Consent Nudging: The Dark Patterns Regulators Are Now Fining

On January 6, 2022, the CNIL fined Google 150 million euros and Facebook 60 million euros for the way their cookie banners worked. The finding was specific: on google.fr, youtube.com, and facebook.com, accepting cookies took one click, and refusing them took several. Google's users needed five clicks to refuse. Facebook's needed a click, a scroll, and another click. The CNIL ordered both companies to provide a means of refusing as simple as the means of accepting, within three months, or face 100,000 euros per day of delay.

The legal basis was Article 82 of the French Data Protection Act, which implements Article 5(3) of the ePrivacy Directive. The CNIL's point was not that the banners were ugly. It was that the imbalance denied users freedom of consent, because a refusal path that is five times harder than the acceptance path is not a choice. The fines were a record at the time, and they were a signal: the design of the banner is a compliance question, not a design question.

150 million euros for five clicks

The European Data Protection Board's Guidelines 03/2022 on dark patterns in social media platform interfaces gave the pattern a name and a definition. Nudging is design that pushes the user toward the choice the service wants, by making one option easy and the other hard, prominent and hidden, bright and grey. It is not a grey area anymore, and it is not a matter of taste. The guidelines describe it as a practice that undermines the freedom of consent, which is the same reasoning the CNIL used in the Google and Facebook fines.

The definition matters because it moves the argument from intent to effect. A banner does not have to be designed to deceive. If the refuse path is harder than the accept path, the effect is nudging, whatever the designer intended. That is a test a regulator can apply from a screenshot, and it is a test most banners fail.

Nudging has a definition now

Count the clicks to accept, then count the clicks to refuse. If the numbers differ, the banner fails the parity test, and the size of the gap is the size of the problem. Then compare the buttons: same size, same colour weight, same position on the screen. A refuse button that is smaller, greyer, or hidden behind a settings link is a nudge, even if the click count matches.

Check whether the refuse path hides behind a second window. The CNIL's finding in the Google case included a specific detail: to refuse, users had to click a button entitled Accept cookies in the second window. The label itself was part of the deception. A refuse path that starts with an accept button is not a refuse path.

Put Reject all next to Accept all, same size, same colour weight, same screen, same number of clicks. Granular controls belong behind a settings link, not in front of the refusal. No pre-ticked boxes: the Court of Justice ruled in Planet49, case C-673/17, that pre-ticked boxes are not valid consent, because consent must be a clear affirmative action.

The test is a click count

Audit the banner the way a regulator would: count the clicks, screenshot both paths, and check the mobile banner separately, because mobile is where the refuse path most often gets buried behind a scroll. A banner that passes on desktop and fails on mobile is a banner that fails, because the regulator will test the phone.

Keep reading: How Much Does Your Consent Banner Weigh? Script Cost in Milliseconds, A/B Testing a Consent Banner Measures the Banner, Not Consent.

Parity is the fix

Frequently asked questions

What did the CNIL fine Google for in 2022?

Google was fined 150 million euros, and Facebook 60 million, because refusing cookies took several clicks while accepting took one. The CNIL ordered a refusal as simple as acceptance within three months.

What is consent nudging?

Design that pushes users toward accepting, like a big bright accept button and a hidden refuse path. The EDPB calls it a dark pattern in Guidelines 03/2022.

How many clicks should refusing cookies take?

The same as accepting. Parity is the test regulators apply, and the CNIL fined Google because refusal took five clicks against one to accept.

Are pre-ticked consent boxes allowed?

No. The Court of Justice ruled in Planet49, case C-673/17, that pre-ticked boxes are not valid consent.