Dark patterns are manipulative design practices that deceive users into making choices they would not otherwise make. In cookie banners, they are not only unethical but also explicitly illegal under EU data protection law. With European regulators now actively targeting deceptive consent interfaces: and fines climbing into the hundreds of millions of euros: understanding what constitutes a dark pattern and how to avoid one has never been more important for website operators across every industry.

What are dark patterns?

The term "dark patterns" was coined by UX researcher Harry Brignull in 2010 to describe user-interface tricks that exploit cognitive biases and habitual behaviours. In the context of cookie consent, dark patterns are design choices that steer visitors towards accepting all cookies while making it unreasonably difficult to refuse non-essential tracking.

Dark patterns in cookie banners typically involve:

  • Making it harder to reject cookies than to accept them
  • Confusing or misleading wording
  • Hidden or obscured options for managing preferences
  • Visual manipulation through colour, size and placement of buttons
  • Forced action: blocking access to the site until the user consents
  • Nagging: repeatedly asking for consent after the user has already refused

The European Data Protection Board (EDPB) published dedicated guidelines on dark patterns in social media interfaces in 2022, and national authorities have since applied the same principles specifically to cookie banners. The concept has also been codified in the Digital Services Act (DSA), which explicitly prohibits online platforms from designing interfaces that deceive or manipulate users.

Why dark patterns are illegal under GDPR and the ePrivacy Directive

Under the GDPR, consent must be freely given, specific, informed and unambiguous (Article 4(11)). The ePrivacy Directive (Article 5(3)) further requires prior consent before storing or accessing information on a user's device: with the sole exception of cookies that are strictly necessary for a service the user has explicitly requested.

Recital 42 of the GDPR clarifies that consent is not freely given if the data subject has no genuine or free choice or is unable to refuse without detriment. Recital 32 states that silence, pre-ticked boxes or inactivity do not constitute consent. Any design that nudges users towards "Accept all" while hiding or complicating the reject option undermines these requirements and renders the collected consent invalid.

In practical terms, this means that if a Data Protection Authority (DPA) determines that your cookie banner uses dark patterns, every consent you have collected through that banner may be treated as void. You could face enforcement action not just for the banner design itself, but for all subsequent data processing that relied on those invalid consents: potentially affecting years of accumulated analytics and marketing data.

Examples of illegal practices in detail

1. Asymmetric buttons

This is the most widespread dark pattern. The "Accept all" button is large, brightly coloured and prominently positioned, while the "Reject" or "Manage settings" option is a small, greyed-out text link tucked away in a corner. Research by Nouwens et al. (2020), published in the proceedings of the ACM CHI Conference on Human Factors in Computing Systems, found that making the reject option less prominent increased acceptance rates by over 20 percentage points: but this is precisely the kind of manipulation regulators consider unlawful.

The CNIL's guidance is explicit: rejecting cookies must be as easy as accepting them. The buttons must be of equal visual weight: same size, comparable colour contrast and the same hierarchical level in the interface. The Italian Garante and the Spanish AEPD have issued near-identical positions, creating a consistent standard across the EU's three largest enforcement jurisdictions.

2. Hidden rejection

Many banners place "Accept all" on the first layer but require users to click "Manage preferences," navigate to a second screen, untick individual categories and then confirm: sometimes across three or four clicks. Accepting cookies takes one click; rejecting them takes four. This asymmetry is a textbook dark pattern that regulators have targeted in several high-profile decisions.

In its January 2022 enforcement actions against Google and Facebook, the CNIL specifically cited the fact that refusing cookies required several clicks, while accepting them took only one. The fines were EUR 150 million for Google and EUR 60 million for Facebook (Meta). Both companies were ordered to provide a first-layer reject button within three months. The decisions were upheld on appeal, confirming that multi-layered rejection is non-compliant when acceptance is immediate.

3. Pre-ticked consents

GDPR requires an affirmative opt-in action. The Court of Justice of the European Union (CJEU) confirmed this in the landmark Planet49 ruling (Case C-673/17, October 2019): pre-ticked checkboxes do not constitute valid consent. The Court held that consent must involve an active indication of the user's wishes, and that a pre-checked box does not satisfy this requirement. Despite this clear legal precedent, many websites still display cookie preference panels with non-essential categories (analytics, marketing, functional) ticked by default, expecting users to manually untick them. Every consent collected through such a mechanism is legally invalid.

