Skip to content
EUID Audit service & seal, Home
Get your website audited

This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung

Data protection

When is a cookie banner a dark pattern?

Consent only applies if it is voluntary. A banner that offers consent as a large color button and hides rejection as a small grey text link guides the decision — experts call it a dark pattern, and the European Data Protection Board has classified it as inadmissible in its guidelines 03/2022. The privacy check area measures both elements in the detected banner and compares them: Is rejecting a button or just a link, and how large is its area in relation to accepting?

Two measurable indicators

The checking area recognises in the banner the elements whose label means agree or reject and reads two properties: the type of element — button or mere link — and the visible area in pixels. A finding arises when rejecting is just a text link while accepting is a button, or when rejecting area measures less than 60 percent of accepting area. Colour and contrast are not evaluated because they cannot be judged safely without context; But the size and design does. The finding does not change the point value - the question of whether rejection at the first level is even possible and whether it works, evaluate own rules.

Why equivalence is the condition

The GDPR requires voluntary, informed and unequivocal consent. The guidelines of the European Data Protection Board and several supervisory authorities have specified what this means for banners: rejection must be possible at the same level, with the same effort and the same visibility as consent. A banner that misses this equivalence receives clicks on consent – but no effective consents, and thus every cookie and tracker based on it lacks the basis. The correction is simple in terms of design: two buttons of equal size next to each other, the same typeface, the same form.

  • Design Reject and Accept as equal buttons at the same banner level.
  • Avoid rejecting text links if accepting is a button.
  • Check the defaults of your Consent tool: many offer an equivalent presentation as an option that needs to be turned on.
  • Test the banner on a mobile device – small reject elements are particularly easily overlooked.

Deutsche Fassung dieser Seite

  • Seal Digitale Barrierefreiheit
  • Seal Daten & Recht
  • Seal Technische Qualität
  • Seal Digital Excellence
  • Seal Cyberversicherung

Audited. For a better digital future.euid.com