The Reject-All Button: The Rule That Killed the Buried Refuse Link

The old banner had a bright accept button and a refuse link buried three clicks deep, in small grey text, under a heading called settings. The design was deliberate: the accept was easy, the refuse was work, and the work was the point. The CNIL ended that design, and the rule is simple: refusing must be as easy as accepting.

The refuse link used to live three clicks deep

The pattern was called a dark pattern, and the CNIL named it as such: a consent interface designed to steer the visitor toward acceptance by making refusal harder. The accept button was large, coloured, and on the first layer. The refuse option was a link, in small text, that opened a second layer, where the visitor had to find another link, which opened a third layer, where the refuse button finally appeared. Each layer lost visitors, and the loss was the conversion.

The CNIL's guidance, and the fines that followed it, made the rule concrete: the refuse option must be on the first layer, and it must be as easy to use as the accept option. Same layer, same effort, same visibility. A banner with a bright accept button and a refuse link in small grey text fails the test, even if the link works, because the effort is not equal. The dark patterns post covers the fines: the CNIL has fined companies for this exact design, and the fines are public.

The rule is not French only. The same principle runs through the GDPR's requirement that consent be freely given, and through the ePrivacy Directive's cookie rules, and the regulators across Europe have converged on the same test. The banner that buries the refuse link is non-compliant in every member state, not just France.

What the CNIL actually requires

The CNIL requires three things. First, the refuse option on the first layer, visible without opening a second layer. Second, parity of effort: the refuse must take the same number of clicks as the accept, and the same prominence. Third, no pre-ticked boxes and no implied consent: the visitor has to act, and the act has to be a choice. The Planet49 ruling from the Court of Justice of the European Union in 2019 is the authority for the third point: a pre-ticked box is not consent, because consent has to be an active choice.

The parity test is the one to run on your own banner. Open it, count the clicks to accept, and count the clicks to refuse. If the numbers differ, the banner fails. If the refuse button is smaller, greyer, or less prominent than the accept, the banner fails. The test takes thirty seconds, and it is the test the regulator runs first. The withdrawal post is the same principle from the other side: withdrawing consent must be as easy as giving it, under Article 7 of the GDPR, and a withdrawal buried in settings fails the same way.

The consent records post is the third leg: the banner has to keep proof of the choice, and the proof has to show the choice was free. A banner that steers the visitor toward accept produces records that show acceptance, and the records do not prove the acceptance was free. The proof and the design are the same compliance question.

The parity test you run on your own banner

Open your banner and answer three questions. Is the refuse option on the first layer, without opening settings? Does it take the same number of clicks as accept? Is it as visible as the accept button, in size, colour, and position? Three yeses and the banner passes. Any no and the banner fails, and the fix is in the design, not in the legal text.

The fix is usually one change: put a reject-all button next to the accept-all button, same size, same layer, same prominence. The opt-in rate will fall, and that is the point. The visitors who accept after the fix are the ones who actually consented, and the consent records will show it. The banner that loses opt-ins and gains compliance is the banner that works.

Frequently asked questions

Does the refuse option have to be on the first layer of the banner?

Yes. The CNIL requires the refuse option to be visible without opening a second layer, and as easy to use as the accept option. A refuse link buried three clicks deep in settings is a dark pattern, and the CNIL has fined companies for it.

What does consent parity mean?

Refusing must take the same number of clicks as accepting, and the refuse button must be as visible as the accept button in size, colour, and position. If the accept is a bright button and the refuse is small grey text, the banner fails parity even if the link works.

Are pre-ticked consent boxes allowed?

No. The Court of Justice of the European Union ruled in Planet49 in 2019 that a pre-ticked box is not consent, because consent has to be an active choice. The visitor has to act, and the act has to be a choice.

Will adding a reject-all button hurt my opt-in rate?

Yes, it will fall, and that is the point. The visitors who accept after the fix are the ones who actually consented, and the consent records will show it. The banner that loses opt-ins and gains compliance is the banner that works.