Report: The 340 Hours You've Spent Clicking 'Reject All Cookies' Were Largely Ceremonial

WASHINGTON — A comprehensive study released Tuesday by the Digital Privacy Research Institute has confirmed what tech companies have known for years: the 340 hours the average American has spent carefully clicking "Reject All Cookies," "Customize Settings," and "Only Essential Cookies" since 2018 were largely ceremonial gestures with no meaningful impact on data collection.

"The buttons work," explained lead researcher Dr. Helena Voss, clicking "Reject All" on her laptop while fourteen tracking scripts loaded in the background. "They just don't do what people think they do. It's like those 'Close Door' buttons in elevators. Technically functional. Practically decorative."

The study found that 94% of websites that display cookie consent banners begin tracking users before the banner even appears. The remaining 6% wait approximately 0.3 seconds after the banner loads—described in the study as "a courtesy delay, like holding the door for someone you're about to rob."

Perhaps most devastating was the study's time analysis. The average user spends 2.4 seconds per cookie banner, encounters 847 banners per month, and has been doing so for approximately six years. This amounts to 340 hours—or just over two full weeks of human existence—spent performing what researchers termed "privacy theater."

The GDPR, Europe's landmark privacy regulation, was supposed to change everything. Instead, it created what one analyst called "the world's most elaborate permission slip that nobody reads." The study found that if a user actually read every privacy policy they encountered, they would need to dedicate 76 full working days per year to the task—more time than most Europeans get for vacation.

"We've essentially created a system where informed consent is mathematically impossible," Dr. Voss noted. "The average privacy policy is 4,000 words. The average human reads 250 words per minute. The average website visit is 52 seconds. The math doesn't math."

When reached for comment, a spokesperson for the Digital Advertising Alliance released a statement reading, in its entirety: "lol. lmao even."

The group later clarified that this was "not intended to be a formal response" but declined to provide an alternative statement, noting that "honestly, that pretty much covers it."

Congressional hearings on the matter have proven equally illuminating. At a recent session, Senator Margaret Thornton (R-TX) asked Google CEO Sundar Pichai whether "the Google" could see when she was sad.

Pichai's four-second pause before answering "We have various signals that help personalize user experience" is now being studied by philosophy departments nationwide as "the most eloquent non-denial in corporate history."

The study's most troubling finding concerned so-called "dark patterns"—interface designs specifically created to manipulate users into giving up more data. The "Reject All" button, researchers found, is on average 73% smaller than "Accept All," positioned in the corner users are least likely to look, and colored to blend into the background "like a privacy chameleon."

"We found one website where the 'Reject' button was literally 2 pixels by 2 pixels," said Dr. Voss. "To click it, you'd need either superhuman precision or a very patient ant. We classified this as 'technically compliant.'"

Perhaps no finding was more depressing than the revelation about data broker intimacy. The study confirmed that the average data broker now possesses more accurate information about users than their own family members.

"We interviewed one subject whose data profile correctly predicted she was pregnant, knew her due date, had already identified her preferred parenting style, and suggested baby names—all before she had told her husband," Dr. Voss reported. "The data broker sent her a tasteful 'Just Checking In' text. She found it 'weirdly supportive.'"

The advertising industry pushed back on the study's findings, arguing that targeted advertising "enhances user experience" and that "consumers love relevant ads." When pressed on why, if users love the ads so much, companies spend billions figuring out how to show them to people who are actively trying to avoid them, the spokesperson asked to go off the record.

Off the record, he said: "Look, we know. They know. Everyone knows. But there's a lot of money involved and nobody wants to be the one to say it out loud. It's like a party where everyone's pretending not to notice the host is on fire."

The study also examined the phenomenon of "aspirational data"—information collected about things users briefly considered but never actually did. Researchers found that mentioning "maybe trying yoga" once in a text message triggers an average of 2,847 yoga-related ads over the following six months.

"The algorithm knows you won't do yoga," Dr. Voss explained. "It knew within 72 hours. But it kept the ads going for six months, just in case. Then, when it calculated you'd fully given up, it served you one final ad: 'Accepting Mediocrity: A Guide.' That's not targeting. That's psychological warfare."

Congress, for its part, has responded to the privacy crisis with characteristic urgency. The proposed "American Data Protection Act" has been in committee for four years, during which time the average American's data has been sold approximately 847,000 times.

"We're working on it," said Representative James Callahan (D-CA), whose campaign received $2.3 million in contributions from tech companies last quarter. "These things take time. We need to balance privacy concerns with, you know, other concerns. Concerns that concern us. Concerning concerns."

When asked whether users have any meaningful recourse, Dr. Voss paused for what witnesses described as "an uncomfortably long time."

"Technically, yes. You can request your data under various laws. GDPR in Europe, CCPA in California. Of course, to do so, you need to submit requests to each of the 4,000 data brokers who have your information. They have 30 to 45 days to respond. They will respond with 47,000 pages of data in a format only a computer scientist could interpret. You'll then need to request deletion from each one individually. By the time you finish, they'll have re-acquired your data 600 times from other sources."

"So yes. There are options. They're just functionally worthless."

The final section of the study examined the psychological toll of "privacy theater"—the constant performance of caring about privacy without any actual protection. Researchers found that 78% of users experience "consent fatigue," defined as "the point at which a person stops reading cookie banners entirely and begins clicking whichever button makes the banner go away fastest."

"We're training an entire generation to click 'I Agree' without reading," Dr. Voss observed. "Which, when you think about it, is perfect preparation for modern citizenship."

As the study concluded, researchers offered a single, sobering recommendation for users genuinely concerned about their digital privacy:

"Move to a cabin in the woods without electricity or internet access. Do not own a smartphone. Pay for everything in cash. Have no friends who use social media. Never appear in any photograph. Never speak within range of any device. Accept that your historical data is already owned by thousands of companies and will outlive you."

"Short of that," Dr. Voss added, "just keep clicking the buttons. It's kind of relaxing once you stop expecting it to do anything."

At press time, the reader's data from this article had already been sold to 47 third parties, including several that technically don't exist yet but have pre-purchased rights to future behavioral profiles. The "Reject All Cookies" button at the bottom of this page is fully functional and does absolutely nothing.