GDPR Dark Patterns in Cookie Consent: An Automated Study of High-Traffic Websites Accessed from Denmark

This paper examines how often GDPR-relevant dark patterns appear in cookie-consent banners and how often users receive a choice that is free and informed. We use an adapted version of CCrawler to crawl 99 high-traffic websites accessed from Denmark, detect consent interfaces, and extract first-layer choice pathways and settings-layer elements for compliance-risk coding. We then assess detected banners against four GDPR-informed interface-level criteria: first-layer refusal availability, absence of pre-ticked or default-enabled options, relative accept/reject prominence, and non-obstructive presentation. These operational criteria are observable interface proxies rather than final legal determinations of GDPR compliance. Cookie banners were detected on 90 of 99 sites; the nine non-detections are reported separately and are not treated as evidence of non-compliance. The results indicate a structural imbalance: acceptance is usually available on the first layer, while refusal is often placed behind additional steps or settings dialogues. A subset of reachable settings interfaces also contained pre-ticked options. To place these observations in the European context, we compare the two directly comparable first-layer choice indicators with a recent 31-country study. Acceptance availability is close to that study’s Denmark-specific estimate, whereas first-layer rejection in our high-traffic Denmark-accessed sample lies between its Denmark-specific estimate and its 31-country aggregate. These cross-study comparisons are descriptive and are not treated as matched statistical estimates because the sampling frames and measurement procedures differ. The findings provide Denmark-specific, time-bounded evidence that known consent-interface asymmetries remain visible on high-traffic websites, together with a reproducible workflow for future audits.