The close button that is not consent: designing a banner exit that holds up

Under the GDPR, consent is a freely given, specific, informed, and unambiguous indication of wishes by a statement or clear affirmative action. The Court of Justice Planet49 judgment added the operational details practitioners still cite: pre ticked boxes are not consent, and consent must be specific to purposes. An X that closes a banner expresses none of that. It expresses a wish for the banner to go away, which is a wish about banners, not about cookies.

The ePrivacy rules sit underneath: storing or accessing information on a user device needs consent unless strictly necessary for a service the user requested. So the legal default after a dismissal is not ambiguity. It is the same state as before the banner was touched: non essential storage stays off. A design that loads analytics the moment the banner disappears has made a decision the visitor never made, and has usually logged it as theirs.

What the law counts as a choice

Pattern one: dismissal defers. The banner closes for the page, non essential tags remain blocked, and the choice is offered again on the next page view or the next visit, depending on how much persistence you judge reasonable. This respects the visitor intent, which was not now, and keeps the door open. Its cost is banner recurrence, which product teams hate and regulators do not care about.

Pattern two: dismissal declines for the session. The banner closes, tracking stays off, and a strictly necessary record notes the dismissal so the banner does not nag on every page of the visit. On the next visit the choice is offered fresh. What neither pattern may do is load the trackers, write an accepted status, or record purposes as granted. The record must say what happened: banner dismissed, no choice made, defaults held.

The two defensible patterns

The drift is rarely a conspiracy. An analytics stakeholder sees session counts fall after a compliant banner ships, because real consent rates are lower than assumed consent rates, and asks whether the close button could count. A vendor default helps: some banner tools ship with close meaning accept, or with implied consent settings written for other legal regimes, left on in the European configuration. Convenience, configured by someone else, becomes your liability.

Why sites drift into treating X as yes

Keep reading: Consent Mode default states by region: the setting that decides data before the banner, The reopen link in the footer: the smallest consent feature with the longest memory.

Designing the exit honestly without wrecking the page

Audit your own tool rather than trusting its label. Click only the X on a fresh browser profile, then read the consent record your system wrote and the cookies actually set. If the record says accepted, or advertising cookies exist, your banner is manufacturing consent. CNIL guidance and several European regulators have treated exactly this pattern as invalid consent in enforcement and guidance, and the fix is a configuration change you want to make before it is their finding.

A compliant X does not have to be a dark pattern in reverse. Make the genuine choices the easy ones: accept and reject presented with equal prominence, as CNIL and other regulators expect, and the X as a quiet third route for not now. Size and contrast should track the honesty of the function. An X that is large, glowing, and the only obvious exit is a funnel wearing a close button costume.

Test the banner the way an auditor will: fresh profile, one action at a time, record inspected after each. Accept writes accept. Reject writes reject. X writes neither. That three line test, run after every banner or tag manager change, is the cheapest consent insurance a site can buy, and almost nobody runs it.

Frequently asked questions

Is closing a cookie banner the same as rejecting cookies?

Not legally, but the safe operational treatment is close to it: non essential cookies and trackers must stay off either way. The difference is in the record and the follow up. A rejection is a recorded choice you should honour for its stated period. A dismissal is no choice, so the banner may be shown again on a later visit.

Can we count banner dismissal as implied consent?

For non essential storage under European rules, no. Consent requires an unambiguous affirmative act, and guidance from European regulators and the Planet49 judgment reject implied and pre ticked models. Implied consent settings borrowed from other regimes do not transfer. If your tool has such a setting on for European traffic, turn it off.

What cookies may run after a visitor closes the banner without choosing?

Only strictly necessary ones: the storage required to deliver the service the visitor requested, such as security, load balancing, the basket, and, reasonably, a record that the banner was dismissed so it does not reappear on every page of that visit. Analytics and advertising stay off.

How should a dismissal be written in the consent log?

As its own event: banner dismissed, no purposes granted, timestamp, and the banner version shown. Never map it to accepted in the log or in downstream systems. If your reporting cannot represent a dismissal distinctly, that is a tooling gap to fix, because auditors read logs literally.