What the CCPA's dark pattern rules mean for cookie banners
Under the California Consumer Privacy Act (CCPA), a cookie banner that makes saying no harder than saying yes is a dark pattern, and agreement obtained through a dark pattern is not consent. The rule of "symmetry in choice" has been in the CCPA regulations since 29 March 2023. The California Privacy Protection Agency (CPPA) explained it in an enforcement advisory in September 2024, enforced it against Honda in March 2025, and the regulations that took effect on 1 January 2026 added new examples, including that closing a pop-up is not consent.
The rules below are California's. The general design problem, and how European regulators see it, is covered in the guide to dark patterns in cookie banners.
The CCPA is an opt-out law for adults: it does not require opt-in consent before cookies load. The dark pattern rules apply whenever a business offers a privacy choice or asks for consent, such as the opt-out of sale and sharing, opting back in after an opt-out, opt-in for known minors under 16, or a consent banner the business chooses to show. If the design nudges a visitor towards giving up more data, the resulting agreement does not count.
Regulators are looking past the legal text in your privacy policy at what your banner actually does. The CPPA's Enforcement Advisory 2024-02 sums up the approach in one line: "Dark patterns are about effect, not intent." European regulators reached a similar view earlier, when the French CNIL fined Google 150 million euros in 2022 over a refusal that took more clicks than acceptance.
The end of asymmetrical consent choices
Symmetry in choice is the core of the California rules. Section 7004(a)(2) of the regulations says the path to the more privacy-protective option must not be longer, harder or more time-consuming than the path to the less protective one.
Many websites still use a highly visible "Accept All" button alongside a muted "Settings" or "Preferences" link. The regulations treat a banner whose only choices are "Accept All" and "Preferences" as not symmetrical, because accepting takes one step and declining takes several, and the advisory gives "Accept All" and "Decline All" as the symmetrical alternative.
Visual weight matters too. The 2026 regulations added an example that a choice featured more prominently, larger in size or in a more eye-catching colour, than the alternative is not equal or symmetrical. If your accept button is bright blue, a reject option in light grey text on a white background works against you.
| Design element | Dark pattern | Symmetrical approach |
|---|---|---|
| Button colours | High contrast for Accept, low contrast for Reject | Identical contrast and visual weight |
| Choice architecture | "Accept All" and "Manage Preferences" | "Accept All" and "Reject All" |
| Default state | Pre-ticked consent boxes | All boxes unticked by default |
| Banner dismissal | Treating a closed banner as consent | Consent only through an explicit choice |
| Opt-in wording | "Yes" and "Ask me later" | "Yes" and "No" |
The Honda case: two clicks to say no, one to say yes
The CPPA's first fine showed what symmetry means in practice. According to the stipulated order against American Honda Motor Co. of 7 March 2025, Honda's cookie management tool had advertising cookies switched on by default. Turning them off took two steps: the toggle, then a "Confirm My Choices" button. Turning them back on took one click on "Allow All".
The Honda cookie tool before and after the CPPA order
Honda paid $632,500 for this and other failures and agreed to add a "Reject All" button beside "Allow All". The same order required Honda to apply Global Privacy Control signals to signed-in consumers too.
Withdrawing a choice must match the opt-in process
Giving visitors the ability to change their minds is as important as the first choice. Under the regulations, opting out of sale or sharing must not take more steps than opting back in.
If a visitor can accept all cookies with a single click on your homepage, they should be able to withdraw with equal ease. Forcing a visitor to dig through a dense privacy policy to find an opt-out link works against that rule. A persistent privacy icon or a clear footer link should give immediate access to the preferences.
The CPPA expects websites to honour opt-out preference signals such as Global Privacy Control (GPC). If a browser sends a GPC signal, your site must treat it as a valid opt-out of sale and sharing without requiring the visitor to interact with a banner. Do Not Track is not a recognised opt-out signal under the CCPA. Since 1 January 2026, the regulations also require businesses to show whether they processed the signal.
Common dark patterns to remove
Several practices appear in the regulations as examples of choices that are not symmetrical or that confuse the consumer.
- False urgency: a countdown clock next to a consent choice saying time is running out, when the offer is not really limited, is misleading (an example added in 2026).
- Closing as consent: closing or navigating away from a pop-up that asks for consent, without selecting the equivalent of "I accept", is not consent (also added in 2026), and neither is a consumer's silence.
- Confusing toggles and double negatives: "Yes" or "No" next to "Do Not Sell or Share My Personal Information", or "on" and "off" toggles without clarifying text.
