Dark patterns in cookie banners are designs that make refusing harder than accepting: a hidden or smaller reject option, pre-ticked boxes, confusing colours or guilt-tripping wording. Regulators treat them as invalid consent. The rule they enforce most is simple to state: on the first layer, rejecting must take no more effort than accepting.
What counts as a dark pattern in cookie consent
A dark pattern is a user interface design that steers visitors toward a choice they would not otherwise make. In cookie consent, that typically means making it harder to refuse tracking than to accept it. The term itself comes from UX researcher Harry Brignull, but regulators across Europe now use it in formal enforcement decisions.
The ePrivacy Directive and GDPR both require consent to be freely given, specific, informed, and unambiguous. Article 4(11) of the GDPR defines consent as an act by a "clear affirmative action." Any design that undermines these conditions risks regulatory action.
Dark patterns do not need to be intentional. A poorly designed banner that buries the reject option behind two extra clicks qualifies just as readily as one built to deceive on purpose.
CNIL fines against Shein and Google
France's data protection authority, the CNIL, has fined both companies over cookies, and the cases show different failures.
Shein received a €150 million fine in September 2025. The CNIL found that advertising cookies were placed on visitors' devices the moment they arrived on shein.com, before any interaction with the consent banner. When a user clicked "Refuse all," new cookies were still set and existing ones continued to be read. The banner itself was split across two incomplete interfaces, neither of which explained the advertising purpose of the cookies being placed.
Google was fined twice. In January 2022, the CNIL fined it €150 million because refusing cookies on google.fr and youtube.com took several clicks while accepting took one. In September 2025, it fined Google €325 million for a different failure: ads shown between emails in Gmail without consent, and invalid consent to advertising cookies when people created a Google account.
Together, the cases show that regulators treat consent flows that steer or skip the visitor's choice as a breach of the GDPR's valid consent requirements.
The six most common dark patterns in cookie banners
Enforcement actions and CNIL guidance reveal a clear pattern of recurring violations. The table below summarises the designs that draw the most regulatory attention.
| Dark pattern | What it looks like | Why it breaches the rules |
|---|---|---|
| Hidden reject button | "Accept all" is prominent, and "Reject" is buried in settings or a second layer | Consent is not freely given if refusal requires more effort than acceptance |
| Pre-ticked boxes | Cookie categories are selected by default, and the visitor must untick them | CJEU Planet49 ruling: pre-ticked boxes do not constitute valid consent (Recital 32 GDPR) |
| Confusing colour contrast | "Accept" is a bright button, and "Manage preferences" is a faint text link | Visual hierarchy manipulates the user's choice, undermining "freely given" consent |
| Confirm-shaming language | "No thanks, I don't care about my experience" as the reject option | Emotional manipulation is incompatible with informed, freely given consent |
| Forced action (cookie walls) | Content is blocked entirely unless the user clicks "Accept" | EDPB Guidelines 05/2020: consent obtained through a cookie wall is generally not freely given |
| Incomplete information | Banner lists no purposes, no cookie names, no third parties | Article 5(3) ePrivacy Directive requires clear and comprehensive information before storing data on a device |
Pre-ticked boxes have been invalid since Planet49
The Court of Justice of the European Union settled the pre-ticked box question in the Planet49 case (C-673/17) on 1 October 2019. The ruling established that consent within the meaning of the ePrivacy Directive requires an active indication of the user's wishes. A pre-selected checkbox does not meet this standard.
Seven years on, enforcement continues. On 15 April 2025, the Dutch data protection authority warned 50 organisations about misleading cookie banners, and the CNIL keeps sanctioning cookie failures: 21 organisations in 2025 alone.
If your cookie banner loads with any category other than strictly necessary already ticked, it fails this test.
Hidden reject buttons break the equal-effort rule
The CNIL's 2022 decisions against Google and Facebook established what privacy practitioners now call the "equal friction" rule: refusing cookies must be as easy as accepting them. A single-click "Accept All" button paired with a multi-step rejection path violates Article 5(3) of the ePrivacy Directive.
Following its 2022 fine, Google redesigned its consent interface to show three options on the first layer: "Accept all," "Reject all," and "More options." The CNIL had given Google three months to comply, with a penalty of €100,000 for each day of delay.
The one-click reject principle is now standard across multiple European data protection authorities. Your banner should present both choices on the same screen, with equivalent visual weight.
The same banner with a hidden refusal and with an equal one
How to audit your banner for dark patterns
Run through this checklist against your live banner, or let the GDPR compliance scanner check the first layer for you. Every "no" is something to fix.
- Is "Reject All" (or equivalent) visible on the first layer of the banner?
- Does clicking "Reject All" require the same number of clicks as "Accept All"?
- Are both buttons the same size, colour prominence, and position?
