# Cookie banner dark patterns regulators target

> Pre-ticked boxes, hidden reject buttons and cookie walls can invalidate consent. See which banner dark patterns regulators target and how to fix them.

Source: https://www.cookiesh.eu/blog/cookie-banner-dark-patterns  
Published: 2026-04-07

## Key takeaways

- Consent collected through a manipulative banner is not valid, so cookies set on the strength of it lack a lawful basis.
- Regulators expect refusing cookies to be as easy as accepting them, which in practice means a reject option on the first layer.
- Pre-ticked boxes, implied consent from scrolling and cookie walls are among the patterns EU authorities reject most consistently.
- California's CPRA also states that agreement obtained through dark patterns does not count as consent.

Cookie banner dark patterns are design choices that steer visitors toward accepting cookies: hiding the reject option, pre-ticking boxes, pairing a bright "Accept" button with a faint "Settings" link, or treating scrolling as agreement. EU regulators treat consent obtained this way as invalid, because GDPR requires consent to be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

## Why do regulators care about banner design?

Because the validity of consent depends on how you collected it. Article 4(11) of GDPR defines consent as a freely given, specific, informed and unambiguous indication of a person's wishes, given by a clear affirmative action. Article 7 adds that you must be able to demonstrate consent, and that withdrawing it must be as easy as giving it.

A banner that nudges people into clicking "Accept" fails those conditions. When it does, every non-essential cookie set afterward was set without valid consent, which breaches the ePrivacy rules, and processing built on that data lacks a lawful basis. Serious GDPR infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher.

The best-known example is the CNIL's December 2021 decisions against Google (€150 million) and Facebook (€60 million). The French regulator found that refusing cookies on their sites was harder than accepting them. For more cases and what they teach, see [what cookie enforcement actions teach website owners](/blog/cookie-enforcement-lessons).

## Which dark patterns do regulators target most?

The patterns that draw the most attention make refusal harder, less visible or less clear than acceptance. This table summarizes the main ones and how to fix them.

| Dark pattern | What it looks like | Why it fails | Fix |
|---|---|---|---|
| No reject on the first layer | "Accept all" and "Manage settings" only | Refusing takes more effort than accepting | Put "Reject all" next to "Accept all" |
| Pre-ticked boxes | Analytics and marketing toggles already on | Not a clear affirmative action | Default every non-essential toggle to off |
| Visual asymmetry | Bold colored accept button, gray text link to reject | Steers the choice through design | Give both options equal size, weight and contrast |
| Implied consent | "By continuing to browse, you agree" | Browsing or scrolling is not a clear affirmative action | Set nothing non-essential until a real choice is made |
| Cookie walls | Content blocked unless the visitor accepts | Consent is generally not freely given | Allow access without accepting non-essential cookies |
| Vague or misleading copy | "We value your privacy" with a single "OK" | Consent is not informed | Name the purposes in plain language |
| Hidden withdrawal | No way to reopen settings after choosing | Withdrawal must be as easy as giving consent | Add a persistent "Cookie settings" link |
| Nagging | Banner reappears after every refusal | Pressures people into accepting | Remember refusals for a reasonable period |

The pre-ticked box rule comes from the CJEU's Planet49 judgment (C-673/17, 2019), which held that a pre-checked box the user must uncheck to refuse does not produce valid consent. The EDPB's consent guidelines add that scrolling or swiping through a page is not consent, and that making access to content conditional on accepting cookies generally means consent is not freely given.

## Is a "Reject all" button legally required?

GDPR does not mention buttons, but regulators require refusal to be as easy as acceptance, and the simplest way to meet that standard is a reject option on the first layer. A banner with one-click acceptance and multi-step refusal is the pattern most likely to draw enforcement.

The button does not have to say "Reject all" word for word. "Decline," "Refuse non-essential" or "Continue without accepting" can work if the option is clearly visible, sits at the same level as the accept button, and actually results in no non-essential cookies being set. A tiny, low-contrast "continue without accepting" link in a corner is unlikely to pass.

## What about the close button and the settings layer?

A close button, often an "X," must never be treated as acceptance. If you offer one, treat closing the banner as a refusal, or at least as no decision, and set nothing non-essential.

The second layer deserves the same scrutiny. Watch for these subtler patterns:

- Toggles labeled "legitimate interest" that are switched on by default and require a separate objection.
- A prominent "Accept all" button in the settings panel, while "Save choices" sits below a long vendor list.
- Category descriptions that downplay tracking, such as calling advertising cookies "performance" cookies.
- Confirmation dialogs that ask "Are you sure?" only when someone refuses.

## How do I audit my own banner for dark patterns?

Test the banner as a skeptical visitor would, on both desktop and mobile, then work through this checklist:

1. Accept and reject are both on the first layer and take the same number of clicks.
2. Both options have equivalent size, color weight and contrast.
3. No non-essential toggle is on by default.
4. No non-essential cookie or tag fires before a choice, confirmed in a clean browser session.
5. Closing or ignoring the banner does not count as acceptance.
6. Purposes are described in specific, plain language.
7. A persistent link lets visitors change or withdraw consent at any time.
8. Refusals are remembered and not immediately re-prompted.

For the full legal conditions behind these checks, see [the conditions for valid cookie consent under GDPR](/blog/valid-consent-checklist). For positive design guidance rather than a list of things to avoid, read [how to design a cookie banner that is compliant and user-friendly](/blog/cookie-banner-design-best-practices).

## Do dark pattern rules apply outside the EU?

Yes, in different forms. In the UK, the ICO enforces UK GDPR and PECR with consent standards closely aligned to the EU's, and has publicly pressed websites to make rejecting cookies as easy as accepting them. Brazil's LGPD likewise requires consent to be free, informed and unambiguous.

California takes an opt-out approach, but the CPRA states that agreement obtained through dark patterns does not constitute consent, and the California Privacy Protection Agency's regulations call for symmetry in choice. An opt-out flow that is harder to complete than its alternative raises the same concerns as an EU banner without a reject button. See [CCPA and CPRA: what US privacy law means for cookies](/blog/ccpa-cpra-cookies) for details.

## Bottom line

Regulators judge a banner by its effect: can a visitor refuse as easily as they accept, and does refusing actually stop tracking? Remove any design that tilts that balance, verify that the technical behavior matches the buttons, and document what you changed and why. Tools like Cookiesh can automate cookie scanning and keep immutable consent logs, which helps you show what visitors actually chose.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Is it a dark pattern to use our brand color for the Accept button?

It can be, if the reject option ends up visibly less prominent. Brand colors are fine as long as accept and reject have comparable size, contrast and placement, so neither choice is visually favored.

### Can I show the banner again after someone rejects cookies?

Not on every page or visit. Asking again and again after a clear refusal pressures people into accepting. Re-ask only after a reasonable period, or when your purposes or vendors change meaningfully.

### Do dark pattern rules apply to small websites?

Yes. The consent requirements apply regardless of company size. Headline fines have mostly targeted large platforms, but any site can be ordered to fix its banner and stop processing data collected without valid consent.

## Sources

- [CJEU case C-673/17 (Planet49)](https://curia.europa.eu/juris/liste.jsf?num=C-673/17)
- [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
- [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [California Privacy Protection Agency](https://cppa.ca.gov/)