Small changes in UI can have a significant effect on acceptance rate. I'm developing an open-source consent tool (Klaro - https://klaro.kiprotect.com, Github: https://github.com/kiprotect/klaro) and where to put the different buttons, which colors to give to them and how easy to make opt-out is a large debate in our community. By default we favor a very user-friendly approach but we give our users (i.e. the website owners) different ways to ask for consent: A mandatory modal, a consent flow that accepts all cookies/apps (or customize) and a consent flow that accepts only a pre-selection of cookies/apps by default. In every flow there's a "Decline" button that visitors can use, so declining consent is just as easy as giving it. Most website publishers prefer the "Accept all" flow as they usually have a good reason for including a given app/tracker on their website, so only choosing a subset doesn't make much sense. A few sites also implement the mandatory flow, where the visitor won't be able to see the website content until he/she has chosen to either give or decline consent (and again, both options are equally simple to reach).
From a GDPR and ePrivacy perspective it's clear that opting out needs to be just as easy as opting in. Most websites violate this principle as opting in is in fact way easier, and often the UI is designed to be deliberately confusing to the user.
IMHO the consent problem one of the central unsolved issues in privacy though, as most people would not opt-in to tracking if they were given a real choice.
I now see a lot of websites now complying with the "opt-out as easy as opt-in" part by giving you checkboxes for configuring your cookies, with a faint "save choice" button that effectively opts out, and a really obvious, well contrasted "accept all" button. I think that ticks all checkboxes of the law, while still being an obvious dark pattern designed to trick the user into opting in.
From a GDPR and ePrivacy perspective it's clear that opting out needs to be just as easy as opting in. Most websites violate this principle as opting in is in fact way easier, and often the UI is designed to be deliberately confusing to the user.
IMHO the consent problem one of the central unsolved issues in privacy though, as most people would not opt-in to tracking if they were given a real choice.