- Are all non-essential cookie categories unticked by default?
- Does the banner clearly state the purposes of the cookies (analytics, advertising, functional)?
- Can visitors change their mind after consenting, and is the mechanism easy to find?
- Does the banner avoid emotional language that shames users into accepting?
- Are cookies actually blocked until consent is given? (Test with Chrome DevTools)
Automated scanning can catch some of these issues. A cookie scanner will reveal whether tracking cookies fire before the user interacts with the banner, the same failure the CNIL found at Shein.
Testing reject functionality
Click "Reject All" on your own banner, then open the browser's Application panel in DevTools. Filter by third-party domains. If you see cookies from doubleclick.net, facebook.com, or analytics.google.com, your reject mechanism is broken. The CNIL cited this failure in the Shein decision: the "Refuse all" button did not actually prevent new cookies from being set.
Enforcement beyond France
The CNIL has been the most active enforcer on cookie dark patterns, but other authorities follow the same line, and news publishers face particular scrutiny over cookie walls that condition access to news content on accepting tracking.
The UK ICO has preferred warnings to fines: in January 2025 it contacted 134 of the top 200 UK websites about their banners, and by December 2025 it reported 979 of the top 1,000 as compliant. Its storage and access technologies guidance, finalised on 29 April 2026, expects rejecting to be as easy as accepting. In California, the 2026 CCPA regulations add their own dark pattern rules for opt-out choices.
How to design a banner without dark patterns
A well-designed banner does not need dark patterns. These principles follow what regulators have asked for in their decisions and guidance.
Button parity
Place "Accept all" and "Reject all" side by side on the first layer, as Kukie.io's consent banner does by default. Use the same button size, font weight, and colour treatment. A third "Manage Preferences" option can link to granular controls, but the binary choice must be immediately available.
Default state
Every toggle and checkbox for non-essential cookies must be off by default. Only strictly necessary cookies should be pre-enabled, and these should not have a toggle at all since they do not require consent.
Clear purpose labels
Label each category with plain language: "Advertising," "Analytics," "Functional." Name the third parties involved. Vague labels like "Improve your experience" obscure the actual data processing and fail the informed consent test.
Make withdrawal as easy as consent
GDPR Article 7(3) states that withdrawing consent must be as easy as giving it. A persistent icon or footer link that reopens the consent preferences does this. Hiding the option in a privacy policy buried three clicks deep does not.
The business case against dark patterns
Dark patterns may inflate consent rates in the short term, but the risk calculation has shifted. The CNIL's €150 million fine against Shein is one of several large cookie fines in 2025, and the GDPR allows penalties of up to 4% of worldwide annual turnover.
A fair banner has a measurable cost. In a 2020 field experiment by Nouwens and colleagues, removing "Reject all" from the first layer raised consent by 22 to 23 percentage points. That gap is what a visible refusal costs, and it is the gap regulators say the visitor is entitled to.
Building trust with visitors creates long-term value that inflated consent numbers cannot replicate.
Questions about dark patterns in cookie banners
What is a dark pattern in a cookie banner?
A dark pattern is any design choice that manipulates visitors into accepting cookies they would otherwise refuse. Common examples include hiding the reject button behind extra clicks, using pre-ticked boxes, or making the accept button visually dominant.
Is it illegal to make the reject button smaller than the accept button?
The CNIL and other European regulators consider asymmetric button designs a violation of freely given consent under the GDPR. Both buttons should have equivalent visual prominence.
How much was Shein fined for its cookie practices?
Shein was fined €150 million by the CNIL in September 2025 for placing advertising cookies before consent, providing incomplete information in the banner, and continuing to set cookies after users clicked "Refuse all."
Are pre-ticked cookie consent boxes legal under GDPR?
No. The CJEU ruled in the Planet49 case (C-673/17) that pre-ticked boxes do not constitute valid consent. GDPR Recital 32 explicitly excludes silence, pre-ticked boxes, and inactivity as forms of consent.
Do I need a reject all button on my cookie banner?
European regulators expect a "Reject All" option on the first layer of the banner that requires the same number of clicks as "Accept All." The CNIL fined Google in 2022 because rejecting took more clicks than accepting.
Can I use a cookie wall to block content until users accept cookies?
The EDPB's Guidelines 05/2020 state that consent obtained through a cookie wall is generally not freely given. Some authorities allow "pay or consent" models for publishers, but a blanket cookie wall is a high-risk approach.
Check your banner's first layer for equal choices
If you are not sure whether your banner uses dark patterns, check it against the rules regulators enforce. The GDPR compliance scanner looks at your live banner's first layer, and the cookie scanner shows which cookies fire before a choice. Kukie.io's banner shows "Reject all" next to "Accept all" with equal weight.
