How we count consent
A consent rate is only useful if you can check how it was calculated. These are the definitions behind every number in the CookieBoss dashboard, the compliance report, the CSV export and the API.
The events
The banner reports four kinds of events:
- Banner view: the banner was shown on a page.
- Accept all: the visitor allowed every optional category.
- Reject all: the visitor refused every optional category.
- Custom choice: the visitor saved their own selection in the preferences panel.
A visitor who leaves without choosing produces banner views and no decision.
Definitions
| Metric | Definition |
|---|---|
| Decisions | Accept all + Reject all + Custom choices |
| Consent rate | Decisions that allow at least one optional category ÷ Decisions. Accept all counts; a custom choice counts only if something was switched on. A custom choice with everything off is a refusal. |
| Accept all / Reject all / Custom | Each ÷ Decisions |
| Category rate (Analytics, Marketing, Functional) | Decisions that allow that category ÷ Decisions. Accept all allows every category. |
| No-choice rate | Banner views without a decision ÷ Banner views. A visitor who browses several pages before choosing adds several banner views, so this is a share of banner views, not of visitors. |
Rates are rounded to whole percentages.
Small numbers
A rate based on a handful of decisions says little: one decision would read as 100% or 0%. Where a country has fewer than 20 decisions in the selected period, the dashboard shows a dash and the number of decisions instead of a rate, and the period summary is marked as indicative.
Bots
Crawlers that run JavaScript load the banner too. AI crawlers in particular can send thousands of banner views in a day. CookieBoss recognises them and keeps them out of every number above:
- Self-identifying crawlers: user agents that name a bot or crawler (for example
Googlebot/2.1,meta-externalagent), carry a crawler info URL, or come from a headless browser or an HTTP library. - Cloud networks: traffic from hosting and cloud providers (AWS, Google Cloud, Azure, Hetzner, OVH and similar), where real visitors almost never browse from. Networks that carry real people, such as VPN and privacy-relay services, are not filtered.
Bot events are not deleted. They are counted separately and shown as “bot events filtered”, so you can see how much was removed.
Global Privacy Control
When a visitor’s browser sends a Global Privacy Control signal in a jurisdiction that requires it to be honoured, CookieBoss opts them out of marketing automatically. These are reported as GPC opt-outs and are not counted as decisions.
A/B tests
Banner experiments use the same consent rate, so a test result and the analytics dashboard always agree.
- Unit: decisions, not banner views. Each decision is one visitor, while one visitor can produce several banner views. Counting views as independent observations would make results look more certain than they are. Each variant’s no-choice rate is shown alongside, so a variant that makes visitors ignore the banner is visible.
- Comparison: every variant is compared with the control. The test is a two-proportion z-test, and the dashboard shows the difference in percentage points with a 95% confidence interval. With several variants, p-values are Holm-corrected, so one variant doing well by chance isn’t reported as a win.
- Minimum sample: no result is declared until every variant has at least 1,000 banner views and 100 decisions.
- Verdicts:
- winner: a variant beats the control significantly;
- control is best: a variant is significantly worse and none is better;
- no difference: the minimum sample is met but nothing differs significantly;
- collecting: below the minimum sample.
- Uplift: shown in percentage points and relative to the control’s rate. A rise from 50% to 55% is +5 points, or +10% relative.
- Time to a result: while a test runs, the dashboard estimates how many more days it needs, from each variant’s daily decisions and the decisions needed to detect the difference seen so far with 80% power (at the Holm-corrected level when there are several variants). It is an estimate: the difference itself is still uncertain until the test ends.
- What a variant can change: layout, position, colours, animation, dark mode, the first-layer texts and the button labels. Categories, consent settings, regions and the cookie list are the same for every variant. Every variant must pass the same banner checks as a published banner, including a Reject button as visible as Accept, before a test can start or a variant can be promoted.
- Automatic promotion (optional, off by default): when turned on for a test, a variant that beats the control is made the banner automatically, but only after at least 14 days and with a corrected p-value below 0.005. The stricter level is there because the test is checked every hour, and each look is another chance for noise to look like a win. If the winning variant no longer passes the banner checks, nothing changes and the account owner is emailed.
Bot traffic never enters an experiment. Assigning a visitor to a variant stores nothing on their device: the banner loads before the visitor has made a choice, so the variant is derived from the request itself, and the same visitor keeps seeing the same variant.
Breakdowns
On Basic and higher plans, the consent rate is also shown by:
- Device: mobile, tablet or desktop, from the browser’s user agent. iPads running iPadOS report themselves as a Mac and count as desktop.
- Banner version: every time you publish the banner, it gets a new version number. Comparing versions shows the effect of a change on your own traffic.
- Page: the most viewed pages where the banner appeared. Only the path is recorded, never the query string. Parts of the path that look like identifiers (numbers, codes, email addresses) are replaced with
:id, so/order/12345is counted as/order/:id.
Each breakdown uses the same definitions as above, including the 20-decision minimum before a rate is shown.
Comparing with your previous consent tool
If you switched from another CMP, you can enter the consent rate it reported on the Analytics page. The dashboard then shows that number next to your CookieBoss consent rate for the selected period, the change in percentage points, and the date CookieBoss went live (the first day with real banner traffic).
The previous rate is whatever you enter; CookieBoss doesn’t verify it. Tools also count differently: some divide by banner views, others by choices. Check how your previous tool defined its number before you compare.