27% of US adults manually customize their cookie settings when a banner gives them that option, rather than accepting or rejecting everything outright, according to a 2025 Pollfish survey of 1,000 US adults commissioned by All About Cookies. That number sits inside a wider three-way split: another 24% accept every cookie, 25% reject every optional cookie, and the remaining 24% land somewhere in between depending on the site. Whether that choice actually changes anything once it is made is a separate question, and the data on that point is less encouraging.
What percentage of users change their cookie settings when given the choice?
Roughly one in four internet users actively changes their cookie settings rather than clicking whichever button is easiest to find. The clearest recent measurement comes from All About Cookies' 2025 Pollfish survey of 1,000 US adults: 27% said they take the time to manually select specific cookie categories to allow when a banner gives them that option, narrowly ahead of both one-click alternatives. 24% blindly accept all cookies when prompted, and 25% reject all optional cookies by default, leaving roughly a quarter of respondents inconsistent or unsure from site to site.
Figure 1: Customizing was the single largest response, narrowly ahead of outright rejection and outright acceptance. Source: All About Cookies, Pollfish survey of 1,000 US adults (August 2025).
The three-way split matters because it breaks a common assumption that most visitors either accept everything or reject everything. In this survey, customizing was not a rare behavior reserved for privacy specialists. It was the largest single response category, ahead of outright rejection and outright acceptance alike, and it lines up with a separate, differently measured result from France's data protection authority.
| Source | What it measured | Result | Year |
|---|---|---|---|
| All About Cookies / Pollfish | US adults who manually customize cookie categories | 27% | 2025 |
| All About Cookies / Pollfish | US adults who reject all optional cookies | 25% | 2025 |
| All About Cookies / Pollfish | US adults who accept all cookies without choosing | 24% | 2025 |
| CNIL | Visits to French websites where the visitor clicked reject once it was equally weighted against accept | 39% | 2022 |
For the fuller picture of how people respond to cookie banners overall, including acceptance rates by country and what happens after a banner loads, see our cookie consent statistics for 2026.
Do most people know how to change their cookie settings but not bother?
There is a real gap between what people say they can do and what they actually do. 80% of respondents in the same 2025 Pollfish survey claimed they know how to clear or disable cookies, and 39% said they feel very or mostly confident they understand what cookies do. Only 15% said they were very confident specifically.
That confidence does not hold up against a basic knowledge check. Just 11% of respondents correctly identified every real use of a cookie from a list of options, 19% picked none of the correct answers at all, and 53% selected at least one false answer about what cookies actually do. Roughly half correctly named analytics, ad personalization, and data storage as cookie functions, but fewer than a third knew cookies are also used to authenticate logged-in accounts.
The practical effect shows up in the accept and reject numbers from the section above: 80% say they know how to manage cookies, but only 27% actually customized their settings the last time a banner asked. Most of the confidence gap between knowing and doing is explained by a separate finding from the same survey: 87% of respondents said they had experienced hyper-personalized ads after searching for a product, and 87% of that group called the experience creepy or invasive. People recognize the outcome of not changing their settings well before they act on it.
Does an automated signal like Global Privacy Control count as changing your cookie settings?
Yes, and it is the only mechanism that changes a visitor's preference across every website at once instead of one banner click at a time. Global Privacy Control (GPC) is a browser-level signal that automatically tells a site the visitor wants to opt out of having their personal data sold or shared, replacing the need to find and click a "Do Not Sell My Personal Information" link on every individual site.
Sites do not reliably honor it. Hausladen et al.'s USENIX Security 2025 study crawled 11,708 US websites in December 2023, February 2024, and April 2024, and found that only 45% of eligible sites fully honored a GPC signal by the final crawl, barely above the 44% recorded 16 months earlier. That is a large jump from an earlier Wesleyan University baseline of just 12% in August 2022, but the improvement has plateaued.
Figure 2: Automated opt-out compliance nearly quadrupled since 2022 but has plateaued in the mid-40s. Source: Hausladen et al., USENIX Security 2025, longitudinal crawl of 11,708 US websites; August 2022 baseline from an earlier Wesleyan University study.
