One-click reject means a visitor can refuse all non-essential cookies with one click on the first layer of the banner, just as they can accept them. As of October 2026 no EU law states that rule in those words. It comes from the ePrivacy Directive's consent requirement as regulators apply it: the EDPB's cookie banner taskforce, the CNIL and Spain's AEPD all treat a banner that offers "Accept" without an equal way to refuse as a breach. The European Commission's Digital Omnibus would write one-click refusal into law, but it is still a proposal.
Refusing cookies should take the same effort as accepting them
Refusing cookies on many websites still takes more effort than accepting them. A large "Accept all" button sits front and centre, while the option to decline hides behind a smaller link, a different colour or a second layer of menus. EU regulators have spent the past three years making clear that this imbalance breaks the rules on consent.
The principle is direct: if a visitor can accept all non-essential cookies with a single click, refusing them should take exactly the same effort. This idea, often called button parity, is already enforced by several data protection authorities, and the European Commission's proposed Digital Omnibus package would write it into the GDPR.
Where the requirement comes from
Button parity is not a single rule you can look up in one place. It draws on several overlapping sources.
Article 5(3) of the ePrivacy Directive requires prior consent before storing or accessing information on a user's device, unless the cookie is strictly necessary. The GDPR then sets the standard for valid consent: freely given, specific, informed and unambiguous (Article 4(11)), and as easy to withdraw as to give (Article 7).
The EDPB's cookie banner taskforce report of 18 January 2023 records the regulators' position. A vast majority of authorities considered that a banner with an accept button but no refuse option on the same layer does not give valid consent and breaches the ePrivacy Directive. A few said they could not find an infringement, because Article 5(3) does not mention a reject option.
The CNIL's enforcement record
The CNIL, France's data protection authority, has been the most active enforcer.
On 1 September 2025 the CNIL fined SHEIN EUR 150 million. According to the CNIL's decision summary, advertising cookies were placed as soon as visitors arrived, before any choice, the banner's information was incomplete, and after a click on "Refuse all", new cookies were still placed and existing ones were still read. The same day the CNIL fined Google EUR 325 million, bringing the two fines to EUR 475 million.
The CNIL has also issued formal notices to website publishers over dark patterns in cookie banners, including a round on 12 December 2024. Practices it has objected to include a prominent "Accept" button paired with a small text link for refusing, and refusal flows that send visitors through settings pages.
The CNIL's position is that "Refuse all" and "Accept all" should appear on the same layer, with comparable size, colour and visual weight.
What the Digital Omnibus would change
On 19 November 2025 the European Commission published its Digital Omnibus proposal, which would move the cookie rules into the GDPR. As proposed, three changes concern refusal:
- One-click accept and one-click refuse at the same level on every banner, with no multi-layer refusal flows
- A machine-readable signal from browsers and operating systems, similar to Global Privacy Control, that sites would have to respect (Article 88b)
- No new request for the same purpose for six months after a visitor refuses
As of October 2026, none of this applies. The European Parliament's file 2025/0360(COD) shows the proposal still with its committees, and the Parliament has adopted no position. The Council's compromise text of 18 June 2026 removed the browser-signal article (88b) entirely, according to noyb's report on the Council text. Both institutions still have to agree on a final text, so treat every detail above as uncertain.
How the reject-button rule developed
What button parity looks like in practice
Meeting the standard takes more than adding a reject button. The design details matter.
Visual equivalence
Both buttons need equal visual prominence. A filled, brightly coloured "Accept all" next to an outlined, grey "Reject all" does not meet it. Regulators assess each banner on its own, but the principle holds: neither option should visually dominate the other.
Placement and wording
The refuse option belongs on the first layer of the banner, next to accept. Placing it inside a "Manage preferences" panel fails the one-click test. Wording should be direct, "Reject all" or "Refuse all", rather than vague alternatives like "Continue browsing" or "Maybe later".
Technical effect
Selecting "Reject all" must actually block non-essential cookies. The SHEIN decision shows that a reject button that does not stop cookies is itself a breach. Check that cookies like _ga, _fbp and other tracking identifiers are absent from the browser after rejection. A cookie audit confirms whether your banner does what it says.
What regulators look for, at a glance
| Point | In line with regulators' guidance | Flagged by regulators |
|---|---|---|
| Reject button layer | First layer, next to Accept | Hidden in settings or a second layer |
| Button size and colour | Equal visual weight | Accept is bold and coloured, Reject is grey or a text link |
| Wording | "Reject all" or "Refuse all" | "Maybe later", "Continue without" far from the buttons, or no label |
| Technical effect | All non-essential cookies blocked | Tracking scripts still run after rejection |
A rule against asking again for six months after a refusal is part of the Digital Omnibus proposal only. It is not in force.
How other regulators approach reject buttons
Not every EU member state enforced button parity the same way. Spain's AEPD once accepted a "Manage settings" link on the first layer as an alternative to a reject button, but its cookie guide updated on 11 July 2023 requires accepting and rejecting to be offered prominently and at the same level, with refusing no harder than accepting.
The EDPB taskforce report recorded some differences between authorities, but a first-layer reject button is the position most of them hold. If your website serves visitors from several EU countries, designing to the strictest standard reduces risk across your rules for each region.
Steps to check your banner
Whatever happens to the Digital Omnibus, current enforcement already expects button parity.
Check your current banner
Open your website in a private browsing window. Check whether "Reject all" appears on the first screen alongside "Accept all". If it does not, your banner falls short of what the CNIL, the EDPB taskforce and most other EU authorities expect.
Update the banner design
Give both buttons the same styling. The cookie banner design guide covers how to get visual parity right. A banner with an equal Reject all on the first layer is the starting point.
Test the technical layer
After selecting "Reject all", open your browser's developer tools and check that no non-essential cookies are set. Check the Network tab for requests to third-party tracking domains.
Follow the browser-signal debate
Browser-level consent signals are uncertain in the EU after the Council's June 2026 text. Signals like Global Privacy Control already carry legal weight in California and several other US states, so supporting them is useful today, whatever the EU decides.
Questions about one-click reject
Is a "Reject all" button legally required on cookie banners in the EU?
No law names the button, but a vast majority of EU authorities in the EDPB's cookie banner taskforce consider a banner with an accept option and no refuse option on the same layer to breach the consent rules. The CNIL and Spain's AEPD expect both options on the first layer.
What happens if my reject button does not actually block cookies?
It is a breach in itself. The CNIL's EUR 150 million fine against SHEIN in September 2025 was partly because new cookies were still placed, and existing ones read, after visitors clicked "Refuse all".
How long must a website remember a visitor's cookie refusal?
No EU-wide period is in force. The Digital Omnibus proposal would bar asking again for six months after a refusal, but as of October 2026 it is still a proposal, and national regulators set their own expectations.
Will browser-level consent signals replace cookie banners?
Not soon. The Commission proposed browser signals in November 2025, but the Council's text of 18 June 2026 removed that article, and the Parliament has not taken a position.
Does the "Reject all" button need to look identical to "Accept all"?
Identical styling is not strictly required, but both buttons need equal visual prominence. A bold, coloured "Accept all" next to a faint, outlined "Reject all" does not meet the standard regulators describe.
Can I use "Continue without accepting" instead of "Reject all"?
Some regulators accept other wording if it clearly means refusal and is as visible as accept on the first layer. "Reject all" is the clearest option and the least likely to be challenged.
Check your banner's reject button
If your cookie banner hides the refuse option behind extra clicks or muted styling, check it before a regulator does. The GDPR compliance scanner checks whether a page's banner has a reject button beside the accept button, and which cookies and trackers load before a visitor chooses.
