Cookie banner requirements: no harder to reject than accept

The rule

No provision of EU law says in terms that a cookie banner must carry a reject button. The requirement is assembled from the consent rules.

The most direct statement from the European authorities is the Cookie Banner Taskforce report, adopted by the EDPB on 17 January 2023. By its own disclaimer the positions are a minimum threshold, not a greenlight for any banner, and each authority decides case by case.

National authorities have put the point more bluntly. The CNIL, announcing its amended guidelines and its recommendation of 17 September 2020, states that “refusing trackers must be as easy as accepting them” and, in the recommendation, advises an interface with “not only an accept all button but also a reject all button” (our translation). The Italian Garante’s guidelines of 10 June 2021 take a different route: closing the banner with the X must leave the default, no tracking, in place, with a separate command for giving consent.

How this is enforced depends on where the page is aimed. The ePrivacy side is enforced under each Member State’s own law, which must provide penalties that are “effective, proportionate and dissuasive” (Art. 15a). The CNIL’s Google decision rests on Article 82 of the French Data Protection Act, the national text implementing Article 5(3). On the GDPR side, Article 83(5)(a) places “conditions for consent” in the upper fine tier, up to EUR 20 million or 4% of worldwide annual turnover. The EDPB’s Guidelines 03/2022 on deceptive design patterns are addressed to social media platforms; for banners, the relevant EDPB text is the taskforce report.

What PeekWell checks and how

EU-03 asks one question: on the banner’s first screen, is saying no about as easy as saying yes? The scan answers it from the page as a visitor sees it, not from the consent tool’s settings.

The scan is automated. It opens your public pages the way a first-time visitor’s browser would and looks at the banner’s first screen. Is there an Accept all? Is there a Reject all, or something equal, beside it? It notes how the two compare in size, and how many clicks it takes to refuse everything non-essential against how many to accept. The finding states what was seen, such as “Accept all on the first screen, no reject control until a second screen”. Where a difference in prominence crosses the line is for you and the authority to judge, so the report shows it rather than ruling on it.

EU-01 looks at what loads before the banner is answered. EU-03 covers only the banner’s own design. The UK equivalent, with the Information Commissioner’s test, is UK-02.

The scan has limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. A banner shown only in some countries may not appear when the scan visits. A Passed means the expected behaviour was observed on the pages scanned. It doesn’t say the site complies.

Why it matters for a company

This is a design fact anyone can see from outside, which is why it recurs in enforcement. In the account-creation flow, the CNIL’s Google decision of 1 September 2025 describes the effect in numbers: before October 2023, accepting personalised advertising cookies took two clicks and refusing took six. In October 2023 Google added a button making refusal as easy as acceptance, and the CNIL found that the lack of informed consent still persisted. It fined Google LLC EUR 200 million and Google Ireland Limited EUR 125 million, ordered changes within six months, and attached a penalty of EUR 100,000 per day of delay. The amount also covers advertisements placed between emails in Gmail, not the banner alone.

The Confalonieri case is the same theme at a smaller scale. The Garante’s decision of 4 June 2025 on Confalonieri S.r.l., after an inspection of its website, records a banner that reappeared after a visitor clicked X and gave no warning that closing it left the default settings in place. There was no fine, but the Garante issued a formal warning and ordered the banner set up so visitors can give specific, informed consent to non-technical cookies.

The practical consequences come in three kinds. Consent that rests on a lopsided banner may not be valid, and under Article 7(1) the company has to show it was. What the tags collect afterwards is exposed too, because the taskforce takes the view that a failure under Article 5(3) means the later processing cannot be compliant (para. 24). And an authority needs no inside access to see the problem.

Smaller companies and larger companies

The rule has no size threshold, and a five-person shop and a global platform are judged on the same screen. What differs is how the asymmetry comes about.

In a smaller company the banner usually comes from a plugin or a hosted builder, and the asymmetry is an unchanged default. The tool ships with Accept all as a bright button and Settings as a grey link, and the Reject all button is switched off. The Confalonieri case began with an inspection of an ordinary company website and ended in a warning and an order, not a fine.

In a larger company the asymmetry tends to be a product decision. A flow such as account creation or checkout gets its own consent screen, built by a team that measures opt-in rates, and the version with the most acceptances can win. The Google decision turned on that kind of flow. With several domains and apps, the main site’s banner may be fixed while another property keeps the old design.

How to fix it

The aim is a first screen where yes and no take one action each. These steps fit most consent tools.

1. Look at the first screen as a visitor. Open the site in a private window and count the clicks to accept everything and to refuse everything non-essential. If the numbers differ, that is the gap a scan will report.
2. Put Reject all next to Accept all. Most consent tools have a setting for a reject button on the first layer. Switch it on. Use the same kind of control for both, the same size, in the same row.
3. Keep the wording plain. Use labels that say what the buttons do, such as Accept all and Reject all. Avoid Continue or Got it, and avoid a refusal that exists only as a link inside a paragraph.
4. Match colour and contrast. The reject text must be readable, and matching the buttons removes the argument about prominence.
5. Make closing the banner mean no. If the banner has an X, closing it should leave non-essential tags off and should not bring the banner back on every page, as in the Confalonieri case.
6. Check the second layer too. Pre-ticked boxes in the settings view do not count as consent, as the taskforce confirmed (para. 10). Leave non-essential categories off until the visitor switches them on.
7. Re-scan. Clear cookies and storage, reload, and run a scan again. The finding should show the same number of clicks for accepting and refusing.

Whether a design meets the rule in a given country is a question for your legal adviser. Peeky reports the buttons and clicks it saw.