Dark Patterns in Cookie Banners: What Regulators Now Prohibit

Why Dark Patterns Are Now an Enforcement Priority

A dark pattern (regulators increasingly prefer the term deceptive design pattern) is an interface deliberately built to steer users toward a choice they would not freely make. In cookie banners, that almost always means nudging visitors to "Accept all" while making it harder, slower, or more confusing to refuse.

For years, banners that technically displayed a choice but quietly stacked the deck were tolerated. That era is over. Data protection authorities across Europe have issued multi-million-euro fines specifically targeting banner design, and the EDPB has published dedicated guidance on deceptive patterns. The legal logic is simple: if the interface manipulates the decision, the resulting consent is not freely given — and consent that is not freely given is invalid. This guide catalogues the patterns regulators have actually penalised and shows the compliant alternative for each.

The Legal Basis: Manipulated Consent Is No Consent

Valid consent under Article 7 GDPR must be freely given, specific, informed, and unambiguous. Two reference points define the standard for banners:

• The CJEU's Planet49 ruling (C-673/17) established that pre-ticked boxes do not constitute valid consent — silence or inactivity is never agreement.
• The EDPB's Guidelines 03/2022 on deceptive design patterns catalogue the manipulation tactics that undermine free choice, from "overloading" to "skipping" and "interface interference."

France's regulator, the CNIL, turned this into headline enforcement when it fined two of the world's largest tech companies a combined €210 million in early 2022 — not for tracking, but specifically because refusing cookies took more clicks than accepting them. The principle they crystallised is now the single most important rule of banner design: refusing must be as easy as accepting. For the deeper regulatory context, see our guide on the CNIL cookie guidelines.

The Dark Patterns Regulators Have Penalised

1. The hidden or buried reject button

The classic violation: a prominent "Accept all" button on the first layer, but no "Reject all" — refusal is hidden behind "Manage preferences," a second screen, and multiple toggles. Regulators treat the extra friction as coercion. Fix: place "Reject all" on the first layer, one click, equal to "Accept all."

2. False hierarchy through colour and contrast

Styling "Accept" as a bright, high-contrast primary button while "Reject" is greyed out, low-contrast, or rendered as plain text. The visual weight pushes the eye toward consent. Fix: give both choices equivalent visual prominence — same size, comparable contrast.

3. Pre-ticked boxes and default-on toggles

Non-essential categories switched on by default so inaction equals consent. Explicitly invalid since Planet49. Fix: all non-essential toggles default to off; consent requires an affirmative action.

4. Nagging and repeated prompts

Re-showing the banner on every page or every visit after a user declines, wearing them down until they accept. Fix: respect a refusal and store it; only re-prompt when there is a legitimate reason, such as a material change — see consent expiry and re-consent.

5. Confirmshaming and emotional steering

Labelling the reject option with guilt-inducing language ("No, I don't want a better experience") instead of neutral wording. Fix: use plain, symmetrical labels — "Accept all" and "Reject all."

6. Forced action and the legitimate-interest loophole

Burying dozens of vendors under "legitimate interest" toggles that are on by default, so even a user who clicks "Reject all" for consent is still tracked. Fix: do not rely on legitimate interest for advertising or analytics tracking that requires consent under the ePrivacy Directive.

7. Misleading link text and obstruction

Making the privacy controls hard to find, using vague link labels, or adding loading delays before the reject action registers. Fix: clear labels, no artificial delay, and a persistent way to reopen settings.

The Symmetry Principle

If you remember one rule, make it this: the path to "no" must be as short, prominent, and easy as the path to "yes." Regulators apply this symmetry test to clicks, visual design, and wording alike.

A compliant first layer typically presents three equally-weighted options side by side: Accept all, Reject all, and Manage preferences. Some banners legitimately omit a first-layer "Reject all" only if accepting also requires opening preferences — but the simplest defensible design keeps both one-click actions visible together. Crucially, symmetry does not require you to hide the accept button or make consent ugly; it requires you not to privilege it.

Verify Your Banner in Practice

Design intent and runtime behaviour can drift apart, so test the live banner, not just the mockup. Confirm that clicking "Reject all" actually prevents non-essential cookies and tags from firing — a banner that says reject but still loads trackers is both a dark pattern and a technical failure. A reliable cookie scanner shows you exactly what fires before and after each choice, and our guide on blocking scripts until consent explains how to enforce the choice at the code level.

Done well, a compliant banner is not a compromise. It builds trust, survives audits, and — as the data on honest optimisation shows — can still earn the consent you need.