# The Reject Button Is the Whole Banner: Dark Patterns and the Fines That Followed

Source: https://bannerbulwark.com/blog/2026-11-10-consent-banner-dark-patterns-reject-button-fines.html

November 10, 2026

*Open a consent banner and count the clicks. Accept takes one. Reject takes three, through a settings submenu, past toggles that reset themselves, to a small grey link at the bottom. That difference is not an accident of design. It is the pattern, and regulators have started fining for it by name.*

## What counts as a dark pattern

The GDPR requires consent to be freely given, specific, informed, and unambiguous, and Article 7(3) requires withdrawing it to be as easy as giving it. A banner that makes Accept one click and Reject three clicks fails the freely given test, because the friction is the pressure. The specific layouts regulators have called out are consistent: a bright, prominent Accept button next to a grey, low-contrast Reject link; a Reject option hidden behind a settings or preferences submenu; toggles that default to on and reset when the user changes tabs; and a banner that reappears on every page until the user accepts, wearing down refusal through repetition.

The enforcement is not theoretical. The CNIL has fined companies for consent flows that made refusal harder than acceptance, and the pattern shows up in enforcement across the EU. The fines are not for having a banner. They are for the layout of the banner, and the layout is the part the design team chose. A banner that treats Accept and Reject symmetrically is a compliance control. A banner that does not is a dark pattern with a legal exposure attached.

## The audit takes ten minutes

Open the banner as a first-time visitor and count the clicks to Reject, then count the clicks to Accept. If the numbers differ, the banner has a problem. Then check the visual weight: same size, same contrast, same position in the hierarchy, or the Accept button is doing all the work. Then open the settings submenu and check whether the toggles stay off when you turn them off, and whether they stay off when you switch tabs. Then close the banner without choosing and count how many pages it takes to reappear. If it reappears on the next page, the banner is pressuring the user to accept, and the CNIL's guidance says a site should not re-ask during a browsing session.

The fix is symmetry, and it is cheaper than the fine. Accept and Reject at the same level, same size, same contrast, one click each. Toggles that default off for non-essential purposes and stay where the user puts them. A banner that remembers the choice for six months and does not ask again in the same session. For the banner that fires twice, see [When the Consent Banner Fires Twice: Duplicate CMP Tags](2026-11-09-consent-banner-fires-twice-duplicate-cmp.md), and for the testing that catches this, [Consent Banner A/B Testing: What to Measure Besides Accept Rate](2026-11-09-consent-banner-ab-testing-besides-accept-rate.md).

## Why accept rate is the wrong metric

Teams optimize the banner for accept rate, and a dark pattern is the fastest way to raise it, which is exactly why it is a trap. An accept rate bought with friction is consent that is not freely given, and consent that is not freely given is not valid consent, which means the data collected under it has no legal basis. The metric to optimize is the rate of valid consent: choices made freely, with equal effort, that stay made. That number is lower, and it is the only one that survives an audit.

## Frequently asked questions

### What makes a consent banner a dark pattern?

Any design that makes rejecting harder than accepting: a bright Accept button next to a grey Reject link, Reject hidden in a settings submenu, toggles that default on and reset themselves, or a banner that reappears on every page until the user accepts.

### Is a high accept rate a good sign?

Not if it was bought with friction. Consent that is not freely given is not valid consent, and data collected under invalid consent has no legal basis. Optimize for valid consent, not for the highest accept rate.

### How many clicks should Reject take?

The same as Accept. One click each, at the same level, same size, same contrast. If Reject takes three clicks through a submenu, the banner has a problem.

### Has anyone actually been fined for a banner layout?

Yes. The CNIL has fined companies for consent flows that made refusal harder than acceptance, and the pattern appears in enforcement across the EU. The fines target the layout, not the existence of the banner.