The consent banner designs European regulators object to

In this article

A consent banner is the one part of a website’s compliance that every visitor sees, which is why it attracts so many complaints. It is also where design and law meet most directly. A banner can contain all the right words and still fail, because the way it presents the choice makes one answer much easier than the other. European authorities have spent the past few years agreeing on what that looks like in practice.

01Why design is a legal question

For cookies and similar technologies, consent is required by Article 5(3) of the ePrivacy Directive (2002/58/EC), and the standard for that consent comes from the GDPR. Under Article 4(11) GDPR, consent must be freely given, specific, informed and unambiguous, expressed by a statement or a clear affirmative action. Recital 32 adds that silence, pre-ticked boxes and inactivity do not count. Article 7(1) puts the burden of proof on the website operator, and Article 7(3) requires that withdrawing consent be as easy as giving it.

Each of those words can be undone by design. A choice is not free if refusing takes five clicks and accepting takes one. It is not informed if the purposes are hidden behind a link nobody notices. It is not unambiguous if closing the banner is treated as agreement. That is why authorities assess the banner as a whole, not only its text.

02The common ground: the Cookie Banner Taskforce

In 2021 the privacy group noyb filed hundreds of complaints about cookie banners with authorities across Europe. To answer them consistently, the European Data Protection Board set up a Cookie Banner Taskforce, whose report was adopted in January 2023. It records the positions on which the participating authorities agreed, as a common denominator for handling complaints. It is not binding law, and national authorities still decide individual cases, but it is the clearest map available of what they treat as a problem.

The report also restates an important structural point: placing or reading cookies is governed by the national laws implementing the ePrivacy Directive, and the GDPR’s one-stop-shop mechanism, under which a company deals mainly with the authority where it has its main EU establishment, does not apply to those rules. An authority in any country where your site is used may act.

03Pattern 1: an “accept” button with no “reject” beside it

The most common complaint. A vast majority of the authorities in the taskforce considered that a banner offering a consent button on a layer, without an equivalent way to refuse on that same layer, does not obtain valid consent. Sending visitors to a second screen of settings to say no, while yes is one click away, is the textbook case.

This is also the pattern behind two of the best-known fines. On 31 December 2021 France’s CNIL fined Google LLC and Google Ireland Limited a total of €150 million, and Facebook Ireland Limited €60 million, because refusing cookies on google.fr, youtube.com and facebook.com took several clicks while accepting took one. The CNIL acted under the French law implementing the ePrivacy Directive, and also ordered the companies to offer a refusal mechanism as simple as acceptance.

04Pattern 2: pre-ticked boxes and consent by scrolling

A checkbox that is already ticked is not a clear affirmative act. The Court of Justice said so for cookies in Planet49 (Case C-673/17, 2019), and the taskforce report repeats it. The same reasoning applies to toggles that start in the “on” position in a settings layer.

The EDPB’s Guidelines 05/2020 on consent go further: actions such as scrolling or swiping through a page, or similar user activity, do not satisfy the requirement of a clear and affirmative action. A banner that says “by continuing to browse you agree” is relying on something the law does not recognise as consent.

05Pattern 3: deceptive links, colours and contrast

The taskforce looked at designs where the refuse option exists but is hard to see: a “reject” link buried in a paragraph of text, a refuse button placed outside the banner, or a button whose colour and contrast make it nearly invisible next to a bold “accept”.

The authorities agreed that a refuse option presented only as a link in running text, without enough visual support to make it noticeable, does not lead to valid consent. On colours and contrast they declined to impose one design standard; each banner is judged on its own facts. But a design that is plainly misleading, such as a reject button with text so faint it cannot be read, was given as an example of what crosses the line.

The practical rule is simple: give “accept” and “reject” the same shape, size and visual weight, on the same layer.

