Transparency lifts conversion: what we learned designing consent under Law 21.719
When Law 21.719 takes effect on December 1, 2026, consent stops being just a checkbox on your site. The law defines it as a free, specific, unambiguous and informed expression of will, given through a statement or a clear affirmative action (1). And it requires people to be able to withdraw it as easily as they gave it (1).
That raises a question our customers always ask us: if I have to be transparent and I can no longer “pre-tick” acceptance, am I going to sink my acceptance rates?
This article offers 10 practical tips for designing consent that people actually want to accept
1. Ask at the right moment, not all at once
A permission asked for exactly when it makes sense (asking for location when someone searches for "stores near me") is understood and accepted better than a batch of them fired off during sign-up. The more contextual the consent, the better users accept it. Does that mean I shouldn't take advantage of the moment? No, it doesn't. If your customer is interacting with you, it's a good time to consider asking for a consent, just don't bombard them with 4 at once.
The European Data Protection Board (2) explicitly warns against overwhelming people with information and decisions during onboarding, because that prevents consent from being distinguishable and conscious.
2. Be transparent with your user
Transparency matters because only informed consent is valid: an induced "yes" inflates a metric but is legally fragile. Dark patterns don't convince anyone: people notice when they're being pushed, and those patterns aren't perceived as fair (they run against the fairness principle). Law 21.719 requires clear, prior and specific information, so transparency lines up the legal, the ethical and the commercial in a single view for the user.
In a case documented by Soyio and a client in the financial industry, we ran an A/B test comparing 2 different ways of collecting consent: one with little information and just a checkbox, and one using the Soyio template, which on click shows more information in a standardized way so it is easier to understand. The results showed that people facing less transparent consent do accept more at first, reaching 96% versus 89% acceptance with the Soyio template, but the picture reverses once you measure conversion across the full onboarding flow. The share who ended up signing up for the product (same flow; the only change was how consent was presented) was 38.4% higher with Soyio's consent, which promotes transparency.
It may sound counterproductive, but that's exactly the point: when people understand, they really decide, and that relationship builds trust in the brand.
3. Speak like a human, not like a lawyer
Swap "processing for profiling purposes" for "using your history to recommend products". This lines up with the transparency and fairness principles: genuinely wanting the person to understand what we're showing them, rather than leaving them confused or just clicking OK. The evidence shows that technical language and links to the privacy policy influence the decision less than the design of the buttons: people react above all to how you present the choice. Use that clarity to explain well, not to hide (3).
4. Use layered design
Don't choose between "tell them everything" and "tell them nothing". The European standard is a short first layer with the essentials (what, what for, who) and deeper, expandable layers for anyone who wants the detail. You respect the person who decides fast and the person who wants to read it all, without giving up validity. That's why at Soyio we offer a 2-layer consent format (template), so transparency is there and, on top of that, users who don't need more information can still move fast (2).
5. Granularity done right: not too much, not too little
The law requires separating by purpose (analytics, advertising, personalization, for example), but too many options is also a problematic pattern: it paralyzes people and gives the user a bad experience. Group by purposes people can understand, not one big bag holding many purposes inside, and break them down in a way that makes sense (not per vendor, not per data point). That is what makes granularity meaningful for the data subject (1),(2).
6. Consent is part of the customer experience
Remember that consent won't stand alone. It sits inside a flow where your user is interacting with you: creating an account, signing up for a service, completing a registration, and so on. That step inherits everything before it: your design, how you interact with your customer and the tone your brand speaks in are important context to consider when you write the consent. When the tone shifts abruptly, people notice and start to doubt.
Consent is understood best when the purpose is explained in the language of the product and at the moment that purpose makes sense.
7. Reduce cognitive load and the number of decisions
Every extra purpose a person has to weigh degrades the quality of their decision. A post-GDPR study of consent found that too many purposes create several problems: choice overload, worse decisions and less understanding.
Minimize the number of decisions on a single screen, use visual hierarchy to guide without manipulating and avoid very long walls of text. The study suggests that 3 consents at a time is a recommended maximum (4).
8. Show trust signals: who is asking and why
Clearly identify the controller and the reason. The consistency between what the banner promises and what the organization does afterwards is what builds the reputation that makes people accept without suspicion. Remember: transparent banners are perceived as fair roughly twice as often. (5)(6).
9. Make withdrawal easy (yes, even if it sounds contradictory)
When withdrawing consent is easy and visible, the perceived risk drops for saying "yes": the person thinks "I'll accept, and if it bothers me I'll turn it off in two clicks". The law also requires withdrawal to be as simple as granting, through prompt, free and always available means. Designed well, an easy way out increases the way in (1).
10. Measure the right thing and keep an auditable record
A/B testing is a great tool for consent design, but if you're going to run one, measure the right metric. Don't optimize only for the "click on accept": experience and research both warn that, because of habituation, the acceptance rate on its own is a misleading indicator. It's better to bring in KPIs such as informed acceptance, drop-off, complaints and withdrawals.
And another important point is keeping an exact record of every consent (what, when, how), because the law requires you to be able to prove it (1).
References
(1) Law No. 21.719, art. 12 and definitions (letter p). Biblioteca del Congreso Nacional de Chile. Entry into force deferred to December 1, 2026.
(2) European Data Protection Board (EDPB). Guidelines 3/2022 on Deceptive design patterns in social media platform interfaces (version 2.0, adopted in February 2023).
(3) Utz, C., Degeling, M., Fahl, S., Schaub, F. & Holz, T. (2019). (Un)informed Consent: Studying GDPR Consent Notices in the Field. ACM CCS '19.
(4) Machuletz, D. & Böhme, R. (2020). Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR. Proceedings on Privacy Enhancing Technologies (PETs) 2020.
(5) Bielova, N. et al. (2024). The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions. USENIX Security. Online experiment with ~3,947 participants in France.
(6) Compilation of large-scale web measurement studies on cookie banner non-compliance (254,148 sites in 31 countries; 35,000 European sites) and trust perception. Ignite.
