Banner does not use dark patterns; reject equally prominent as accept
Why it matters
GDPR Art. 4(11) requires consent to be 'freely given' — a standard the CNIL (FR), ICO (UK), and Belgian DPA have each applied to banner design, finding that visually suppressed reject buttons constitute coercive design that vitiates free choice. Dark patterns documented by regulators include: ghost-styled reject buttons next to primary-styled accept buttons, reject paths buried behind multi-step preference dialogs, and labels like 'I understand' that conflate dismissal with acceptance. Data collected via these patterns has been ruled to lack valid consent under ePrivacy Art. 5(3).
Severity rationale
High because regulators in multiple EU jurisdictions have explicitly ruled that asymmetric button prominence constitutes a dark pattern that invalidates consent under GDPR Art. 7(4) and Art. 4(11).
Remediation
Match accept and reject button styles exactly — same variant, same font weight, same padding. The reject action must also be reachable in the same number of clicks as accept.
// WRONG — different visual weight
<button className="bg-blue-600 text-white px-4 py-2 rounded font-semibold">Accept All</button>
<button className="text-gray-400 text-sm underline">Reject All</button>
// CORRECT — equal prominence
<button className="bg-blue-600 text-white px-4 py-2 rounded font-semibold">Accept All</button>
<button className="bg-white text-gray-900 border border-gray-300 px-4 py-2 rounded font-semibold">Reject All</button>
If 'Accept All' is a one-click button on the main banner, 'Reject All' must also be a one-click button on the main banner — not a path through 'Manage preferences → uncheck all → Save'.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Cookie & Consent Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 4(11) — GDPR — consent must be freely given; dark patterns negate free choice
- gdpr · Art. 7(4) — GDPR — consent not freely given when bundled or coerced
- eprivacy · Art. 5(3) — ePrivacy Directive — requires unambiguous consent; dark patterns invalidate it
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cookie-consent-compliance·automated