Revealing the restrictiveness-fairness paradox in general data protection regulation consent practices: evidence from a mixed-methods study

Purpose Restrictive cookie consent may satisfy regulatory requirements while limiting meaningful privacy choice. Existing privacy research explains why users disclose information despite privacy concerns, but less is known about why they continue using digital services after judging consent procedures as unfair. This study examines how users interpret restrictive consent, how regulatory contexts shape evaluations and why unfairness coexists with continued engagement. Design/methodology/approach An exploratory sequential mixed-methods design was used. Study 1 analyzed qualitative responses from users in General Data Protection Regulation (GDPR) and non-GDPR contexts to develop a Communication Privacy Management (CPM)-based model. Study 2 tested the model through two experiments and a pooled post hoc analysis examining how restrictiveness and institutional privacy boundaries shape privacy risk-control assessments, fairness and intention to use online flight-booking websites. Findings Restrictive consent consistently reduced perceived fairness without reliably reducing intention to use website services, revealing a Restrictiveness-Fairness Paradox: users continue engaging despite judging consent procedures as unfair. GDPR also functions as an institutional privacy boundary that changes the fairness cues users rely on. Research limitations/implications The study identifies procedural fairness as a distinct mechanism underlying continued engagement and extends CPM theory by conceptualizing restrictive consent as privacy turbulence and GDPR as an institutional privacy boundary. Practical implications Legal compliance alone may not ensure perceived fairness. The study introduces Fairness Calibration, whereby organizations align consent interfaces with users’ fairness expectations and institutional context to support meaningful choice. Social implications The findings suggest that meaningful consent and perceived fairness are important for trust in digital services, particularly across uneven regulatory contexts, supporting more transparent and user-centered privacy protections. Originality/value The study conceptualizes the Restrictiveness-Fairness Paradox as a distinct form of behavioral persistence under constrained privacy choice.