Consent is a popular tenant of privacy laws such as the General Data Protection Regulation (GDPR) but the “how” and “why” behind it may be causing organizations some trouble with their compliance efforts.

A new study conducted by researchers from Aarhus University, the Massachusetts Institute of Technology and University College London examined the top 10,000 U.K. websites and the consumer management platforms they utilize. One takeaway was that implicit consent—which the study defines as “continuing to use a website without active objection to a notice”—was practiced by almost one-third of the sites.