The Reject Button Is There. Finding It Is the Test.
A reject-all button buried in a second layer, shrunk, greyed, or worded as a guilt trip is a deceptive design pattern, and the EDPB has named it as one. Reject has to be as easy as accept.
Open a cookie banner and look at the two buttons. Accept is large, bright, and on the first layer. Reject is smaller, grey, on a second layer behind a settings link, and labeled not now or continue without accepting, as if declining were a temporary state. A shopper who wants to say no has to work for it, and most will not bother.
The European Data Protection Board has named this pattern for what it is: a deceptive design pattern. Its guidelines on the topic say that refusing consent must be as easy as giving it, and that a banner which makes rejection harder than acceptance does not collect valid consent, no matter how many people click accept.
The patterns, named
The first pattern is the hidden reject. Accept sits on the first layer, reject lives behind a settings or preferences link, so declining takes two clicks and accepting takes one. The EDPB's position is that the choice has to be presented at the same level, with the same prominence, or the consent is not freely given.
The second pattern is the shrunken reject. Same layer, but reject is a small text link under a large accept button, in a lighter color, with less padding. The visual hierarchy does the persuading, and the shopper's eye lands on accept before she has read either option.
The third pattern is the guilt trip. Reject is labeled continue without personalization or I prefer less relevant ads, wording that frames declining as a loss instead of a choice. The regulation requires the choice to be neutral, and a label that punishes the shopper for saying no is not neutral.
Why it matters beyond the fine
The immediate risk is enforcement. Regulators have fined sites for banners that make rejection harder than acceptance, and the fines land on the design, not on the absence of a banner. A store that installed a CMP to be compliant, and left the default banner design in place, can be fined for the tool it bought to avoid fines.
The quieter risk is the consent record. If the banner's design is found to be deceptive, the consent it collected is invalid, which means the marketing tags that ran on the back of it ran without a legal basis. The store then has to stop processing, delete what was collected, and re-collect consent properly, which is more expensive than fixing the button in the first place.
Fixing the banner
Put accept and reject on the same layer, the same size, the same color weight, with neutral labels: Accept all and Reject all. No second layer for the choice itself; the settings link is for granular choices, not for the basic yes or no.
Then test it the way a regulator would. Time how long it takes a first-time visitor to reject, and compare it with the time to accept. If rejecting takes longer, the banner is still steering, and the fix is not done. Record the test, because a dated record of the check is the evidence that the store took the requirement seriously.
Related reading: Global Privacy Control: Is Your Banner Listening to the Signal?, Your Banner Speaks One Language. Your Shoppers Read Five., Consent Banners on a One Page Checkout: No Second Screen to Fix a Bad Choice.
Frequently asked questions
Is a reject button on a second layer allowed?
No, under the EDPB's guidance. Refusing consent must be as easy as giving it, so reject has to sit on the same layer as accept, with the same prominence. A reject hidden behind a settings link makes the consent invalid.
What counts as a deceptive design pattern in a banner?
A shrunken or greyed reject button, a reject hidden behind a second layer, or guilt-trip wording like continue without personalization. All three steer the shopper toward accept, and the EDPB has named them as deceptive patterns.
Can a store be fined if it has a consent banner?
Yes. Regulators have fined sites whose banners make rejection harder than acceptance. The fine lands on the design, not on the absence of a banner, so a CMP with a non-compliant default design does not protect the store.
How should accept and reject buttons be designed?
Same layer, same size, same color weight, neutral labels: Accept all and Reject all. Time a first-time visitor rejecting versus accepting; if rejecting takes longer, the banner is still steering and the fix is not done.