4. Confirm shaming

Confirm shaming uses emotionally manipulative language to guilt users into consenting. Examples include:

  • "No thanks, I prefer a worse experience"
  • "I don't care about personalised content"
  • "Continue with limited functionality"
  • "I'll miss out on relevant recommendations"

Such wording implies that rejecting cookies has negative consequences for the user, which undermines the "freely given" requirement. The language must be neutral and factual. "Reject non-essential cookies" or "Continue with necessary cookies only" are appropriate alternatives. The EDPB's 2022 guidelines on dark patterns specifically identify emotional steering as a deceptive practice that invalidates consent.

5. Cookie walls (forced consent)

A cookie wall blocks access to the website entirely unless the visitor accepts all cookies. The EDPB initially took the position that cookie walls are generally not compliant with GDPR, since consent cannot be considered freely given when access to a service is conditional on it. However, some nuance has emerged: the Dutch DPA (Autoriteit Persoonsgegevens) has accepted cookie walls in limited cases where a genuine equivalent alternative exists (e.g., a paid subscription without tracking). The Austrian DSB has taken a similar position. In practice, for the vast majority of websites: particularly business sites, e-commerce stores and information portals: blocking content until consent is given remains unlawful.

6. Nagging and repeated prompts

Some websites re-display the cookie banner on every page load, every new session, or after a short period of time, even when the user has already explicitly declined. This "consent fatigue" strategy aims to wear users down until they finally click "Accept." Under GDPR, once a user has made a choice, that choice must be respected for a reasonable period. The EDPB cookie banner taskforce recommended that consent decisions should be stored for at least six months. Repeatedly asking for consent is a form of coercion that violates Article 7(4) and the principle of fairness in Article 5(1)(a).

7. Misleading categorisation

Labelling marketing or tracking cookies as "functional" or "performance" cookies to place them under a category that users are more likely to accept: or worse, to classify them as "strictly necessary" so they bypass consent entirely: is a deceptive practice that violates the transparency principle of GDPR (Article 5(1)(a)). For example, classifying the Facebook Pixel as a "functional" cookie, or treating Google Analytics as "strictly necessary," misrepresents the purpose of these tracking technologies and deprives users of the opportunity to make an informed choice.

Major enforcement actions against dark patterns

European regulators have moved from issuing warnings to imposing substantial fines. The following cases demonstrate the regulatory trajectory:

  • Google (CNIL, January 2022): EUR 150 million: rejecting cookies required multiple clicks; no equivalent first-layer reject button on google.fr and youtube.com.
  • Facebook/Meta (CNIL, January 2022): EUR 60 million: same issue as Google; the "Accept" button was prominently displayed while refusal required navigating through settings on facebook.com.
  • Microsoft (CNIL, December 2022): EUR 60 million: Bing's cookie banner lacked a first-layer rejection mechanism equivalent to the acceptance button, and advertising cookies were deposited without valid consent.
  • TikTok (CNIL, December 2022): EUR 5 million: rejecting cookies was more complex than accepting them; the platform also dropped cookies before obtaining valid consent.
  • Criteo (CNIL, June 2023): EUR 40 million: the ad-tech firm failed to verify that its partners obtained valid consent, and the consent interfaces used by those partners employed dark patterns.
  • Voodoo (CNIL, January 2023): EUR 3 million: the mobile game developer set advertising trackers via its mobile apps without valid prior consent.

Beyond France, the Italian Garante, the Spanish AEPD, the Austrian DSB and the Belgian APD have all issued guidance or decisions specifically addressing dark patterns in cookie consent interfaces. In 2024 alone, the AEPD imposed over 200 sanctions related to cookie compliance. The trend is clear: enforcement is intensifying across the entire EU.