- Guilt and shaming: wording such as "No, I do not want a better experience" steers the choice and works against the requirement for neutral, easy-to-understand language.
Shrouding information in legal jargon also works against the rules. The advisory asks businesses whether their language is "easy to read and understandable" and avoids "technical or legal jargon".
Your consent management platform should explain what data is collected and why. Vague statements about "improving services" do not tell visitors what they are agreeing to. Categorise trackers accurately in your cookie categories, distinguishing between marketing scripts and functional cookies, and give visitors control over each category.
How the CPPA enforces the rules
Regulators in California have shifted their focus from policy text to technical implementation. The CPPA's advisory states that dark patterns are about effect rather than intent, and it reminds businesses that this includes interfaces they deploy through service providers, such as consent management platforms. A business cannot point to its vendor if the design it uses misleads consumers.
Recent cases show the pattern. Besides Honda, the CPPA fined PlayOn Sports $1.1 million in March 2026 for making visitors click "agree" to tracking before they could use their tickets and for ignoring opt-out preference signals. The same month, Ford paid $375,703 for requiring an email confirmation before acting on opt-outs. In September 2025, the CPPA and the Attorneys General of California, Colorado and Connecticut announced a joint sweep of businesses that may not be honouring GPC.
Keep consent logs that show when and how each visitor made a choice, so you can answer questions about a specific visitor's consent or opt-out. Penalties are counted per violation, up to $2,663 each or $7,988 if intentional, and regulators have counted violations per consumer affected, so the total grows quickly on high-traffic sites. The full list of cases is in the guide to CCPA penalties and enforcement.
The impact on mobile and app interfaces
Screen size does not exempt you from the symmetry rules.
Mobile websites and native apps are covered by the same rules on choice architecture. A reject option hidden below the fold on a phone, while the accept button sits in plain view, makes the privacy-protective path longer and is likely to be read as asymmetrical.
Touch targets should be adequately sized and spaced to prevent accidental taps. A large accept button next to a tiny, hard-to-tap reject link is the mobile version of the colour imbalance the 2026 example describes.
Apps also need to think about repeated prompts. After a consumer opts out of sale or sharing, the regulations require a business to wait at least 12 months before asking them to opt back in, so a banner that keeps reopening to ask again breaks that rule. If a visitor has already said no at the operating-system level, for example through Apple's App Tracking Transparency, asking again in your own prompt adds pressure the regulations are designed to avoid.
How to audit your CMP for the CCPA rules
As of October 2026, the 2026 examples have applied for more than nine months, so a review is overdue rather than early. Start by evaluating the exact journey a new visitor takes.
Open your site in a private window, or run it through the GDPR compliance scanner, to see your banner as a visitor does. Count the clicks needed to accept and the clicks needed to reject. If the reject path takes even one extra click, adjust your configuration. Then turn on GPC in a browser that offers it and check that advertising tags stay off and that your site shows the opt-out was processed.
Short answers on California's dark pattern rules
Do I need separate accept and reject buttons on my cookie banner?
Only if your banner offers an "Accept All" choice. The CCPA does not require a cookie banner, but if yours offers "Accept All", the privacy-protective choice must be just as easy. The CPPA's March 2025 order against Honda required a "Reject All" button beside "Allow All".
Can I use different colours for the accept and reject options?
It is risky. The 2026 regulations give the example that a choice featured more prominently, larger or in a more eye-catching colour, is not equal or symmetrical. Give both buttons the same visual weight and contrast.
Does closing the cookie pop-up count as consent?
No. Since 1 January 2026, the regulations state that closing or navigating away from a pop-up that asks for consent, without selecting the equivalent of "I accept", does not count as consent, and neither does a consumer's silence.
How easy does withdrawing a choice need to be?
Opting out of sale or sharing must not take more steps than opting back in. You cannot bury the opt-out in a complex menu, and after an opt-out you must wait at least 12 months before asking the consumer to opt back in.
Do these rules apply if my business is not based in California?
If your website collects data from California residents and meets the CCPA revenue or volume thresholds, these design rules apply regardless of your physical location.
Check your banner's reject path
If your current banner uses asymmetrical buttons or hides the reject option, it is exactly what the Honda order targeted. Kukie.io's banner can show "Accept all" and "Reject all" as equal buttons on the first layer, can treat a GPC signal as an opt-out in the regions where you use an opt-out model, and records each visitor's choice in the Consent Log.