06Pattern 4: “legitimate interest” switches and inflated “essential” lists

Some banners present a second set of toggles for purposes that the site says it pursues on the basis of “legitimate interest”, already switched on. For the act of storing or reading information on the device, Article 5(3) of the ePrivacy Directive allows only two routes: consent, or the narrow strict-necessity exemptions. Legitimate interest is not one of them, and the taskforce report says the authorities do not accept it as a substitute.

A related pattern is the “strictly necessary” category stretched to cover analytics, A/B testing or advertising tools. Authorities have treated the misclassification of cookies as essential as a problem in its own right. A scan report is the quickest way to check: compare what loads before any choice with what your banner calls necessary.

These issues reach the industry’s own standards. In February 2022 the Belgian Data Protection Authority fined IAB Europe €250,000 over its Transparency and Consent Framework, used by many consent platforms, and in March 2024 the Court of Justice confirmed, in Case C-604/22, that the consent string the framework stores can be personal data.

07Pattern 5: cookie walls and “pay or consent”

A cookie wall blocks access to a site unless the visitor accepts tracking. The EDPB’s Guidelines 05/2020 state that consent obtained this way is not freely given. Whether a site may instead offer a paid alternative to consent is a newer and more contested question. In April 2024 the EDPB adopted Opinion 08/2024 on “consent or pay” models used by large online platforms, concluding that in most cases offering only a binary choice between consenting and paying will not meet the requirements for valid consent. The opinion addresses large platforms specifically; for ordinary websites, national authorities' positions differ, and the safest course is to check the guidance of each authority whose residents you serve.

08Pattern 6: easy to give, hard to take back

Article 7(3) GDPR requires that withdrawing consent be as easy as giving it. If consent was given with one click on a banner, withdrawing it should not require an email to the data protection officer. The taskforce report discussed the absence of any persistent way to reopen the consent choices, such as a small icon or a footer link; the authorities agreed that some easily accessible means to withdraw must exist, and that it should be clearly visible where it is placed.

09Beyond data protection law

Manipulative interface design is also addressed outside the GDPR. Article 25 of the Digital Services Act (Regulation (EU) 2022/2065) prohibits providers of online platforms from designing their interfaces in a way that deceives or manipulates users or materially distorts their ability to make free and informed decisions; it does not apply to practices already covered by the GDPR or the Unfair Commercial Practices Directive. That directive (2005/29/EC) applies to misleading and aggressive practices toward consumers generally, and the European Commission’s 2021 guidance on it includes a section on data-driven practices and dark patterns.

10A five-minute self-test

Open your site in a private window, from a device and country your customers use, and check:

1. Is there a refuse option on the first layer, as easy to find and press as “accept”?
2. Are all optional purposes switched off until the visitor switches them on?
3. Does anything non-essential load before you choose, or after you refuse? (A scan report answers this; see how to read one.)
4. Does the banner name the purposes and the companies that will receive data?
5. Can you reopen the choice later, from every page, in one or two clicks?
6. Does the site work if you refuse?

A “no” to any of the first five is worth fixing before anything else in your compliance backlog.

11Sources and further reading

Primary legal texts and official guidance referred to above. Links go to the official publishers.

1. Regulation (EU) 2016/679 (GDPR) (eur-lex.europa.eu)
2. Directive 2002/58/EC (ePrivacy Directive) (eur-lex.europa.eu)
3. EDPB, Report of the work undertaken by the Cookie Banner Taskforce (January 2023) (edpb.europa.eu)
4. EDPB Guidelines 05/2020 on consent (edpb.europa.eu)
5. EDPB Opinion 08/2024 on consent or pay models (April 2024) (edpb.europa.eu)
6. Court of Justice of the EU, Case C-673/17 Planet49 (curia.europa.eu)
7. Court of Justice of the EU, Case C-604/22 IAB Europe (curia.europa.eu)
8. CNIL: the Conseil d’État confirms the 2020 cookie sanction against Google (cnil.fr)
9. Regulation (EU) 2022/2065 (Digital Services Act) (eur-lex.europa.eu)
10. Directive 2005/29/EC (Unfair Commercial Practices Directive) (eur-lex.europa.eu)