How to recognise a legal cookie banner

A compliant cookie banner should meet all of the following criteria:

  • Equal prominence: Accept and reject buttons are the same size, colour contrast and position hierarchy
  • No pre-ticked consents: All non-essential cookie categories are off by default
  • Neutral language: No emotional manipulation, confirm shaming or misleading descriptions
  • Equal effort: Rejecting takes the same number of clicks as accepting (ideally one click each on the first layer)
  • Granular control: Users can choose which categories to accept (analytics, marketing, functional) independently
  • Easy withdrawal: Users can change or withdraw consent at any time with the same ease as giving it (Article 7(3) GDPR)
  • No content blocking: The website is accessible regardless of the consent decision
  • Transparent information: A clear explanation of what each cookie category does and which third parties receive data
  • No cookies before consent: Non-essential scripts are blocked until the user makes an affirmative choice

The EDPB cookie banner taskforce findings

In January 2023, the EDPB published a report from its cookie banner taskforce, which analysed complaints filed by the NGO noyb (None Of Your Business, led by Max Schrems) against over 700 websites across Europe. The taskforce identified several key issues that have since become the benchmark for compliance assessments:

  • The absence of a reject button on the first layer is non-compliant: a "manage preferences" link is not an adequate substitute
  • Deceptive button colours and contrasts designed to steer users towards acceptance violate the requirement for freely given consent
  • "Legitimate interest" cannot be used as a legal basis for advertising cookies: consent is required under Article 5(3) of the ePrivacy Directive
  • The withdrawal of consent must be as easy as giving it (Article 7(3) GDPR): burying the preference centre in a footer link is insufficient
  • Consent collected through non-compliant banners is invalid, and all data processed on the basis of that consent is unlawfully processed

This report has become a de facto standard that DPAs across Europe now reference in their enforcement actions and compliance guidance.

Practical checklist: auditing your banner for dark patterns

Use this checklist to evaluate whether your current cookie banner may contain dark patterns:

  • Is there a "Reject all" or "Necessary only" button on the first screen of the banner?
  • Is this button the same size, colour and visual weight as "Accept all"?
  • Are all non-essential cookie toggles off by default in the preference centre?
  • Is the language factual, neutral and non-manipulative?
  • Can a user reject all non-essential cookies in a single click?
  • Does the banner stop reappearing after the user has made a decision?
  • Can users access a preference centre to change their choice at any time?
  • Are cookie categories accurately and honestly described?
  • Does the banner avoid blocking access to the website content?
  • Are non-essential cookies actually blocked before consent is given (verify with browser DevTools)?

If you answer "no" to any of these questions, your banner likely contains a dark pattern and should be revised before it attracts regulatory attention.

Why avoiding dark patterns is also good business

Beyond the legal risks, dark patterns carry significant business costs:

  • Eroded trust: Users who feel manipulated are less likely to return, convert or recommend your brand. A study by the Baymard Institute found that perceived dishonesty in consent interfaces reduces overall site trust by up to 40%.
  • Negative publicity: Organisations like noyb actively name and shame companies that use dark patterns, and their complaints have generated major media coverage across Europe. A single viral social media post about your deceptive banner can cause lasting reputational damage.
  • Complaints to authorities: The GDPR gives every individual the right to lodge a complaint with a supervisory authority (Article 77). It takes only one complaint to trigger an investigation. Noyb alone has filed thousands of complaints across the EU.
  • Invalid data: Consent collected through dark patterns is legally void. If your marketing and analytics data is built on invalid consent, it could be challenged or rendered unusable in a regulatory audit. Rebuilding years of baseline data is not feasible.

Conversely, transparent and user-friendly consent interfaces often achieve surprisingly high consent rates: typically 60–80%: because users appreciate honesty and clarity. The data you do collect is higher quality, legally defensible and more trustworthy for business decisions. Ethical design is not a compromise; it is an advantage.

How Consentio helps you avoid dark patterns

Consentio's cookie banner is designed from the ground up to be fully compliant with GDPR, the ePrivacy Directive and EDPB guidelines. The banner provides equally prominent accept and reject buttons on the first layer, no pre-ticked checkboxes, neutral language and granular category controls. Non-essential scripts are blocked until the user makes an explicit choice. Every consent is logged with a timestamp and the exact banner configuration, giving you a complete audit trail that satisfies regulatory requirements.

A transparent, ethical approach to consent is not just a legal requirement: it is a competitive advantage. When visitors trust your website, they are more likely to engage, convert and come back. With Consentio, compliance is built in from the start, so you can focus on growing your business with confidence.