The GDPR reject button is not optional. It is not a nice-to-have. It is a legal requirement that has been enforced with nine-figure fines against some of the world's largest companies — and the same legal standard applies to a small business website as to Google.
Where the Legal Requirement Comes From
The requirement for an equally prominent reject option derives from three intersecting sources:
GDPR Article 7(3): "The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw consent as to give it."
If it takes one click to accept cookies but three clicks to reject or withdraw, consent withdrawal is not as easy as consent giving. The design of the initial banner is the primary mechanism through which this symmetry is (or is not) achieved.
EDPB Guidelines 05/2020 on Consent: The European Data Protection Board's binding guidelines explicitly state that consent is not freely given if the user interface steers users towards acceptance. They describe buttons that make acceptance easier or more prominent than rejection as a form of design manipulation incompatible with free consent.
EDPB Guidelines 03/2022 on Dark Patterns: Published in response to widespread non-compliance, these guidelines catalogue specific dark patterns that violate GDPR. The "unequal prominence" pattern — where the accept button is visually dominant and the reject option is minimised — is listed explicitly as illegal.
The Enforcement Record: Real Fines for Real Design Failures
The following fines were issued specifically or substantially because of reject-button design failures:
| Authority | Company | Year | Fine | Primary Reason |
|---|---|---|---|---|
| CNIL (France) | Google LLC | 2022 | €150,000,000 | "Refuse All" required more clicks than "Accept All"; reject option not on first banner layer |
| CNIL (France) | Meta (Facebook) | 2022 | €60,000,000 | Accepting cookies required one click; refusing required multiple clicks through settings |
| CNIL (France) | Microsoft (Bing) | 2023 | €60,000,000 | Advertising cookies placed without consent; no straightforward refusal mechanism |
| AEPD (Spain) | Various websites | 2023–2024 | €10,000–€200,000 | Reject options absent or requiring additional navigation steps |
| Garante (Italy) | Multiple companies | 2023–2024 | €50,000–€10,000,000 | Analytics fired before consent; reject options not at same prominence as accept |
The CNIL's Google decision is the most instructive. Google's banner had an "Accept All" button on the first layer and directed users who wanted to refuse to a separate "Personalise" link, requiring multiple subsequent steps. The CNIL found this asymmetry — one click to accept, several clicks to refuse — made consent non-freely-given and therefore invalid.
What an Illegal Dark Pattern Looks Like
EDPB Guidelines 03/2022 catalogue the following specific dark patterns as illegal in cookie consent interfaces:
Unequal prominence: "Accept All" is a large, coloured, high-contrast button. "Refuse" or "Manage Preferences" is a small, grey, low-contrast text link beneath or beside it. The visual hierarchy communicates that acceptance is the intended action and refusal is the exception.
Confirm-shaming: Using language that guilt-trips the user into accepting — "No thanks, I don't want a better experience" or "Reject (you'll get a worse experience)." The refusal option is labelled in a way designed to discourage its use.
Buried rejection: The reject option exists but is accessible only through multiple clicks — e.g., "Manage Preferences" → "Analytics" → toggle off → "Functional" → toggle off → "Marketing" → toggle off → "Save." The accept option requires one click.
Interface interference: The banner is designed so that clicking anywhere outside it (to close it or to access content) counts as acceptance. Or the close button (×) counts as acceptance rather than rejection.
Misleading labels: Using "Accept" and "Learn More" as the two main options, where "Learn More" leads to another page rather than providing a rejection mechanism.
Deceptive visual styling: Greying out or fading the reject option, making it appear inactive or disabled, while the accept button is bright and saturated.
What a Compliant Reject Mechanism Looks Like
Compliant designs share the following characteristics:
Option 1 — Two symmetric buttons: The banner has two main call-to-action buttons of identical size, padding, and font weight. One says "Accept All" (or equivalent); the other says "Reject All" (or "Decline All"). They may differ in colour (e.g., one filled, one outlined) but must be visually equivalent in weight. An optional "Manage Preferences" link may also be present but does not replace the "Reject All" button.
Option 2 — Category toggles only: The banner presents granular category toggles (analytics off by default, marketing off by default) and a single "Save Preferences" or "Confirm My Choices" button. There is no one-click "Accept All" shortcut, so there is nothing to balance the reject option against. This avoids the prominence problem entirely.
Option 3 — Three-option banner: "Accept All" / "Reject All" / "Manage Preferences" — all presented with equivalent visual weight. This is the most common template in updated enterprise CMPs.
In all compliant designs:
- The reject option is on the first layer of the banner (the initial overlay)
- It does not require the user to navigate to a second page or modal
- It has the same or equivalent visual weight as the accept option
- Clicking it immediately closes the banner and sets all non-necessary cookies to rejected
Compliance Checklist for Your Cookie Banner Reject Mechanism
| Requirement | Action |
|---|---|
| Reject option on first banner layer | Confirm "Reject All" is visible on initial banner without any additional clicks |
| Visual parity with Accept button | Match button size, font weight, and visual prominence |
| No confirm-shaming language | Use neutral labels ("Reject All" / "Accept All") — not value-laden language |
| No interface interference | Closing the banner or clicking outside does not count as acceptance |
| Reject fires immediately | On clicking Reject, all non-necessary scripts are blocked immediately |
| No pre-loaded analytics | Analytics and marketing scripts do not load before consent signal |
| Granular controls available | "Manage Preferences" may supplement but must not replace the Reject All option |
| Withdrawal as easy as consent | "Manage Preferences" link is persistent and accessible at all times after initial consent |
| Consent records logged | Both accept and reject events are logged with timestamp and banner version |
Use our free Cookie Consent Banner Generator to generate a banner configuration that meets the EDPB's equal-prominence standard — with a Reject All button correctly placed and styled on the first banner layer, and no dark patterns.