Not every technical mechanism performs the same once a GPC signal arrives. The OptanonConsent cookie, set by OneTrust's consent platform and the most widely deployed of the four mechanisms the study tracked, produced the best result at 68% in April 2024. The US Privacy String fared worse: it was implemented on 54% of sites in the study's accuracy test set, but only 46% of those (25 of 54) actually flipped their opt-out value after receiving the signal. Brave, DuckDuckGo, and Firefox all support GPC natively as of 2026, so a share of "changed" settings now happen automatically, on every site a visitor loads, without a single banner click.
Does changing your cookie settings actually stop websites from tracking you?
Not consistently, no. A 2024 USENIX Security study by Ahmed Bouhoula and colleagues at ETH Zurich automatically analyzed cookie notices on 97,000 EU websites, drawn from real Chrome browsing traffic rather than a hand-picked sample, and found that 65.4% of sites offering a working reject option collected user data anyway after the visitor explicitly declined. Clicking reject, in other words, was not the same as opting out in practice for roughly two out of every three sites tested.
Figure 3: Three different ways a visitor's cookie choice can be applied, with very different odds that it actually works. Source: Bouhoula et al., USENIX Security 2024 (97,000 EU websites); Hausladen et al., USENIX Security 2025 (11,708 US websites).
None of this means changing cookie settings is pointless. It means a banner click or a browser signal is only a request, not an enforcement mechanism, and the site on the other end still has to build the backend to honor it. A site that wants visitors to trust its cookie choices needs to document, in plain language, exactly which categories it sets and why, which is precisely the disclosure a privacy policy covering cookie use is built to provide, rather than leaving visitors to guess whether their reject click actually did anything.
Does cookie-setting behavior differ by country?
The two most detailed available studies use different populations and different questions, so a direct percentage-for-percentage comparison would overstate what the data actually shows. Still, both point the same direction: once a real choice exists, a meaningful share of visitors move away from the default "accept everything" outcome.
France's CNIL monitored 1,000 of the country's most popular websites between January 2021 and August 2022 and found a 59% acceptance rate and a 39% refusal rate by June 2022, once banners gave reject and accept equal visual weight. That is a site-level measurement of actual clicks. The 2025 Pollfish survey of 1,000 US adults asked people to self-report their usual behavior instead, and found 25% reject all cookies plus 27% customize, meaning 52% describe themselves as typically moving away from the accept-everything default.
| Study | Population measured | What moved away from default | Year |
|---|---|---|---|
| CNIL | 1,000 top French websites, actual visitor clicks | 39% refused when reject was equally visible | 2022 |
| All About Cookies / Pollfish | 1,000 US adults, self-reported behavior | 52% (25% reject plus 27% customize) | 2025 |
Both figures land well above the 80-to-90% acceptance rates that were common before regulators required an equally visible reject option, even though the two studies were not designed to be compared directly against each other.
Which browsers change your default cookie settings for you?
Some of the biggest changes to cookie settings happen automatically, at the browser level, before a visitor ever sees a banner. Safari's Intelligent Tracking Prevention "blocks all third-party cookies" by default, with no exceptions, according to WebKit's own tracking prevention documentation. Firefox has shipped its Standard Enhanced Tracking Protection setting on by default since June 2019, which blocks known third-party tracking cookies drawn from the Disconnect list, according to Mozilla's own announcement of the rollout.
Chrome has not followed the same path. In July 2024, Google reversed its long-running plan to deprecate third-party cookies entirely and said it would instead build "a new experience in Chrome that lets people make an informed choice that applies across their web browsing," which users can adjust at any time, according to Google's own Privacy Sandbox blog. Chrome remains the world's largest browser by a wide margin.
Figure 4: Chrome, which does not block third-party cookies by default, carries more than four times the combined share of Safari and Firefox, both of which do. Source: StatCounter Global Stats, Browser Market Share Worldwide, June 2026.
That split means most visitors' cookie exposure is shaped by which browser they picked long before any banner loads, and a smaller minority get a default-on block simply for using Safari or Firefox.
Figure 5: Regulatory and market pressure gradually shifted part of the job of changing cookie settings from the visitor onto the platform itself. Source: GDPR Article 7; WebKit; Hausladen et al., USENIX Security 2025; CNIL; All About Cookies/Pollfish; Google Privacy Sandbox blog (July 2024).
