a later moment touches one piece of your tag setup. This is the kind of work our [Fractional Marketing Engineer](/services/fractional-marketing-engineer/) service picks up, and you can [get in touch](/contact/) if you want a second pair of eyes on how yours is wired.