The Bottom Line
27% of users actively customize their cookie settings, another half reject or customize combined, and the rest either accept everything or never form a consistent habit at all. The bigger finding sits one layer down: knowing how to change a setting, saying you know how, and having that change actually respected by the site on the other end are three different things, and the data shows a real gap at every one of those steps. Browser defaults, automated signals, and per-site banner clicks each cover a different slice of the population, and none of the three reaches everyone. A site that wants visitors to trust its cookie handling still needs to explain it in writing rather than assume a banner click settled the question.
Frequently Asked Questions
What percentage of users change their cookie settings? 27% of US adults manually customize their cookie settings, choosing specific categories to allow rather than accepting or rejecting everything, according to a 2025 Pollfish survey of 1,000 US adults commissioned by All About Cookies. Another 24% accept all cookies and 25% reject all cookies, leaving the remaining 24% unsure or inconsistent.
Do most people know how to change their cookie settings? Most say they do, but few act on it. 80% of respondents in the same 2025 Pollfish survey claimed they know how to clear or disable cookies, yet only 27% actually customized their settings when a real cookie banner gave them the choice, and just 11% could correctly identify all the real uses of a cookie from a list of options.
Does Global Privacy Control count as changing your cookie settings? Yes. Global Privacy Control is a browser-level signal that automatically tells every website a visitor wants to opt out of having their data sold or shared, without the visitor manually clicking through each site's cookie banner. Only 45% of eligible websites honored that signal when tested in April 2024, according to Hausladen et al.'s USENIX Security 2025 study of 11,708 US websites, up from just 12% in an earlier August 2022 baseline.
Does changing your cookie settings actually stop tracking? Not always. A 2024 USENIX Security study of 97,000 EU websites by researchers at ETH Zurich found that 65.4% of sites with a working reject option collected user data anyway after the visitor explicitly declined, meaning a rejected or customized cookie choice does not guarantee the tracking actually stops.
Where the Numbers Come From
- All About Cookies. (2025). "Cookies Survey." Pollfish survey of 1,000 US adults, conducted August 2025; 24% blindly accept, 25% reject all, 27% customize, 80% claim they know how to clear or disable cookies.
- Hausladen, Wang, Eng, Wang, Wijaya, May, and Zimmeck: Websites' Global Privacy Control Compliance at Scale and over Time (USENIX Security 2025). Wesleyan University and Princeton University. Longitudinal crawl of 11,708 US websites in December 2023, February 2024, and April 2024; 45% full compliance by the final crawl.
- Wesleyan University: Study, Majority of Websites Don't Honor Opt-Outs (July 2025). Research summary including the August 2022 baseline compliance figure of 12%.
- USENIX Security 2024 / Bouhoula, Kubicek, Zac, Cotrini, Basin (ETH Zurich). "Automated Large-Scale Analysis of Cookie Notice Compliance." 97,000 EU websites analyzed; 65.4% collected data despite explicit refusal.
- CNIL. (2022). "Evolution of Practices on the Web Regarding Cookies." 1,000 top French websites monitored January 2021 to August 2022; 59% acceptance, 39% refusal as of June 2022.
- WebKit. "Tracking Prevention." Documents that Intelligent Tracking Prevention blocks all third-party cookies by default with no exceptions.
- Mozilla. (2019). "Firefox Now Available With Enhanced Tracking Protection by Default." June 4, 2019 announcement of Standard mode blocking known third-party tracking cookies by default.
- Google Privacy Sandbox. (2024). "Privacy Sandbox Update." July 22, 2024 announcement reversing third-party cookie deprecation in favor of a persistent, adjustable user choice.
- StatCounter Global Stats. "Browser Market Share Worldwide." Chrome 69.65%, Safari 15.31%, Edge 5.21%, Firefox 3.33%, June 2026.
Note: All figures verified as of August 2026. The GPC compliance figures reflect Hausladen et al.'s most recent published crawl (April 2024) and have not been re-measured at the same scale since; browser market share moves month to month and should be checked against StatCounter's current data before republishing this post's chart.
